| civilianurinedtsraov.shop/api;f |  172.67.197.146 | 403 Forbidden | 5.8 kB |
URL User Request GET HTTP/1.1civilianurinedtsraov.shop/api;f IP172.67.197.146:80
File typeHTML document, ASCII text, with very long lines (14131), with no line terminators Hash563ca8f80421938c8f2cf04699c62493 99a0b07074472bbd4fb80dae5d7c3ccca56f3d2b 954eef6ac0a6c01e121fa4ec124bc569f1694f5db5feaf0650b44001666e1ae4
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /api;f HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 May 2024 19:37:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: IuH4s1J8YBnZqaAQHnfxi3r1CxnP7ZKGUhfZ2/yJQwLXYB8GQe2tuxTasdxXShmcr+UFw05sQJQOWuuoI1jBuQeCrDRhg9jwTtarsrklQvWt0HV7SmymWuaHX7deVbgQPnMbUxEa76qnkfplT2xlsQ==$ddCul8W7ujkB5naAxUNLOQ==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yG%2BzXF5dClHB0Zgn1nLaVpqzDC5LTZzLs4ifHr8mCQzH9Jdh%2BrnFZvmvWYqbg5XpaR6QOyykyQn1%2FD9hnFrfOoFU3luUIxVsdXgOjA1nMjtvrkJr6Q4rVJun9%2FYpeaIeajdQmhFGn5YDTSFi"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8897fb268e9db511-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8897fb268e9db511 | 172.67.197.146 | | 111 kB |
URL civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8897fb268e9db511 IP172.67.197.146:0
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size111 kB (111352 bytes) Hashb3c77b4283e06acf36cb43e4a6591bd1 3e7da228f959e60fae6ffa66062e9497ac11a672 70f20c13ad01815a05d18f87c2c738e44701c9bec8b022ccfd316f70adb26b9d
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8897fb268e9db511 HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f?__cf_chl_rt_tk=Y8el0wgJwtxnr2JwT7BDcMurR1obl4WrPnRUMsz53sI-1716665857-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 May 2024 19:37:37 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1nNmUrUde3FO2U9Rkl9BJZg%2Ff2lHTWVwy3Or4O3vAJ1bbzwTKEOe%2BKKsbMmMDBA79UCOwKaEOS4DeTP8DJ2JKal1e8xi6eIiv67wO1AjT%2BYOMDVG8yX2HYkSgREUukjOjFC8QioWPk%2BepVoD"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8897fb282f4856ab-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/favicon.ico | 172.67.197.146 | 403 Forbidden | 5.8 kB |
URL GET HTTP/1.1civilianurinedtsraov.shop/favicon.ico IP172.67.197.146:80
Requested byhttp://civilianurinedtsraov.shop/api;f
File typeHTML document, ASCII text, with very long lines (14242), with no line terminators Hash487696491d98f141d7ecf8d735615b08 62472aa82de35c11e7288fb0c497c4e2ddf3ad10 f5c637ae82563ad224dbfe6f362f73a6c196ec204b694bffd0d93a5923a1c6fd
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f?__cf_chl_rt_tk=Y8el0wgJwtxnr2JwT7BDcMurR1obl4WrPnRUMsz53sI-1716665857-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 May 2024 19:37:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: pebpysPbNAchC+7QBevX0x9bmjAxVXnVI5t7FCoUJhOLmEKxYz3xrOSGxn1md9rVkhXOb7tfvRDnieVZc9cqfl23wqXZM+ldJhSwB61WsVv4ZLrdntOIoV55mn7/S+Mt3KKZfawZhDXx01T9lU7evg==$xnN2N75lOODlcBn1eE0HmA==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QMSTgKyTIkxoB2Hek%2BaCQyO%2F01huYPeTtYOeMAtOdlhEltCvFDrOo1C7k5J44QqHAAtiht2llrqy9t%2FiEG27EDUrTKb4jdznezHKh0rivfE55glWbhlnfreDR5W79wry1YyCeE0986mw%2BthW"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8897fb286f8756ab-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/favicon.ico | 172.67.197.146 | 403 Forbidden | 5.8 kB |
