WEBSITE ANALYSIS REPORT

http://pornkrm.com/e/dfyqxksszqji

22 Feb 2026 · 11:59:15.000 UTCpublic

Report tags: malicious clickfix
Submit tags

Request review

Malicious detection

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

11:58:51.777 GET 302 document 130.1 KB 116 ms —

11:58:51.857 GET 200 document 130.1 KB 420 ms —

11:58:52.356 GET 200 stylesheet 2.4 KB 402 ms —

11:58:52.357 GET 200 stylesheet 264.3 KB 52 ms —

11:58:52.361 GET 200 script 85.5 KB 50 ms —

11:58:52.365 GET 200 stylesheet 5.5 KB 86 ms —

11:58:52.368 GET 200 script 1.7 KB 83 ms —

11:58:52.369 GET 200 script 156.1 KB 75 ms —

11:58:52.371 GET 200 script 81.2 KB 123 ms —

11:58:52.373 GET 200 script 97.2 KB 146 ms 2 alerts

11:58:52.375 GET 200 script 78.8 KB 52 ms —

11:58:52.377 GET 200 script 100.4 KB 121 ms 1 alerts

11:58:52.529 GET 200 script 455.5 KB 151 ms —

11:58:52.899 GET 200 xhr 126 B 162 ms —

11:58:52.902 GET 200 img 403 B 34 ms —

11:58:52.916 GET 200 script 65.8 KB 36 ms —

11:58:52.961 GET 200 script 334.9 KB 54 ms —

11:58:52.964 GET 200 script 560.9 KB 79 ms —

11:58:52.966 GET 200 font 19.7 KB 289 ms —

11:58:53.099 GET 200 script 5.0 KB 38 ms —

11:58:53.160 GET 200 img 6.9 KB 35 ms —

11:58:53.163 GET 200 img 533 B 35 ms —

11:58:53.331 GET 200 subdocument 926 B 17 ms 2 alerts

11:58:53.522 GET 200 img 3.6 KB 32 ms —

11:58:53.590 GET 200 xhr 12.0 KB 103 ms —

11:58:53.605 GET 200 img 89.0 KB 39 ms —

11:58:53.742 GET 200 script 6.2 KB 19 ms 2 alerts

11:58:53.753 GET 200 img 243.0 KB 301 ms —

11:58:53.772 GET 200 img 35.2 KB 199 ms —

11:58:53.797 GET 200 img 36.1 KB 167 ms —

11:58:55.804 GET 200 img 43 B 18 ms 2 alerts

Transaction #10

Request / response

URL

GET HTTPS

https://avalanchetremorunfilled.com/chicken.gif?z=2060451&pb=582a050e78092d5dab535deeff3515701771768733&pbc=akZs2CkT4pSdC5tp&pbi=zT5uZDD2ENedC5tp&pbu=4JLSZEshM7adC5tp&psp=UKca5-aDO_NQv6KjAD76Rymvp6gDN1Vsp9ddMwQj5g-f75WpGQpqGE0mwmgR7wi173LmsFmW7fqRVKKxuEtmLiHmaC0Uvx9LhsLnmQ5SXZ-mKzm8qXS1JIu5L-OaDEcNk66ym_VD6R6wPPRr11FyqOjyfGreGABccYOvaHu4a21aXoE9U_HoUF5V4opQo7KAyXgjhdUyNHCwrPTmpbK5B8GSI6DgkEpHWlZ45CbAzh-QC0JDCtiq2jPVc1CG7h39GfyFUHuieZi2rIH64B_uInLIHYAY3QjiQPQxK3leCi6mDqbTqT-6l77FrmV2tGZjnma3KAYgDVCXEUcAm68zC4-gUqd3luvi48hBCMV6qSayabSRRc2ZOjq1YWujYATN-LDpSbu-ENX-Ppv5wx0Vmpnjad_EFuqtF5uMI3YYH4CTqz5utqQLu5wLWuTubNRH-i4TYtbaXErb73BK2sWojvgGXLV9psFZV_bxsi3TKL2w7t8lGxA_Me1avkpnnauPXi6KC9suleRy2pgeXYr2h4iQxTwd0OQfImzCfFmIqUb0IpHZUZpcZHIc-nLCLq-BjFhRODIUjhRIma4O2xNJ3mXiiYhQOPXKtPltsjjOaVuF3FSQPCD2dDtCgpEmAc52OQlxyv_6LPS4Ph-jmT6m7v25gzl2K69LZ4W4WmOl8niBU7zSe1Jt9YA2pzAmz7yutqBkGDIloFXHst0VJMsZn2uq6E1vGSeyiZt1vWE2vyih2JRZftju_a80udoMQVnSsboQCgoyRuRVX8GZ1NKXQooUDnzXX2KYcWReRAPTm2R6QzsJU6v7hHzhdQAZLM5SPgz_E0rZ8rkpm-_K-o65gt6GsGYPRo_kIIjc0N_dAloEHu9bL6Bmlsnqww2-LBFFXA_scDCmmc_YQswnyxHK8DE9PpZ-iAfQRxvJA6nNqkYHL9uAWBLPG9A2Ia62uw8oHjvcxIW7pLch8JV1xYPPY4yGGMDSjvKDWwP8mYoq4CmXXquDwLCuu7TiyNQ-1PDu0sOVxDauG9KNrg6Ub-nTyzjqTJ4IwwsMVBJbMw==&freq=0&nojs=0&bavar=0&febuild=1.1.16-st&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC+0&ss=1&ls=1&bb=0&cti=2&fn=3&es=13&ge=2&th=7IoJcHhiaxnnrdFrsPjlmdLeXWVsPCTpVIbFIUEQtsql-&pcs=2&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Win32&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=1280&y=1024&md=0&psu=s7lSAm8aHR0cHM6Ly9sYW5jZXdob3NlZGlmZmljdWx0LmNvbS9lL2RmeXF4a3NzenFqaQ&afid=3775288861197312&eclog=0&snc=0&ssc=2&tp=0&vp=8&pkw=0&pload=1932&rlp=%5B0%2C150%2C520%2C404%2C7457%2C5293%2C1776%2C4911%2C1%5D&srw=1280&srh=1024&im=1&noch=1&cs=5

IP / ASN

94.242.247.33

AS7979 · SERVERS-COM

Requested by: https://lancewhosedifficult.com/e/dfyqxksszqji

Resource information

File type: GIF image data, version 89a, 1 x 1
MIME type: image/gif
First seen (UTC): 05 Apr 2023 · 09:26:54.000 UTC
Last seen (UTC): 21 Oct 2026 · 21:01:39.321 UTC
Times seen: 23090

Size: 43 B (43 bytes)
MD5: 28e463819a210071de3b45ebe7633613
SHA1: 6dccd571828ec0912629119cf7eabfea9f33ddbc
SHA256: 44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84

Certificate information

Issuer: Google Trust Services · WR1
Subject: avalanchetremorunfilled.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 7E:76:08:B0:01:78:32:41:71:D8:35:27:81:F2:8C:70:67:04:AA:9F
Valid from: Tue, 06 Jan 2026 14:14:58 GMT
Valid until: Mon, 06 Apr 2026 14:14:57 GMT

