Report - ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce

Report Overview

Visited public
2023-11-22 03:13:45
Tags
Submit Tags
URL
ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Finishing URL
ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce#
IP / ASN
188.114.96.1
#13335 CLOUDFLARENET
Title
Walmart

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ziaont.com	unknown	2023-02-13	2023-02-13 07:35:21	2023-11-18 17:22:34	13 kB	383 kB	188.114.97.1
my.rtmark.net	9054	2014-10-29	2015-02-04 10:54:57	2023-11-21 05:11:06	1.5 kB	1.9 kB	139.45.195.8
pentlyconger.com	unknown	2021-08-12	2021-08-13 10:08:22	2023-11-20 00:09:58	897 B	4.0 kB	18.192.249.87
redrotou.net	145989	2021-03-12	2021-03-16 06:03:50	2023-11-19 18:58:24	986 B	28 kB	139.45.197.251
cdn-adef.akamaized.net	125719	2014-03-18	2018-02-06 08:56:01	2023-11-21 16:23:07	433 B	4.6 kB	23.36.76.96
cdn.stfilecamp.com	400667	2021-09-06	2021-09-06 17:32:03	2023-11-19 12:15:32	401 B	33 kB	172.64.154.72
stormtrk.com	289095	2019-05-15	2019-05-17 20:09:53	2023-11-20 00:09:58	894 B	1.4 kB	172.67.69.203

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed
2023-11-22	medium	ziaont.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (12)

	URL	From	Size	First Seen	Last Seen
	cdn.stfilecamp.com/fp.min.js	ScriptElement	32 kB	2023-04-06	2025-07-02
Pretty URL cdn.stfilecamp.com/fp.min.js IP 172.64.154.72 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 21:01 Last Seen2025-07-02 05:31 Times Seen570 Hash 198f2f5b0a649f41fe890c59d37319aa f24629687612889bb59f610df3879afcd766fb80 d2bc2cb800679f495a7731c105b2e2047965800515f98008867ab33edc940912 Loading...

	ziaont.com/z/index_files/stormtrk.js	ScriptElement	6.5 kB	2023-03-07	2025-07-02
Pretty URL ziaont.com/z/index_files/stormtrk.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03 Last Seen2025-07-02 05:31 Times Seen438 Hash 469e121bb4c4fe159bbca2b4f5a88267 f0c66f226de28b324e4f1ecb766597938f984c60 4706b6d6c3e39cf2915a772595f2cc124e96d0919538b56aa817113e6482c416 Loading...

	ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce	ScriptElement	496 B	2023-08-18	2024-08-21
Pretty URL ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-08-18 05:42 Last Seen2024-08-21 08:28 Times Seen50 Hash 0e776c4bb6876cab5eb208559031f96b a8211d0554b83df54549f201bc80235ceae48a72 a27b1c6ef0f71411dc8bc4c63bc43c2340b67dabdd34930c161279a29653609d Loading...

	ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce	ScriptElement	83 B	2023-04-07	2024-08-21
Pretty URL ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 17:20 Last Seen2024-08-21 09:30 Times Seen194 Hash cc8b574af920ace3d58d9114f4e6ab6c bae263945e9961d815f4c5bbef052c29dcc51dcf c85f159ca98233d658799d0a88c5fccea12e11424b144d598b7ae3e81971ce55 Loading...

	ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce	ScriptElement	1.6 kB	2023-03-07	2024-10-11
Pretty URL ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:40 Last Seen2024-10-11 08:32 Times Seen839 Hash 88f1478c977eac6c59d28d1c7ddd80df 647aefa687a36f49bb7d25375da25718445dd31f 14c9a3ed05798d5a423b51ccb9b1e568a62e4b268e721a41c129de8b5df51ccd Loading...

	my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990	ScriptElement	697 B	2023-03-26	2024-08-21
Pretty URL my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990 IP 139.45.195.8 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 14:20 Last Seen2024-08-21 09:30 Times Seen194 Hash 4c31f3c3993d15451b1cbf592344e69d 202eaf67a1b877dbaa3fdf17edd6b520aa9254e0 76f40efce542cf27486eb36faf5787e5769246644ed03c8c6bc446a21e7ad18e Loading...

	redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js	ScriptElement	27 kB	2023-11-02	2024-08-20
Pretty URL redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js IP 139.45.197.251 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-02 09:44 Last Seen2024-08-20 21:23 Times Seen8998 Hash 5ccd2d5882a06f293d07510ac91c92e6 b44dc0eaa03981adb70d3313e728f9359c1d21c1 9fc2aa21f3a7bfe66783d35fdbb48147f73e72a41f87aea848f64a8cb4518eba Loading...

	ziaont.com/z/index_files/jquery.min.js	ScriptElement	88 kB	2023-03-07	2025-07-04
Pretty URL ziaont.com/z/index_files/jquery.min.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-07-04 05:50 Times Seen72931 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

	ziaont.com/z/index_files/main.js	ScriptElement	3.1 kB	2023-03-07	2025-07-02
Pretty URL ziaont.com/z/index_files/main.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:40 Last Seen2025-07-02 05:31 Times Seen861 Hash 03d61bebb9362e3571c134d17e88261e c966e468ebbc5ac203bb35ea7b3a5cc586768b37 d25d6be4101c96b081881ae7f929b86cfc535abfadfdd3f62ebd71c17f76afdd Loading...

	ziaont.com/z/index_files/second_back.js	ScriptElement	2.2 kB	2023-03-07	2025-07-02
Pretty URL ziaont.com/z/index_files/second_back.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:40 Last Seen2025-07-02 05:31 Times Seen438 Hash 8dcc9f5ed8ffe107323085e2952946e3 60a762e6c3f93a4176dba2a336ef4d8c8c8aa9ea aa30848f0b1633b7fbb5d7a3cf3b75a9f897fc310b3bfca1bbe89d98f2a06328 Loading...

	ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce	ScriptElement	489 B	2023-04-07	2024-08-21
Pretty URL ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 17:20 Last Seen2024-08-21 09:36 Times Seen330 Hash d20e8d57e86019fbf43e12ef1ea13624 7a9dbef6dbf25aa57bcc90fb40fc889536860282 323b9833a7256fef9f7acc60b22f3248013057e3f94e66efbda0530de3637592 Loading...

	pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23&lpt=Walmart&vtm=1700622809796	ScriptElement	3.6 kB	2023-11-22	2023-11-22
Pretty URL pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23&lpt=Walmart&vtm=1700622809796 IP 18.192.249.87 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-22 04:13 Last Seen2023-11-22 04:13 Times Seen1 Hash 206250f57237d913daee862ed8a97e97 d441c1ec36cafc5314181642a994848c70a7411d ba52cd294a75f9aec6d68aad62cabf9af096fd3bd2829dc4af80b65a133c805c Loading...

HTTP Transactions (25)

URL IP Response Size

GET ziaont.com/z/index_files/11.png

188.114.97.1

200 OK

20 kB

URL GET HTTP/3
ziaont.com/z/index_files/11.png
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 531 x 531, 8-bit/color RGBA, non-interlaced\012- data
Size
20 kB (19608 bytes)
Hash
1c7e1037a62b15dc080894acb7955aa7
4400836d965f60e0dc7f093ce50b2c869f0f5ab7
c379ce20c3e8081a24ee7f71d94ad73d88d2d2db94c99b1d33effd4d6849f31a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/11.png HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/png
content-length: 19608
last-modified: Wed, 02 Nov 2022 07:26:35 GMT
etag: "63621bab-4c98"
expires: Fri, 08 Dec 2023 04:07:04 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1206383
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F1t6ntVyL1kP%2BFvCiQ%2BFoQ52cTneGIuGlKBRhkk45RhPDFcYGfmnZ14ZxP%2BLl5jj2anHPkPOgFrEAxh9%2FvINFgQkCTd59%2BJG5pyUHgDOqkfnrruhEJKIO%2Ft%2Fqoxt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff22dbc656bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/prizewheel-amazon_2.png?1

188.114.97.1

200 OK

104 kB

URL GET HTTP/3
ziaont.com/z/index_files/prizewheel-amazon_2.png?1
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 502 x 502, 8-bit/color RGBA, non-interlaced\012- data
Size
104 kB (104023 bytes)
Hash
fa45d2b35f605ccfb363df33d6054844
9b0ad37d32a3f44231b91b64eafe2b7729fefda7
b1a5ac0fdc54446907a81b4f9736919a78b6c667ebd191e4aff8b19d54790f97