URL GET HTTP/1.1civilianurinedtsraov.shop/favicon.ico IP172.67.197.146:80
Requested byhttp://civilianurinedtsraov.shop/api;f
File typeHTML document, ASCII text, with very long lines (14156), with no line terminators Hash15f5006177b095feee4985796369fd6c 541f43534b4957023533322b8db5d0215dae8f34 a656247f9f252eec02b84c0a2449de7312297ece2d63ddd8f730ff4ada070d97
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 May 2024 19:37:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: FLDLVtLq9oEFST9TsHEsPzK4xDIV4hqiBk60+bq2WaP9Rb6phbzJtPxGZSX+WB3f7PKZqnUNqjbcY1jrz7ZcdtA960jG+YcVq3H9v1FtF8cCf7g1ZWmy6yg89Skcug8DXZ2Cd/ULJI+kHO8bAno/2A==$ngHLVq3HM3MrALlEjagdXQ==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rYmq%2FvUVbBJQCJVRfSlgI3CoTar0jnnYdnRVMKMUDfxfRAY8Hs%2FnO70Tiu2ToB1G0TGmDDKJ%2B6knwI14%2Bbu%2F3GD7pz2Bd2uv%2BV38fQEvoPEcVHh%2FGXJeR6EdfLikYmmwBzKplP5HZiHNZNE8"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8897fb28cc557131-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/476572979:1716664250:Y9NXlz5P6QaQSMuBDPYyJskb7xVtg3YMNczXyE5oHZM/8897fb268e9db511/0595bff3c2965b3 | 172.67.197.146 | | 12 kB |
URL civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/476572979:1716664250:Y9NXlz5P6QaQSMuBDPYyJskb7xVtg3YMNczXyE5oHZM/8897fb268e9db511/0595bff3c2965b3 IP172.67.197.146:0
File typeASCII text, with very long lines (16600), with no line terminators Hash2218ea167679d8e38db23de90a670573 6dce10681f6a28068fe35fe6459f778c320d358c ee4c438ed07cd9ca77f5d410c1f408e1690d997695b8603e3c9382c06100c1b2
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/476572979:1716664250:Y9NXlz5P6QaQSMuBDPYyJskb7xVtg3YMNczXyE5oHZM/8897fb268e9db511/0595bff3c2965b3 HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f
Content-type: application/x-www-form-urlencoded
CF-Challenge: 0595bff3c2965b3
Content-Length: 1812
Origin: http://civilianurinedtsraov.shop
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 May 2024 19:37:37 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: fBBXIKFL99qdDBGgtc4wBSBKyjT2KQ25+S1y9w6Xw3P5QWxNptbz1JWb26d+TsBx$Y9Olkoy+gBoZ/VOzO/znvg==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QYy0B1K%2BYH9Hcp1CO6CLUO5uXVgbT7SnDVylnorbuMymSlMk7DV7bPkVfPRrii1AhlspUYQqcrDCoyOopzfzFrv1AxkvhcQHncCliiiwN0G5Ikf%2BkbdOAzxVtPBDDlsIO8rMBrq03DYZRH2B"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8897fb29be061c02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D |  104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.3.184:0
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:37 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 8897fb2b9b540b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal | 104.17.3.184 | | 28 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal IP104.17.3.184:0