Technology fingerprints

Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Cloudflare DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /chicken.gif?z=2060451&pb=582a050e78092d5dab535deeff3515701771768733&pbc=akZs2CkT4pSdC5tp&pbi=zT5uZDD2ENedC5tp&pbu=4JLSZEshM7adC5tp&psp=UKca5-aDO_NQv6KjAD76Rymvp6gDN1Vsp9ddMwQj5g-f75WpGQpqGE0mwmgR7wi173LmsFmW7fqRVKKxuEtmLiHmaC0Uvx9LhsLnmQ5SXZ-mKzm8qXS1JIu5L-OaDEcNk66ym_VD6R6wPPRr11FyqOjyfGreGABccYOvaHu4a21aXoE9U_HoUF5V4opQo7KAyXgjhdUyNHCwrPTmpbK5B8GSI6DgkEpHWlZ45CbAzh-QC0JDCtiq2jPVc1CG7h39GfyFUHuieZi2rIH64B_uInLIHYAY3QjiQPQxK3leCi6mDqbTqT-6l77FrmV2tGZjnma3KAYgDVCXEUcAm68zC4-gUqd3luvi48hBCMV6qSayabSRRc2ZOjq1YWujYATN-LDpSbu-ENX-Ppv5wx0Vmpnjad_EFuqtF5uMI3YYH4CTqz5utqQLu5wLWuTubNRH-i4TYtbaXErb73BK2sWojvgGXLV9psFZV_bxsi3TKL2w7t8lGxA_Me1avkpnnauPXi6KC9suleRy2pgeXYr2h4iQxTwd0OQfImzCfFmIqUb0IpHZUZpcZHIc-nLCLq-BjFhRODIUjhRIma4O2xNJ3mXiiYhQOPXKtPltsjjOaVuF3FSQPCD2dDtCgpEmAc52OQlxyv_6LPS4Ph-jmT6m7v25gzl2K69LZ4W4WmOl8niBU7zSe1Jt9YA2pzAmz7yutqBkGDIloFXHst0VJMsZn2uq6E1vGSeyiZt1vWE2vyih2JRZftju_a80udoMQVnSsboQCgoyRuRVX8GZ1NKXQooUDnzXX2KYcWReRAPTm2R6QzsJU6v7hHzhdQAZLM5SPgz_E0rZ8rkpm-_K-o65gt6GsGYPRo_kIIjc0N_dAloEHu9bL6Bmlsnqww2-LBFFXA_scDCmmc_YQswnyxHK8DE9PpZ-iAfQRxvJA6nNqkYHL9uAWBLPG9A2Ia62uw8oHjvcxIW7pLch8JV1xYPPY4yGGMDSjvKDWwP8mYoq4CmXXquDwLCuu7TiyNQ-1PDu0sOVxDauG9KNrg6Ub-nTyzjqTJ4IwwsMVBJbMw==&freq=0&nojs=0&bavar=0&febuild=1.1.16-st&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC+0&ss=1&ls=1&bb=0&cti=2&fn=3&es=13&ge=2&th=7IoJcHhiaxnnrdFrsPjlmdLeXWVsPCTpVIbFIUEQtsql-&pcs=2&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Win32&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=1280&y=1024&md=0&psu=s7lSAm8aHR0cHM6Ly9sYW5jZXdob3NlZGlmZmljdWx0LmNvbS9lL2RmeXF4a3NzenFqaQ&afid=3775288861197312&eclog=0&snc=0&ssc=2&tp=0&vp=8&pkw=0&pload=1932&rlp=%5B0%2C150%2C520%2C404%2C7457%2C5293%2C1776%2C4911%2C1%5D&srw=1280&srh=1024&im=1&noch=1&cs=5 HTTP/1.1
Host: avalanchetremorunfilled.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: cart=1; cart_p=2; CHCK=1; PTS=; UID=260222065836f64c73dbd54a2aa4044901cd
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

Response headers

HTTP/2 200 OK
server: nginx
date: Sun, 22 Feb 2026 11:58:55 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.impression
set-cookie: BCAI=ABSSGwAAAAAAAAAB; Path=/; Expires=Mon, 23 Feb 2026 11:58:55 GMT; Secure; SameSite=None
BMI=AB8WWQAAAAAAAAAB; Path=/; Expires=Mon, 23 Feb 2026 11:58:55 GMT; Secure; SameSite=None
BCRI=iBn8AAAAAAAAAAAB; Path=/; Expires=Mon, 23 Feb 2026 11:58:55 GMT; Secure; SameSite=None
IMC_102=1; Path=/; Expires=Mon, 23 Feb 2026 11:58:55 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

11:58:56.817 GET 200 img 43 B 22 ms 2 alerts

http://pornkrm.com/e/dfyqxksszqji

Domain graph

Hostnames

Connections

Network requests

Transaction #10

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://pornkrm.com/e/dfyqxksszqji

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #10

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://pornkrm.com/e/dfyqxksszqji

Domain graph

Network requests