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/prizewheel-amazon_2.png?1 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/png
content-length: 104023
last-modified: Thu, 18 May 2023 09:46:44 GMT
etag: "6465f404-19657"
expires: Fri, 08 Dec 2023 04:07:04 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1206383
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=irx6ho99Nrup%2FXyiB1Q7KJ6vgqNXM39TjhbyEDupDXk13JdeybcXVL5WfXQQ52jgXRm8amxwBzNdXxTn5LdPqa%2FXSwjd7mzzr5Ft57nkScYxJwsEUaAqrZ1NT9Xa"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff22dbc956bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/walmart_1.png?1

188.114.97.1

200 OK

160 kB

URL GET HTTP/3
ziaont.com/z/index_files/walmart_1.png?1
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 533 x 363, 8-bit/color RGBA, non-interlaced\012- data
Size
160 kB (160485 bytes)
Hash
3b52cfca4d8020080c18b651bbaf9c13
2d374c4010ecb38aa47ccf30ee03107155d4e647
6fce4e32f529207683d525dfff676242b72003ca36ff2cfbcaa90de895b8f4be

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/walmart_1.png?1 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/png
content-length: 160485
last-modified: Thu, 18 May 2023 09:46:45 GMT
etag: "6465f405-272e5"
expires: Sat, 02 Dec 2023 20:38:55 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1665272
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X3yrMKDafvVQsLV3DFe25qitmnXrrH7LBaOxZEOA9T3DsalIKIXM282ALQdFA8DYFImSyIkJqMkkZ4QXVGMh0B3TWNEjvzV45mgtL6ARLziayKIX%2FVp1rhfshDCd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff22dbcb56bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/like.png

188.114.97.1

200 OK

220 B

URL GET HTTP/3
ziaont.com/z/index_files/like.png
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 13 x 12, 8-bit colormap, non-interlaced\012- data
Size
220 B (220 bytes)
Hash
e4c6e8dcd575bd5f346565ce8dbacfe7
29e5d4862f0470607f803d462bddf5f14cf57969
9e79a749ac5f41341fdff11f64845580207490915f72b09ec320e0db0fea224a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/like.png HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/png
content-length: 220
last-modified: Wed, 02 Nov 2022 07:26:41 GMT
etag: "63621bb1-dc"
expires: Sat, 25 Nov 2023 02:27:57 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 2335530
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gegWIfXoeCx8zMYVS8rLtNb6mjVN0rPLWfsoQuMsmDvA7gzTjGQKSuh3HyZ9KgSBePYt8bYcooucNbfP9kEeM2yGg%2B5gF8%2F8CvnK3yGKzWsqG2IDMWW2iyg8%2Bsre"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff23ec3056bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/2.jpg

188.114.97.1

200 OK

3.7 kB

URL GET HTTP/3
ziaont.com/z/index_files/2.jpg
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, datetime=2017:06:15 10:57:43], baseline, precision 8, 50x50, components 3\012- data
Size
3.7 kB (3694 bytes)
Hash
02eebe83bc6786ef27b852477d4c4998
205314ba911137b6f6be4eefd946a2c62229e591
a0038f9d5f6fe1ce8fe1bf1cc7256f05e16c11d27041739c55918b823744753c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/2.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/jpeg
content-length: 3694
last-modified: Wed, 02 Nov 2022 07:26:36 GMT
etag: "63621bac-e6e"
expires: Fri, 08 Dec 2023 15:01:44 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1167103
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GR%2BGULlX4RT8Lk6g8%2Bm1%2ByGEaOrQqrq5wqUGL44YQe1Jb5lqwtxNHKN3WpYYKwpP7Uoxt64D6swqZUi%2F1tYhxDbrqi%2FpvXKCiM%2FpP0mON5L0wOsjqRWxDNu0NK7a"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff23ec3356bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/3.jpg

188.114.97.1

200 OK

1.1 kB

URL GET HTTP/3
ziaont.com/z/index_files/3.jpg
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3\012- data
Size
1.1 kB (1063 bytes)
Hash
72ab252d8ff828965ad984b8ab16991f
e45ea3665e80feb2e6309b04e1ec2e8d41bb279b
c5d70c3abf95aecc84bcc1b1f9fc25848e690852071169bf57522fd671550291