File typeHTML document, ASCII text, with very long lines (42150) Hash860ac1b9534462b3445bdd74d6a895d4 7741b57d80bd32db9c3c2d1960d4cb79f247403a d1b983aeb439ac1e0c51baa503706ff0f51779b00775dad900a652ad71cfef73
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:37 GMT
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
referrer-policy: same-origin
server: cloudflare
cf-ray: 8897fb2b1afe0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8897fb2b1afe0b41/1716665858127/Ik-8IfRjtA7pzM- | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8897fb2b1afe0b41/1716665858127/Ik-8IfRjtA7pzM- IP104.17.3.184:0
File typePNG image data, 41 x 28, 8-bit/color RGB, non-interlaced Hashf281796351ef24fc6d89b81965903d9f 19325cf6732c061863b52e1ecc8129234743e197 e48ddd6d8f2c3ad7353766baa99ca4484a33d1fb6dd3e0c7a4344ab012eacfce
GET /cdn-cgi/challenge-platform/h/b/i/8897fb2b1afe0b41/1716665858127/Ik-8IfRjtA7pzM- HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:40 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 8897fb3e39970b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/971156802:1716664328:FabNBeYz8OAgFs9420DcC0pmHkg3m8l6e9sGZOExuZI/8897fb2b1afe0b41/5c72911794b874c | 104.17.3.184 | | 3.1 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/971156802:1716664328:FabNBeYz8OAgFs9420DcC0pmHkg3m8l6e9sGZOExuZI/8897fb2b1afe0b41/5c72911794b874c IP104.17.3.184:0
File typeASCII text, with very long lines (956), with no line terminators Hash5abc78125a3f4e876bd1f62948ae8023 789385ab84d29aaf89959af5b6ffd3e1a1dc6897 6f60522895d5949e3956a2167706dcd1e1efedc8d9511b4c25da2f092758c70c
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/971156802:1716664328:FabNBeYz8OAgFs9420DcC0pmHkg3m8l6e9sGZOExuZI/8897fb2b1afe0b41/5c72911794b874c HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 5c72911794b874c
Content-Length: 40325
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:45 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: Cg/7YZRxt3lyeFwSYEMxY4mfgkRfVHODFyqJY//u7cwQLXcVcpBM2G3gSdVlGOYBDPORdr83wFvXc2CKqgqV56YhbAhCI1FKbxbTgmTr7SQ=$ynAnLGYC2C487DX9UN/YcQ==
cf-chl-out-s: wnz6F/BKhUk8T+DyIl/wPp+nLBHSNsGVbm6MNibpCNDFL94OxKRcoMzKIm9wtalnazoy0v5bTpnWy7jsb9kIBvbdJVSAlbkMAeLyDP3+5NGqAbyZDn2a5VT9cVhY9eCFypdphFo+4IKMYCJZOS/jUItoUn24E3+XPSu5hS+3cCd21zwzSBo3kT6m8X8sosDxI28x/J54OZhs+O6niP+DONmfm5OfHg3AOHqxNo/nUIjvJzMi1X0m61fbzkXn0pM9FsYn93iA9lyDGyS/ghUEXnuHPgXkXCKPjmwa6EeiHaEIxziQU9ryYHZts1WJH4kxFd5zkIWHc/5LvpUfonyDSPC4o9JCsOADVT7GhsSlY5/33BtgQAk+Kp9T2nCpx6ZU5pht2sGGGEDnKoJmlHi+sUGrfXplzHsbj6+kAt1/2yaff04shgPuDzna83rpsOSKsvp5mQBxEB6D4JlEm/SIcaiVyxES9mOFoSIq4f8R8fzfi8yRWR81zzeHWZacJDzJZRfv/XpMTSwEHpzbuRW0MR2yH15/+vC9jxADQWIA0Xwn8RfMvd7z2fsrLh1fnsjMMaJ8x69K+llMHVvdBOTBNyva2Hr7MfYRABBpZSc4Ev1E6xTYruZ1w/v4PiLv4jdYkTHqW/LmZVEQ4C8moMA7YaIu8mopKEzc0pnmX30Y9V8kv5Z7EoblTx6hXEo9axYGFgxovxvthbGMgxI9xH4jBj2luwPqd58f+PQpKnirSSTc6nNPjq7t8+u7xftHbQpFxW9ukxWPX6sHrHn0E4VKUNGeA1sGz36Ba2Q7U+S8CMI=$dvodLeS88TE1uGIo+AGXQA==
server: cloudflare
cf-ray: 8897fb585e650b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/971156802:1716664328:FabNBeYz8OAgFs9420DcC0pmHkg3m8l6e9sGZOExuZI/8897fb2b1afe0b41/5c72911794b874c | 104.17.3.184 | | 94 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/971156802:1716664328:FabNBeYz8OAgFs9420DcC0pmHkg3m8l6e9sGZOExuZI/8897fb2b1afe0b41/5c72911794b874c IP104.17.3.184:0
