WEBSITE ANALYSIS REPORT

http://pornkrm.com/e/dfyqxksszqji

22 Feb 2026 · 11:59:15.000 UTCpublic

Report tags: malicious clickfix
Submit tags

Request review

Malicious detection

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

11:58:51.777 GET 302 document 130.1 KB 116 ms —

11:58:51.857 GET 200 document 130.1 KB 420 ms —

11:58:52.356 GET 200 stylesheet 2.4 KB 402 ms —

11:58:52.357 GET 200 stylesheet 264.3 KB 52 ms —

11:58:52.361 GET 200 script 85.5 KB 50 ms —

11:58:52.365 GET 200 stylesheet 5.5 KB 86 ms —

11:58:52.368 GET 200 script 1.7 KB 83 ms —

11:58:52.369 GET 200 script 156.1 KB 75 ms —

11:58:52.371 GET 200 script 81.2 KB 123 ms —

11:58:52.373 GET 200 script 97.2 KB 146 ms 2 alerts

11:58:52.375 GET 200 script 78.8 KB 52 ms —

11:58:52.377 GET 200 script 100.4 KB 121 ms 1 alerts

Transaction #17

Request / response

URL

GET HTTPS

https://lancewhosedifficult.com/s/js/site.min.js?fe1eebe79ae88e4bfa6ed669174fca9c

IP / ASN

186.2.163.224

AS59692 · IQWeb FZ-LLC

Requested by: https://lancewhosedifficult.com/e/dfyqxksszqji

Resource information

File type: JavaScript source, Unicode text, UTF-8 text, with very long lines (52119)
MIME type: application/javascript; charset=utf-8
First seen (UTC): 04 Oct 2025 · 08:15:13.352 UTC
Last seen (UTC): 27 Sep 2026 · 07:25:12.592 UTC
Times seen: 302

Size: 100.4 KB (102814 bytes)
MD5: f221d7962c60ad362e2fbc5e1dacc9e6
SHA1: 9e2a0ee15fec83034ee0eedfdc866d2d7472ecee
SHA256: efd0ced2b4c5c6490d8ac3462669df8c5aa143db9ef81fc947dc3ffc739d4088

Certificate information

Issuer: Let's Encrypt · R12
Subject: lancewhosedifficult.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: F6:E4:1F:31:D7:A1:0D:2C:83:C3:CB:1C:A7:01:13:17:B3:2B:F1:7B
Valid from: Wed, 18 Feb 2026 22:39:42 GMT
Valid until: Tue, 19 May 2026 22:39:41 GMT

Technology fingerprints

DDoS-Guard (Security)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Malicious - Copy/Paste Social Engineering (ClickFix)	medium	Malicious

HTTP headers

Request headers

GET /s/js/site.min.js?fe1eebe79ae88e4bfa6ed669174fca9c HTTP/1.1
Host: lancewhosedifficult.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lancewhosedifficult.com/e/dfyqxksszqji
Cookie: __ddg8_=KR1Ysy8lWrvzSdFO; __ddg10_=1771761532; __ddg9_=91.90.42.154; __ddg1_=2pkBLcmOwNhxTQToI41m; XSRF-TOKEN=eyJpdiI6ImJlQytUK05XQUNaaTU5Y0UwOUxXVWc9PSIsInZhbHVlIjoiRGc0dndLbUFvcklPUXpXYVF0Zm5FaUZPUU13UUdWWDJYemMzd1J5NzBzSUlQMUpnME8zRUpkYTcwa0poV3ZCZzR1d3pHMnNCQkx1cEdEczRLZ25pS1hVMDRsdmlEV3lieUZhT08xVWw4NUZIVDBMVFpFbkhkc1hoUi94am0zTjkiLCJtYWMiOiI5ZGIwZjY1YjhjNWEyOWViNjJmOTIyMTk2ZDRmZDE3ODU5YThmNmMzMzZlYjVmZDBjNDllOWU4MzlkYTZiYmQ4IiwidGFnIjoiIn0%3D; voe_session=eyJpdiI6IjBwWE9MckN0VVNNblF5K0V5cU5ac0E9PSIsInZhbHVlIjoiYmZJdXYvRFY4cSs2RXpkZ0cyUmcybWg0bVVhTjVxcllJZDIvWXBuTGpqelJGS3ZjcVhEbnhaSFd2RUE5cEpldWpvNWd4U0RYQmp2RFpzN1dQa1pGbTFRQjUyUHFQd2toQ0hnZ0VBZjZHSXpocm5UbFlzV2JEYlVoS3VIYVM0YmgiLCJtYWMiOiI5MjY1NDVhZjIyYWMxZGU0OWE3MjMyN2U0MmIxYTMwYTk2MjM3NzRjZGI1MTZkMTI1NzIwNjk1NTljMDBjM2IyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg8_=PH8MsrzlSrbvhIeb; Domain=.lancewhosedifficult.com; Path=/; Expires=Sun, 22-Feb-2026 12:18:52 GMT
__ddg10_=1771761532; Domain=.lancewhosedifficult.com; Path=/; Expires=Sun, 22-Feb-2026 12:18:52 GMT
__ddg9_=91.90.42.154; Domain=.lancewhosedifficult.com; Path=/; Expires=Sun, 22-Feb-2026 12:18:52 GMT
strict-transport-security: max-age=2628000
content-security-policy: upgrade-insecure-requests;
date: Wed, 18 Feb 2026 23:38:55 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 03 Oct 2025 21:05:04 GMT
etag: W/"68e03a80-1919e"
expires: Fri, 20 Mar 2026 23:38:55 GMT
cache-control: max-age=2592000
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
age: 303597
content-length: 23409
ddg-cache-status: HIT
X-Firefox-Spdy: h2

11:58:52.529 GET 200 script 455.5 KB 151 ms —

11:58:52.899 GET 200 xhr 126 B 162 ms —

11:58:52.902 GET 200 img 403 B 34 ms —

11:58:52.916 GET 200 script 65.8 KB 36 ms —

11:58:52.961 GET 200 script 334.9 KB 54 ms —

11:58:52.964 GET 200 script 560.9 KB 79 ms —

11:58:52.966 GET 200 font 19.7 KB 289 ms —

11:58:53.099 GET 200 script 5.0 KB 38 ms —

11:58:53.160 GET 200 img 6.9 KB 35 ms —

11:58:53.163 GET 200 img 533 B 35 ms —

11:58:53.331 GET 200 subdocument 926 B 17 ms 2 alerts

11:58:53.522 GET 200 img 3.6 KB 32 ms —

11:58:53.590 GET 200 xhr 12.0 KB 103 ms —

11:58:53.605 GET 200 img 89.0 KB 39 ms —

11:58:53.742 GET 200 script 6.2 KB 19 ms 2 alerts

11:58:53.753 GET 200 img 243.0 KB 301 ms —

11:58:53.772 GET 200 img 35.2 KB 199 ms —

11:58:53.797 GET 200 img 36.1 KB 167 ms —

11:58:55.804 GET 200 img 43 B 18 ms 2 alerts

11:58:56.817 GET 200 img 43 B 22 ms 2 alerts

http://pornkrm.com/e/dfyqxksszqji

Domain graph

Hostnames

Connections

Network requests

Transaction #17

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://pornkrm.com/e/dfyqxksszqji

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #17

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://pornkrm.com/e/dfyqxksszqji

Domain graph

Network requests