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/3.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/jpeg
content-length: 1063
last-modified: Wed, 02 Nov 2022 07:26:37 GMT
etag: "63621bad-427"
expires: Mon, 27 Nov 2023 10:50:48 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 2132559
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vyNpCXN9eWx1DPb07W86W%2BTI1vckgIf5QQH27ChewjfNI4uEVVO7VsVR6A1kJReK7QxJWVON0BB3xl%2Btgb4FGw%2F4UNhur04TgbuHeoWLi2DpJDzbXbEN%2FHSynLxq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff23ec3656bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/1.jpg

188.114.97.1

200 OK

3.9 kB

URL GET HTTP/3
ziaont.com/z/index_files/1.jpg
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, datetime=2017:06:15 10:57:43], baseline, precision 8, 50x52, components 3\012- data
Size
3.9 kB (3900 bytes)
Hash
72c067fe856886245e7c47c7ff84e041
5210cb05f897db334c61f8971ccec9a7396ea8a7
9a106ad9f340c7bafdd365ea1ad24b9336c304b1e72653eb58e84b5604471030

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/1.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/jpeg
content-length: 3900
last-modified: Wed, 02 Nov 2022 07:26:33 GMT
etag: "63621ba9-f3c"
expires: Sat, 25 Nov 2023 23:53:04 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 2258423
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OgtiAiPRYS6yfGm%2FAi34Dp%2FapSF1bRf8hXFCB6vaNkIcncoyv0vk%2Bf93jvpf7F%2BXHbyq7nFJpnYzq2YpNkt%2FlivSHczc2O%2B3s93lD6IzH2EMvlQy1QWb%2BbEOYRfV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff23ec3256bf-OSL
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/style.css?2

188.114.97.1

200 OK

8.4 kB

URL GET HTTP/3
ziaont.com/z/index_files/style.css?2
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text
Size
8.4 kB (8365 bytes)
Hash
cffc01d3f82e5e03e1bddc9a1405fba6
a92cd1941ba14c0c692aaa73c354bb4625833a37
9d3df57abc060dd08f728b371ecdf0269234e282bf04dfacd921be6e48da7dd2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/style.css?2 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: text/css
last-modified: Wed, 02 Nov 2022 07:26:49 GMT
vary: Accept-Encoding
etag: W/"63621bb9-96b1"
expires: Wed, 22 Nov 2023 05:49:19 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 33848
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6i%2Fvd3hyWDmVhaFfb7DsLE29OBAlms1wAeSZs2pBvUUVL1VWhBEur3VmCdtNuBVBqjRw2mHHC0%2BReZWzq1d8lWiMvPJvmFvJfiw4t3XbYPrCtzK31Vm0YUbkDRBn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff22dbc156bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/jquery.min.js

188.114.97.1

200 OK

33 kB

URL GET HTTP/3
ziaont.com/z/index_files/jquery.min.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (65451)
Size
33 kB (32749 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/jquery.min.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:40 GMT
vary: Accept-Encoding
etag: W/"63621bb0-15851"
expires: Wed, 22 Nov 2023 05:49:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 33847
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I4Buev92XZsU6ylDHFffU7%2BNyVGm3FRiJNxKjyMcyc4SsfVy%2FPPYaeT8va3o2BDp8Lx0VL5lQFjRHjNsypKHsDbi6bIs9S9Ac9koRF1%2FL9SjWBotpOGGym2PagLg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff22dbc256bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990

139.45.195.8

200 OK

697 B

URL GET HTTP/2
my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT

File type
ASCII text
Size
697 B (697 bytes)
Hash
4c31f3c3993d15451b1cbf592344e69d
202eaf67a1b877dbaa3fdf17edd6b520aa9254e0
76f40efce542cf27486eb36faf5787e5769246644ed03c8c6bc446a21e7ad18e

HTTP Headers

GET /p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

GET ziaont.com/z/index_files/spin-button.png

188.114.97.1

200 OK

5.6 kB

URL GET HTTP/3
ziaont.com/z/index_files/spin-button.png
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 276 x 301, 8-bit colormap, non-interlaced\012- data
Size
5.6 kB (5586 bytes)
Hash
66271b99acf174bf87d903ffac88c5f5
69e67eb0440ff320c8603071207b43a95e90c2bb
a2f084594e048fe1bf77c215f4c9447bb355584eb749dc8a5841a0c250ca9172