File typeASCII text, with very long lines (65536), with no line terminators Hash46007e3355a2bf14357569b384288ff8 67873a7574600380e8aebe75f160446c9c7a08f1 63e2c517077f5ee8480edaf624bf5dfa23f50474001db5a19d378180228609ff
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/971156802:1716664328:FabNBeYz8OAgFs9420DcC0pmHkg3m8l6e9sGZOExuZI/8897fb2b1afe0b41/5c72911794b874c HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ta1co/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 5c72911794b874c
Content-Length: 3434
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:38 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: helg5CvAlglWY7QFRCrDT8U+w2rS6nQ/JXBlwIVKdx9NldlB1xnBrWPn7g+zyZarBjcbzw7pNZmu7j1IqkYdml9E0UBzrzd2jfqq6dQovJYSir43XcYSXfdE+cz2f/dwr3T8DbA/v6+JYPgtYRvw1hdjIru1+8oudU+ZYlNmYJ3xhbe+F1XIBWDIt2s1PMfqPhV/TXYCXNw4cqYgToDQTYGKV/CuI5d6w3CapK7D/i0qfxdH8oOIs1fM9xwYYI+jqXP3HkZcCLJwVzsgTIlqBzDJbirKlRAkjWVobBPuc1cp9EvhP5+gC/+oFnrRSOH87XmdNA3oSpe+fHY5AU3POKBmhyowoAJJk/fnvmSZBGmNGPig2TdjP15ndv6l3MPTdZHxLWzri51shsviKwlnY9zexmdgrWlIO3+mdiuHd5mo+oGKXCWdZ8lMaUvnHELOqjr/UbDZ/np2ZaPLYXHijw==$iuDtLn6uaI7jcnqkP44D3w==
server: cloudflare
cf-ray: 8897fb2d3c7f0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| civilianurinedtsraov.shop/api;f | 172.67.197.146 | 403 Forbidden | 5.8 kB |
URL User Request GET HTTP/1.1civilianurinedtsraov.shop/api;f IP172.67.197.146:80
File typeHTML document, ASCII text, with very long lines (14152), with no line terminators Hash602c5f087ef103f637c10baa3e3977f4 0affa200df4bf4cadca4ed8b7c58a5249af4a0f1 f5a1ef2e73a1c7092041fcfed13daf040cecb6676107940ab5e62f7c6a740f4a
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /api;f HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 May 2024 19:37:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 7An0iw1uDaGXbM0LrkITdVwUVnY6QbMID+3PK7j0hf2a+hqvWu6qt+7UV9qwVvk+OjxXy5QZOoZDElnWxLH4bN/r7MYD7ZMdb8jqShMzcJeroobPCvf5BjYnwSKYo/xMI1Irx2WNNyVK7G6x5O+afg==$3/aErdegS9bO7/PUnNx0tw==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PD4bK8%2BG7%2FBO%2Bcot%2BncZHKT%2BGQ4DxEawm8HGlDm3aN615T92hjdNXSO4m9w0%2FfsBXEwdO7bULW6gbwZYDOc0CGcUGWaYr2axAnOtVIhkzEfFUJbWbH5%2FTsKjtcWJFmpgARG2I16KPKF8lHJF"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8897fb65d8701c02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8897fb65d8701c02 | 172.67.197.146 | 200 OK | 114 kB |
URL GET HTTP/1.1civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8897fb65d8701c02 IP172.67.197.146:80
Requested byhttp://civilianurinedtsraov.shop/api;f
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size114 kB (114024 bytes) Hashceded6ee195f70620b58110ce7ac9cc6 e690324b54d63e32e7fc904f10f8a9d28b808c8b 753010b9a338e102e8f4af21f6896a6200afc0cf452fec30b895c5695d811c63
