WEBSITE ANALYSIS REPORT

http://pornkrm.com/e/dfyqxksszqji

22 Feb 2026 · 11:59:15.000 UTCpublic

Report tags: malicious clickfix
Submit tags

Request review

Malicious detection

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

11:58:51.777 GET 302 document 130.1 KB 116 ms —

11:58:51.857 GET 200 document 130.1 KB 420 ms —

11:58:52.356 GET 200 stylesheet 2.4 KB 402 ms —

11:58:52.357 GET 200 stylesheet 264.3 KB 52 ms —

11:58:52.361 GET 200 script 85.5 KB 50 ms —

11:58:52.365 GET 200 stylesheet 5.5 KB 86 ms —

11:58:52.368 GET 200 script 1.7 KB 83 ms —

11:58:52.369 GET 200 script 156.1 KB 75 ms —

11:58:52.371 GET 200 script 81.2 KB 123 ms —

11:58:52.373 GET 200 script 97.2 KB 146 ms 2 alerts

11:58:52.375 GET 200 script 78.8 KB 52 ms —

11:58:52.377 GET 200 script 100.4 KB 121 ms 1 alerts

11:58:52.529 GET 200 script 455.5 KB 151 ms —

11:58:52.899 GET 200 xhr 126 B 162 ms —

11:58:52.902 GET 200 img 403 B 34 ms —

11:58:52.916 GET 200 script 65.8 KB 36 ms —

11:58:52.961 GET 200 script 334.9 KB 54 ms —

11:58:52.964 GET 200 script 560.9 KB 79 ms —

11:58:52.966 GET 200 font 19.7 KB 289 ms —

11:58:53.099 GET 200 script 5.0 KB 38 ms —

11:58:53.160 GET 200 img 6.9 KB 35 ms —

11:58:53.163 GET 200 img 533 B 35 ms —

11:58:53.331 GET 200 subdocument 926 B 17 ms 2 alerts

11:58:53.522 GET 200 img 3.6 KB 32 ms —

11:58:53.590 GET 200 xhr 12.0 KB 103 ms —

11:58:53.605 GET 200 img 89.0 KB 39 ms —

11:58:53.742 GET 200 script 6.2 KB 19 ms 2 alerts

Transaction #31

Request / response

URL

GET HTTPS

https://avalanchetremorunfilled.com/get/2060451?id=2060451&jp=_clazctpokbkxwjymvdyfks&dr=102&cuaa=1&nojs=0&bavar=0&febuild=1.1.16-st&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC+0&ss=1&ls=1&bb=0&cti=2&fn=3&es=13&ge=2&th=7IoJcHhiaxnnrdFrsPjlmdLeXWVsPCTpVIbFIUEQtsql-&pcs=2&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Win32&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=1280&y=1024&md=0&psu=ppNyNGNaHR0cHM6Ly9sYW5jZXdob3NlZGlmZmljdWx0LmNvbS9lL2RmeXF4a3NzenFqaQ&afid=2086439000855552&eclog=0&snc=0&ssc=0&vp=8&pkw=0&pload=1524&rlp=%5B0%2C150%2C383%2C284%2C2935%2C2412%2C1056%2C2030%2C0%5D&srw=1280&srh=1024&im=1&noch=1&cs=5&uf=0&freq=0

IP / ASN

94.242.247.33

AS7979 · SERVERS-COM

Requested by: https://lancewhosedifficult.com/e/dfyqxksszqji

Resource information

File type: ASCII text, with very long lines (6400), with no line terminators
MIME type: text/javascript; charset=utf-8
First seen (UTC): 22 Feb 2026 · 11:59:23.742 UTC
Last seen (UTC): 22 Feb 2026 · 11:59:23.742 UTC
Times seen: 1

Size: 6.2 KB (6400 bytes)
MD5: 883c823387720fb76f4c4cad99700d95
SHA1: 19975a3c8457ca81c29ca4cacc3a02ea9cd5e351
SHA256: a498d183bc23886a0d7588b85d3d5b7588419e77923e9499cf9a0c3be9fb6b81

Certificate information

Issuer: Google Trust Services · WR1
Subject: avalanchetremorunfilled.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 7E:76:08:B0:01:78:32:41:71:D8:35:27:81:F2:8C:70:67:04:AA:9F
Valid from: Tue, 06 Jan 2026 14:14:58 GMT
Valid until: Mon, 06 Apr 2026 14:14:57 GMT

Technology fingerprints

Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /get/2060451?id=2060451&jp=_clazctpokbkxwjymvdyfks&dr=102&cuaa=1&nojs=0&bavar=0&febuild=1.1.16-st&t=0&wcks=1&wgl=1&cnvs=1&os=0&tz=UTC+0&ss=1&ls=1&bb=0&cti=2&fn=3&es=13&ge=2&th=7IoJcHhiaxnnrdFrsPjlmdLeXWVsPCTpVIbFIUEQtsql-&pcs=2&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Win32&cd=24&vcv=Mesa&vcn=llvmpipe&ix=0&x=1280&y=1024&md=0&psu=ppNyNGNaHR0cHM6Ly9sYW5jZXdob3NlZGlmZmljdWx0LmNvbS9lL2RmeXF4a3NzenFqaQ&afid=2086439000855552&eclog=0&snc=0&ssc=0&vp=8&pkw=0&pload=1524&rlp=%5B0%2C150%2C383%2C284%2C2935%2C2412%2C1056%2C2030%2C0%5D&srw=1280&srh=1024&im=1&noch=1&cs=5&uf=0&freq=0 HTTP/1.1
Host: avalanchetremorunfilled.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lancewhosedifficult.com/
Cookie: cart=1; cart_p=2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
server: nginx
date: Sun, 22 Feb 2026 11:58:53 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: CHCK=1; Path=/; Expires=Sun, 28 Mar 2027 11:58:53 GMT; Secure; SameSite=None
PTS=; Path=/; Expires=Sun, 28 Mar 2027 11:58:53 GMT; Secure; SameSite=None
UID=260222065836f64c73dbd54a2aa4044901cd; Path=/; Expires=Sun, 28 Mar 2027 11:58:53 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

11:58:53.753 GET 200 img 243.0 KB 301 ms —

11:58:53.772 GET 200 img 35.2 KB 199 ms —

11:58:53.797 GET 200 img 36.1 KB 167 ms —

11:58:55.804 GET 200 img 43 B 18 ms 2 alerts

11:58:56.817 GET 200 img 43 B 22 ms 2 alerts

http://pornkrm.com/e/dfyqxksszqji

Domain graph

Hostnames

Connections

Network requests

Transaction #31

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://pornkrm.com/e/dfyqxksszqji

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #31

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://pornkrm.com/e/dfyqxksszqji

Domain graph

Network requests