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/spin-button.png HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/png
content-length: 5586
last-modified: Wed, 02 Nov 2022 07:26:46 GMT
etag: "63621bb6-15d2"
expires: Fri, 22 Dec 2023 03:13:27 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Fm8OrR77GT%2FlSrQXd2xG5FsdoV5X33P68i8FfdoQK7yK2XByOZ5Jp0vW7bo%2FGXS7XncvKvDhyvgAjcxfoY%2FPaVT568bAFqsYlHhYEkynO1I6RY7a48bc6ONvGQC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff22dbca56bf-OSL
alt-svc: h3=":443"; ma=86400

GET pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23&lpt=Walmart&vtm=1700622809796

18.192.249.87

200 OK

3.6 kB

URL GET HTTP/2
pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23&lpt=Walmart&vtm=1700622809796
IP
18.192.249.87:443
ASN
#16509 AMAZON-02

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerLet's Encrypt
Subjectpentlyconger.com
Fingerprint08:30:41:92:4E:E7:EE:E4:74:42:FF:FB:50:89:83:6C:E2:B5:AF:BB
ValidityTue, 26 Sep 2023 06:49:01 GMT - Mon, 25 Dec 2023 06:49:00 GMT

File type
ASCII text, with very long lines (1616)
Size
3.6 kB (3644 bytes)
Hash
206250f57237d913daee862ed8a97e97
d441c1ec36cafc5314181642a994848c70a7411d
ba52cd294a75f9aec6d68aad62cabf9af096fd3bd2829dc4af80b65a133c805c

HTTP Headers

GET /d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23&lpt=Walmart&vtm=1700622809796 HTTP/1.1
Host: pentlyconger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: application/javascript;charset=UTF-8
content-length: 3644
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
X-Firefox-Spdy: h2

POST redrotou.net/zone?&pub=0&zone_id=6206858&is_mobile=false&domain=ziaont.com&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.471&action=prerequest

139.45.197.251

200 OK

0 B

URL POST HTTP/2
redrotou.net/zone?&pub=0&zone_id=6206858&is_mobile=false&domain=ziaont.com&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.471&action=prerequest
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerLet's Encrypt
Subjectredrotou.net
Fingerprint75:61:49:6F:3C:DF:A2:36:1C:08:81:85:8A:A6:7D:E9:AE:31:71:1D
ValiditySat, 28 Oct 2023 05:44:53 GMT - Fri, 26 Jan 2024 05:44:52 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /zone?&pub=0&zone_id=6206858&is_mobile=false&domain=ziaont.com&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.471&action=prerequest HTTP/1.1
Host: redrotou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ziaont.com
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 03:13:28 GMT
content-length: 0
x-trace-id: 408a4ff30d904712dd7533fc17b68385
access-control-allow-origin: https://ziaont.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2

GET cdn-adef.akamaized.net/images/favicon.ico

23.36.76.96

200 OK

4.1 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/images/favicon.ico
IP
23.36.76.96:443
ASN
#20940 Akamai International B.V.

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Size
4.1 kB (4103 bytes)
Hash
4cdf3256cd7b8ec3917adb79d6bf457e
bc615337e9223183a126c8fb649774866fb53e69
fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0

HTTP Headers

GET /images/favicon.ico HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: mzbDFFn0Yhqdz4XL9s4sX6yByljdNVrKhKiK+UtK4DVRgNzfBI6OtL7EakQiGwqEsC19uC++cQI=
x-amz-request-id: 78F19547EBC3B810
Last-Modified: Wed, 07 Nov 2018 08:41:38 GMT
ETag: "4cdf3256cd7b8ec3917adb79d6bf457e"
Accept-Ranges: bytes
Content-Type: image/x-icon
Content-Length: 4103
Server: AmazonS3
X-Akamai-EW-Subworker: 8096267
Date: Wed, 22 Nov 2023 03:13:28 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

GET my.rtmark.net/img.gif?f=sync&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990&ttl=&rurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23

139.45.195.8

200 OK

43 B

URL GET HTTP/2
my.rtmark.net/img.gif?f=sync&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990&ttl=&rurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

HTTP Headers

GET /img.gif?f=sync&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990&ttl=&rurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce%23 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 03:13:28 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=7e998182da63477e84e77b9cce9117ec; expires=Thu, 21 Nov 2024 03:13:28 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