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8897fb65d8701c02 HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f?__cf_chl_rt_tk=Dm6eg2qi3u_CLLBvrqre4OoaXn4ax17yw6mcEv4Jpig-1716665867-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 May 2024 19:37:47 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mg%2B77bDiL5XpLRgn9wMj6TCnsPu8UJRn8%2FEoZTetdLRjer8BwDWVjjzKEtRNNObRcLIN3b6Ubw0eF3ri1IoUyA1waUVb5P4rJyisR1vicLN2l%2FYMLtNJKSV4%2BN53ssa7l2NYkp3fUjcZmSTV"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8897fb665c127128-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/favicon.ico | 172.67.197.146 | 403 Forbidden | 5.9 kB |
URL GET HTTP/1.1civilianurinedtsraov.shop/favicon.ico IP172.67.197.146:80
Requested byhttp://civilianurinedtsraov.shop/api;f
File typeHTML document, ASCII text, with very long lines (14263), with no line terminators Hash7b487979263b46c633e1fa546e902745 896da9c0ca1cd5efdeedb268811504ea9bd9e08c 86314cded182a1a247f347f34f83e859e5a9fcd6b7c3d7a0d00bba02eeeb279d
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f?__cf_chl_rt_tk=Dm6eg2qi3u_CLLBvrqre4OoaXn4ax17yw6mcEv4Jpig-1716665867-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 May 2024 19:37:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: IQg22hZNmECPf8fbYiyjKS19xtNjKUPBR001K0b4a+5F3M+KxBW8m22ONWcKvy1tAck41AtohmhRKZ9GTujVJVANVs4pdxO+jrU23rsZmVnjsJMQpeyJ0h2J3YQa07cZ4xWemJdrF85nsvm952PcyQ==$bgrzBsnIWsFkfetbpTH2hg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ggQLZerZjvJMPCfpPFe0FjAh6vX2Rvf7XivGz8T3P7l4AXNq%2BTg4bJLVmZYwpetc8ZBxRCoAFPEXqlCfUX31UDFiIYsEuflfRiUIt24IYRA1un3V1kWwm7OatW2kpQtjGtkDfW4oKGroDY5D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8897fb66ccd57128-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| civilianurinedtsraov.shop/favicon.ico | 172.67.197.146 | 403 Forbidden | 5.8 kB |
URL GET HTTP/1.1civilianurinedtsraov.shop/favicon.ico IP172.67.197.146:80
Requested byhttp://civilianurinedtsraov.shop/api;f
File typeHTML document, ASCII text, with very long lines (14178), with no line terminators Hashfa9fbdd6ccd81d0d572077e883c9174b ca055968875931745a1101cbe0acad8964fd3be6 7f5b4c8a87e0c08c515b10c7d106e14a7bc7495d0bcca3b8b730097c794e120f
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 May 2024 19:37:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: ytuNrB159Thi2Slu1BkdVtAyGNJT5eKJR6rBo7Cu5AOJ0rVJL/lqFmux28K+tCS8//NwbP6d3EB5jnKjkXU0hzXL2IFJh4W7lrdUA9CcN4xnLNg3gwwcMB9PjtTYQCnseZseWzvkm0HyIiLjLcjYig==$GkqkOnaBYqzTVzVUE1tQkA==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uUPw%2Bq7ECmT0KRXevoN0iZgvqwksGCkjGOBwV%2BhSz8C1meCjK%2BBSWYmF4CmgC0f1uooWzGu%2BZ1JBUS8Aw5LpIN9XtIgCvGGmIofV%2F7LJyJDlo1zRjppTgRtjgGhvI4x3xChtduV9ZFYXMQTP"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8897fb677db47127-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/turnstile/v0/b/695da7821231/api.js?onload=gayxv3&render=explicit | 104.17.3.184 | 200 OK | 27 kB |
URL GET HTTP/3challenges.cloudflare.com/turnstile/v0/b/695da7821231/api.js?onload=gayxv3&render=explicit IP104.17.3.184:443
Requested byhttp://civilianurinedtsraov.shop/api;f CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (42526) Hashc667700be084108f8deded9026ffbbf9 31d633a11ef13a66787ec6504e38c11842664b7b e158035a6f740b0245a027bf0d559c56782ebbeec7cab5a827083bd16aa47901
GET /turnstile/v0/b/695da7821231/api.js?onload=gayxv3&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://civilianurinedtsraov.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:47 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=604800, public
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 8897fb677a3e0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.3.184:0
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/s4nja/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:47 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 8897fb69fc5b0b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1464038978:1716664430:ZNGcTrLOmuBr3e60tb_aUBJPj_-o07ax8km1WWIQ3LQ/8897fb694bb60b41/12e32c14da45b22 | 104.17.3.184 | | 87 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1464038978:1716664430:ZNGcTrLOmuBr3e60tb_aUBJPj_-o07ax8km1WWIQ3LQ/8897fb694bb60b41/12e32c14da45b22 IP104.17.3.184:0
File typeASCII text, with very long lines (65536), with no line terminators Hash748d8415bdd00c19e278fc402d6f40b7 7958024236679098db8082d8b6303aaa3ba2b30d ca9e56dc62799bcaf5b2fae8f69776004d58aeb2b9235ed9fc7413d4d7dc2bc6
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1464038978:1716664430:ZNGcTrLOmuBr3e60tb_aUBJPj_-o07ax8km1WWIQ3LQ/8897fb694bb60b41/12e32c14da45b22 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/s4nja/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 12e32c14da45b22
Content-Length: 3449
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:48 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: 9yd/iJMwX07y7xpN1O2orl09hgG2pDbZMiBbjgS5d5FCtY0UO25VZyEIjojmLMBpSlhJRZFSGvGSsDQT/Kx0PRO/7qA/fAGSGu51EgQ6cMnMS6uRX7NKK4xanmwQAhYV5jKexdquZgssl07aT2gKdPsW74I3YpvBfSocPU0ribl6BbwZvp9TzEogEhT6YV6reG8LPWfL/hn+x2DTY+J+IPF0AHXetc6wtjMzusvrdJPhbe04aSt9QeWWwh5TcOfXECHUQsM3j8ws2mp0kT5KABjvscN4br491OgWChO1fgPnfavybpPnK0R4uDtzTqRYIUFmSOL/ntK4EfgSHv/i0SF+bnItEVnt7YBCXq02bib+ej1waNgu8FRiauhRQKUfL2xn34e2LI11cXPtPWKUrWAvwLBp6oJ6oErkzoll3TLsOow/ZoVQwEk2QG/k1x5W$Pz9KK8HOyqfNKmPMLmQVFg==
server: cloudflare
cf-ray: 8897fb6bee1d0b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8897fb694bb60b41/1716665868160/52HhOvlsS6Iro8E | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8897fb694bb60b41/1716665868160/52HhOvlsS6Iro8E IP104.17.3.184:0
File typePNG image data, 52 x 15, 8-bit/color RGB, non-interlaced Hashe5cab3795814d3170afa6be70ac6f86a b7ce700485f71490ebd0d31bef161136abbc2ef8 2623bd1a1703fa072a5b73e802ee6e1e7b5c8c374d448991870307972e6757ac
GET /cdn-cgi/challenge-platform/h/b/i/8897fb694bb60b41/1716665868160/52HhOvlsS6Iro8E HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/s4nja/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:50 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 8897fb7939190b41-OSL
alt-svc: h3=":443"; ma=86400
|
|
| civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/1248647653:1716664197:iVqWkzZpBJZ0HfXHeX3slUImwiC7YhkJ1BojQcFiJmA/8897fb65d8701c02/309c9e25ec19d29 | 172.67.197.146 | 200 OK | 2.4 kB |