GET ziaont.com/z/index_files/4.jpg

188.114.97.1

200 OK

1.0 kB

URL GET HTTP/3
ziaont.com/z/index_files/4.jpg
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3\012- data
Size
1.0 kB (1042 bytes)
Hash
e489d022a40ba80f51fb5acc1addea46
41c334f49c248783037ceaf6fc335acff62f760c
c39b4bfbcc6aa147547ca922c4f80350b48dbfa59cbd5176f44373e3b20f3567

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/4.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/jpeg
content-length: 1042
last-modified: Wed, 02 Nov 2022 07:26:38 GMT
etag: "63621bae-412"
expires: Tue, 28 Nov 2023 16:57:52 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 2024135
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7WUCvbaWznCxoSCgskKdFhMe1%2FiU8uqjdr2DoB0T9Vyq0XiXTJlzM9scAWylOFA%2B4RyFmggSb30vn4LgDZ5QVKweYZxzP9QWrM8NC3MKkdByttZONn3%2F15T5Zn4G"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff23ec3a56bf-OSL
alt-svc: h3=":443"; ma=86400

GET cdn.stfilecamp.com/fp.min.js

172.64.154.72

200 OK

32 kB

URL GET HTTP/2
cdn.stfilecamp.com/fp.min.js
IP
172.64.154.72:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerLet's Encrypt
Subjectstfilecamp.com
FingerprintB9:69:70:B1:52:5D:FE:AE:F0:24:90:58:7D:85:5B:38:3E:38:9C:4F
ValidityThu, 26 Oct 2023 11:10:00 GMT - Wed, 24 Jan 2024 11:09:59 GMT

File type

Size
32 kB (31705 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /fp.min.js HTTP/1.1
Host: cdn.stfilecamp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 22 Nov 2023 03:13:28 GMT
content-type: text/javascript
last-modified: Mon, 13 Jun 2022 11:23:14 GMT
x-rgw-object-type: Normal
etag: W/"198f2f5b0a649f41fe890c59d37319aa"
x-amz-request-id: tx000003f9d7ee37b75dccf-006557cf3f-3c6f487a-sfo3a
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: 243e22a9-bb9f-4609-9c16-1fb0681c9c84
cache-control: max-age=3600
x-envoy-upstream-healthchecked-cluster: 
cf-cache-status: HIT
set-cookie: __cf_bm=1WFs.1mto1Iwv4mZiJxePY77tRvN6TyT.zBsWhW4Ndc-1700622808-0-AQaveBykaD0m9Rmlr2V1msU4Jn+ubIgjKuMIiU6CzBqvYQi1c47dfdpQY+GSLT8kgngGMmTRJRArRcwLuGzbF/U=; path=/; expires=Wed, 22-Nov-23 03:43:28 GMT; domain=.cdn.stfilecamp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 829dff2888d0b523-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

GET ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce

188.114.97.1

200 OK

14 kB

URL User Request GET HTTP/2
ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type

Size
14 kB (13599 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: text/html
last-modified: Mon, 14 Aug 2023 05:52:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FJ5LzvOIX1jhNm3Xhxym%2BepCE9%2Bqfla0BK%2BRN1goQHDk2RyBaTHvtPoeWV5l67WhcfATwdHbmcNU8%2FjUPBIM%2BVVUZFIGGEGBXvJv%2FmtIZ5n2Sba4DS3BGPWrbozE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff1f989cb4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET ziaont.com/z/index_files/second_back.js

188.114.97.1

200 OK

2.2 kB

URL GET HTTP/3
ziaont.com/z/index_files/second_back.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (2311), with no line terminators
Size
2.2 kB (2231 bytes)
Hash
d8cda4c9b52122a5717b7675e4cc0507
afcdbf8c3511ec604eca7b8283ae1547eb2a4b09
fd3f9a5b037a50b89b415375eb1e46ead471ad9762127db59258b52f22387d00

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/second_back.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:45 GMT
vary: Accept-Encoding
etag: W/"63621bb5-8b7"
expires: Wed, 22 Nov 2023 05:49:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 33847
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W53FBMeN3bvoMPzUpnP8Sr8j8srZx7sa0DcivFSqUb%2BlE%2BpmbVculbfpmpEg280IpcaKp%2B36a7wKWjjL4F9k4ZvGK7MR8b14Gw6KZuy3f6JAoYjke3tEjd4ytJIx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff22dbc456bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET ziaont.com/sw-check-permissions-f1d69.js