URL POST HTTP/1.1civilianurinedtsraov.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/1248647653:1716664197:iVqWkzZpBJZ0HfXHeX3slUImwiC7YhkJ1BojQcFiJmA/8897fb65d8701c02/309c9e25ec19d29 IP172.67.197.146:80
Requested byhttp://civilianurinedtsraov.shop/api;f
File typeASCII text, with very long lines (3048), with no line terminators Hash584476486374ec80e5b2384f0a86285b d52d5ff6af4ae51b643999d2e4ea24a743119d1d 646f841b8078d76ab93f477df9f4849a2831c572eac7bd87b3c774828608a09c
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1248647653:1716664197:iVqWkzZpBJZ0HfXHeX3slUImwiC7YhkJ1BojQcFiJmA/8897fb65d8701c02/309c9e25ec19d29 HTTP/1.1
Host: civilianurinedtsraov.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://civilianurinedtsraov.shop/api;f
Content-type: application/x-www-form-urlencoded
CF-Challenge: 309c9e25ec19d29
Content-Length: 2462
Origin: http://civilianurinedtsraov.shop
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 May 2024 19:37:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out: hyKosp/OhvzQXGb0Om2lE0Iu9DVUQpHy36m7tvw7Ulbn1uGFC/Qv3sNuCm07ZAZ6uMQKxTdms8Tx35epUVyCl9xHH+f0MNSvgGmS+I3HU+g=$EnsywTcZWJ5ikrra5iYwwA==
cf-chl-out-s: 80Oa9c6mg1Bu6qdTKilYV9Xqy+A46pjtqQJqa6Wou7rnZotJtfiIZxJ2l4Wv/tHNBCfEUe74tq/uDcEsT/wkilccndiwsYQGLDQe6vArg81QWUq/9vR3ImCFvaj4JMXMvQB8BjdnGUvH5ccDmYMRG3vBo2n2bTbaf25Gj5HPb8PxhfDaC3bDwrWD7USI6CLWNFSMrPeMj0SQJ0hSxP8QNUFfb0X0Hh6NTkbn+c/Sm9QwL8r9QYYAVZVl9p2A1fBPbyMQ0BS8ZHIldJIgCAY6BYs8rOJ6DA5WOj4maAs1o0te31G9JWxGnU+C2nLfMKkWOKcfZbY1EEYldVL9RzaV6oIm5NpUvBFpa/VUbNmPAtCvpwTI1n3vaC3dBfhytnEtJ9CCVorhuo2ePGEFTfI6wvOx8qome3anzyn2n2Qd1YbSic603Dm+yr3CuWnjFyxWBudXOqNaSK57MMgo1uf7k7IERmRA7XvFft1/vAIMo14=$NW7zn7NNt1MDN+mee6SXYQ==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9NFEph4Oe137ItZxX%2Bbd2A6NfjxXX7f7c1wWh2YkKNnA7fvY178qA%2BVDA99RcEIxq9u7b6RkTN5ycTogHz5JKARKXjnwqtB3iM4QbD14Px2g46YZr9Hr50v6qJs9vEMavGvHQgZPnN4cvgIF"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8897fba17ed05684-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/s4nja/0x4AAAAAAAAjq6WYeRDKmebM/light/normal | 104.17.3.184 | 200 OK | 79 kB |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/s4nja/0x4AAAAAAAAjq6WYeRDKmebM/light/normal IP104.17.3.184:443
Requested byhttp://civilianurinedtsraov.shop/api;f CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (42150) Hashbd9e46348f7b099cb873d4e247fc7f9c f75111f7d140297ad4cb68532d4de9a51a268f59 1d56f96187d527e18cc4f1ffd9078b1f60ce89b809cf7ad73cd542979da59a5e
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/s4nja/0x4AAAAAAAAjq6WYeRDKmebM/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sat, 25 May 2024 19:37:47 GMT
content-type: text/html; charset=UTF-8
cross-origin-opener-policy: same-origin
cross-origin-embedder-policy: require-corp
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
document-policy: js-profiling
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
server: cloudflare
cf-ray: 8897fb694bb60b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|