188.114.97.1

200 OK

566 B

URL GET HTTP/3
ziaont.com/sw-check-permissions-f1d69.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (605), with no line terminators
Size
566 B (566 bytes)
Hash
035fe7d7c59399a5e710c8d151d0a9ec
929833ad44211c2f7cc8032b279d7668fe36af91
4f9934de580fa64a0d0fd66fe02690cd85e4ed3872d64d5ffb28cf2e724fb7c7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /sw-check-permissions-f1d69.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Cookie: vl-cep=cep=RUAiCgV3eC8cXOXZKUz37v70O-VBNwfiXVk_PG2uAtWlKT6koTi50rtK7s_04e3csQGu0jU18lPxOxJB4hgsxgOxR4YbqtTSoj3ruoU_lw1HIrRowGB16JyEej3hyx_NSDj8WkaBX6JvOqQKcZR_ROr8Yn87P17AATPyYrf5r3bLwB994I3QqWK-BtyHH_4H22gxeeKFBtsUe-JpFHiVOVrSDwMxdG62-NVnqntHV_4huoFPuvqP2u8S-7-7qElcgdgxQ-4rONvF3hgzSXAeuvJkm0PAKHC-4QEnuKfSgkNCqjiWZFju_toeFx2y8cdaG4nWXj11jCNyMo3be1YJjwOnJYqP-gx3TrGfMYfZxQ_mhlbSjmZhZr9GYvZNuLMO
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:28 GMT
content-type: application/javascript
last-modified: Thu, 10 Aug 2023 03:36:41 GMT
etag: W/"64d45b49-236"
expires: Wed, 22 Nov 2023 07:41:52 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 27096
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FjpzB8iUQtcXwvIRTlPNCyu5cxk%2BE7iOeFcKEIl6XQTZ2HtUQsJqpb9exACfUAoXyen8%2Bd3G4xniA6JZIyHcJ%2BDaxLbFWNfEIXFxKH0CTNHb%2FqpIDg1l2TNXT81E"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff264d3556bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/main.js

188.114.97.1

200 OK

3.1 kB

URL GET HTTP/3
ziaont.com/z/index_files/main.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (3200), with no line terminators
Size
3.1 kB (3065 bytes)
Hash
fdd423b17da31208a5c21fad72b932b9
e91c7519cfec28bb1cbf7090140deb21551e811d
2bc415ece1375eaca76cd91cb34849987af8dddae11391d1972fabc4be0b0f6a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/main.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:42 GMT
vary: Accept-Encoding
etag: W/"63621bb2-bf9"
expires: Wed, 22 Nov 2023 05:49:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 33847
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Gi2vI%2BIKSySg9h%2FuxYPJ6vwcInyqhvipnV%2BRD%2BFrDYDe2F9b%2B7IFI%2FaU7feOxv8wBd3QqS2tAlYVPtO9HFq6PTKXKhqJAif%2B7MaGwXB6kAnU%2BPyo6JCmo8ibhdy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff22dbc356bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET ziaont.com/z/index_files/stormtrk.js

188.114.97.1

200 OK

6.5 kB

URL GET HTTP/3
ziaont.com/z/index_files/stormtrk.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (6726), with no line terminators
Size
6.5 kB (6502 bytes)
Hash
c1ae765e0a69e76b62652260fa084405
34a6c5996f85c7466cfaeecf3de27935ffd5385d
ad4368b41a81e243d6589c9ac93f789c53b403e1e9d1a6969b28cbec593d5621

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/stormtrk.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:47 GMT
vary: Accept-Encoding
etag: W/"63621bb7-1966"
expires: Wed, 22 Nov 2023 05:49:20 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 33847
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sXT88E4ZuCsnCxFBpY6Zb3xp7bX9RIiI7Gu6wwXqbgeUpyIWj%2FniDo4G2ksSxCHjPte0lAxtrqRRRx1ZV12QkrJMX6RpBvhpeb4sUh9ujr3u3%2F1mlCVO1uAZnzHp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff22dbc556bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET stormtrk.com/api/1.0/ping/pong?location=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce

172.67.69.203

200 OK

653 B

URL GET HTTP/2
stormtrk.com/api/1.0/ping/pong?location=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce
IP
172.67.69.203:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectstormtrk.com
Fingerprint1F:F3:7F:EE:CA:64:B3:D7:E5:63:51:58:3C:32:70:22:53:56:0E:76
ValidityWed, 08 Nov 2023 23:28:06 GMT - Tue, 06 Feb 2024 23:28:05 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (674), with no line terminators
Size
653 B (653 bytes)
Hash
dde81f570e81ca9960b0189a021a984b
4bd5fe400da0ec5222c6cd1271e1b7688daa0874
6cc6a7f01fdc9b427c5d8bc5844790f8676ede788ca46c2891a186cd323ab16c

HTTP Headers

GET /api/1.0/ping/pong?location=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3D2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm%26lptoken%3D175600616246453c80ce HTTP/1.1
Host: stormtrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ziaont.com
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 22 Nov 2023 03:13:28 GMT
content-type: application/json
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EFImIbWhyvZmgHZdITO%2BZ37DEmUPB84tpnjuYNln1uW4oAMXw1vANpg1yX4EZP7HL7jHPZwu8IMiYN3rU5ug0xxpmcYmfxNK%2Fsrn8F0ixvgHjmeibanApngi2mmoxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 829dff2429c70b31-OSL
content-encoding: br
X-Firefox-Spdy: h2

GET ziaont.com/z/index_files/5.jpg

188.114.97.1

200 OK

3.3 kB

URL GET HTTP/3
ziaont.com/z/index_files/5.jpg
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, datetime=2017:06:15 10:57:43], baseline, precision 8, 50x50, components 3\012- data
Size
3.3 kB (3268 bytes)
Hash
92c40a962aa579868b64b8b7f1b6575c
f676f1ce463a7b0b7b2c05587a9b52285e55e679
64e47fb0b1dc439d03463c15a7977d88988a4d3f7d563e3d772cc9ca8d41e414

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/5.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: image/jpeg
content-length: 3268
last-modified: Wed, 02 Nov 2022 07:26:39 GMT
etag: "63621baf-cc4"
expires: Fri, 08 Dec 2023 15:01:44 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1167103
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q6OsY0FJfga3Z%2FebrTa3obnw1mtgqCxjvtcj6oKs%2B6SuIW%2F0v%2F5jGcuff01K9Fy%2FvJcpwl%2FyPu5VqsoQwnFiE26n58spY4Ogep0YU5RCPoj4qS8dOc5b8H7nl9i%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 829dff23ec3b56bf-OSL
alt-svc: h3=":443"; ma=86400

GET redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js

139.45.197.251

200 OK

27 kB

URL GET HTTP/2
redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=2cPOji6BquPBPEGQWoyhMJdxWTENGWml4N9xhk3laXOzqh_0n1TT0th57DHhj4g4R75IriP2fTpbC0nIKNStd8g2EFnyXAKlKfltpJViTzm9CTxtWL2SxoCy0dqfpbGiy09EvFFxL8ldN8nqnPMDsmLMBdXevP3YXxmohb9-bKAietswsFldI86Zp-5UaJmhu_GlxCdGV_w5r37WJiNq-16MZ8brWlCft7ARAVobDhKgnymYx9HXGB3Ryp_U024NeDwxZE0TnEh-EcO6ThdTCBf-9-C_zNXsinx2bYxXyOzQ-dKkg5GGTB85d0WJs7WBonDPHY3HW18QOKfFCKJ47V_dJX1pZTHPDF67GweJpAy5mdP46xCgZ0p44JhDwlzm&lptoken=175600616246453c80ce
Certificate
IssuerLet's Encrypt
Subjectredrotou.net
Fingerprint75:61:49:6F:3C:DF:A2:36:1C:08:81:85:8A:A6:7D:E9:AE:31:71:1D
ValiditySat, 28 Oct 2023 05:44:53 GMT - Fri, 26 Jan 2024 05:44:52 GMT

File type
ASCII text, with very long lines (27007), with no line terminators
Size
27 kB (27007 bytes)
Hash
5ccd2d5882a06f293d07510ac91c92e6
b44dc0eaa03981adb70d3313e728f9359c1d21c1
9fc2aa21f3a7bfe66783d35fdbb48147f73e72a41f87aea848f64a8cb4518eba

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js HTTP/1.1
Host: redrotou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 03:13:27 GMT
content-type: application/javascript
last-modified: Tue, 21 Nov 2023 16:59:22 GMT
etag: W/"655ce1ea-697f"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by