WEBSITE ANALYSIS REPORT

http://c94hwz4.pages.dev/

21 Aug 2026 · 20:01:51.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

c94hwz4.pages.dev2 captured requests
cdn.redgarto.com6 captured requests
cdn.show-creative1.com1 captured requests
cdn.storageimagedisplay.com24 captured requests
exemplarfederallithe.com1 captured requests
flushpersist.com2 captured requests
fonts.googleapis.com1 captured requests
fonts.gstatic.com2 captured requests
furiousexpansion.com18 captured requests
go.realus.lt2 captured requests
mamshirt.com1 captured requests
portalfluently.com2 captured requests
protrafficinspector.com4 captured requests
racingorchestra.com5 captured requests
sleepoverlimitprofound.com36 captured requests
static.nresystems.com1 captured requests
wingsmob.com3 captured requests
workdeadlinededicate.com12 captured requests

Connections

c94hwz4.pages.dev → cdn.redgarto.comCalls3 captured connections
c94hwz4.pages.dev → cdn.redgarto.comLoads from3 captured connections
c94hwz4.pages.dev → cdn.show-creative1.comCalls1 captured connections
c94hwz4.pages.dev → cdn.storageimagedisplay.comLoads from24 captured connections
c94hwz4.pages.dev → exemplarfederallithe.comLoads from1 captured connections
c94hwz4.pages.dev → flushpersist.comLoads from2 captured connections
c94hwz4.pages.dev → fonts.googleapis.comLoads from1 captured connections
c94hwz4.pages.dev → fonts.gstatic.comLoads from2 captured connections
c94hwz4.pages.dev → furiousexpansion.comCalls2 captured connections
c94hwz4.pages.dev → furiousexpansion.comLoads from16 captured connections
c94hwz4.pages.dev → go.realus.ltLoads from2 captured connections
c94hwz4.pages.dev → mamshirt.comLoads from1 captured connections
c94hwz4.pages.dev → portalfluently.comLoads from2 captured connections
c94hwz4.pages.dev → protrafficinspector.comCalls4 captured connections
c94hwz4.pages.dev → racingorchestra.comLoads from5 captured connections
c94hwz4.pages.dev → sleepoverlimitprofound.comCalls4 captured connections
c94hwz4.pages.dev → sleepoverlimitprofound.comLoads from32 captured connections
c94hwz4.pages.dev → static.nresystems.comLoads from1 captured connections
c94hwz4.pages.dev → wingsmob.comCalls2 captured connections
c94hwz4.pages.dev → wingsmob.comLoads from1 captured connections
c94hwz4.pages.dev → workdeadlinededicate.comCalls5 captured connections
c94hwz4.pages.dev → workdeadlinededicate.comLoads from7 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

20:01:21.085 GET 200 document 44.9 KB 214 ms —

20:01:21.716 GET 200 script 32.3 KB 156 ms 1 alerts

20:01:21.718 GET 200 script 32.2 KB 154 ms 1 alerts

20:01:21.719 GET 200 script 32.3 KB 151 ms 1 alerts

20:01:21.721 GET 200 script 32.2 KB 138 ms 1 alerts

20:01:21.722 GET 200 script 94.8 KB 148 ms 1 alerts

20:01:21.724 GET No response script 0 B 0 ms —

20:01:21.928 GET 200 script 83.4 KB 107 ms 1 alerts

20:01:21.930 GET 200 xhr 40 B 113 ms —

20:01:21.932 GET 200 script 4.2 KB 117 ms —

20:01:21.933 GET No response script 0 B 0 ms —

20:01:21.957 GET 200 xhr 40 B 90 ms —

20:01:21.961 GET 200 xhr 14.2 KB 554 ms 1 alerts

20:01:21.962 GET 200 xhr 40 B 87 ms —

20:01:21.964 GET 200 xhr 14.1 KB 139 ms 1 alerts

20:01:21.968 GET 200 xhr 40 B 99 ms —

20:01:21.969 GET 200 xhr 14.1 KB 551 ms 1 alerts

20:01:21.971 GET 200 script 90.2 KB 80 ms —

20:01:21.973 GET 200 img 0 B 384 ms 1 alerts

20:01:22.046 GET 200 xhr 14.0 KB 485 ms 1 alerts

20:01:22.047 GET 200 xhr 14.2 KB 127 ms 1 alerts

20:01:22.061 GET 200 xhr 14.0 KB 542 ms 1 alerts

20:01:22.113 GET 200 img 56.2 KB 315 ms —

20:01:22.114 GET 200 img 15.6 KB 313 ms —

20:01:22.116 GET 200 img 117.9 KB 128 ms —

20:01:22.117 GET 200 img 20.5 KB 311 ms —

20:01:22.123 GET 200 img 0 B 0 ms 1 alerts

20:01:22.124 GET 200 img 0 B 0 ms 1 alerts

Transaction #30

Request / response

URL

GET HTTPS

https://furiousexpansion.com/ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRQeG0NDgUBHSrRCCIGU8-3v2Uu6iJ-G3EESlAJRzN8eE493NjuztuPqQiJEeUIUlHuf73IVB0gIWuSjQ0LKdlfEDSUdSCglsmNxiJHmvTfzjd5833vv88NqQbqo6PkH18xUaU23kq7vvXFL5cKMrbdz0wv8rn_Fu6Xy7fiKN1macvRWEMVd_03vPckHZiv0A98P_MB7V5UyM5OtFQpVnAZp0t2Ou0HQ7wZJiEn5_xtbtWBpC2K0IC9BieaF37OPofgc-fC7t6UdOFNcfmdYaepMiZE4-Sgf5GacY3gRZmULWX6yfg1jG0K-bsPkJ2sVMKOjpQow1ZD2pcdg-cmaKtjo-ClbpiFzMPE8xqM5pJ5D0Tm4uQ8lHhGAC-zsIh8-3DHlmN59itIl2pDO339BjRvSebyBfHh6VauJd8PoyimTW0yyGmoyh9qbo6jO4KZtqPEZuPsMSvxG_PYryIfH12hVUihRr-SrbA5qW6iWW7VQZW1URRtDce7RtJ-xdDumqcx6mfCDHqdJFKW9OAmzbZ6g4vegxAF4uY-i3MdAHcCKFqxrSOvDfYxEfSy0DW39UGhbsWDtw7WP6plxe4f02Lg9mRPQ8gClqI9UccfeB3fPzKaZFTOzNJS5ekaZqGdKOILyzvlrfkD9MJHppqT9YLMno2Cz3_ejzTjlrJ_yOIri9CizrqoPiwV5cVXCP_qfYCDPPcnjjKc8yHzWFyHrhVmP09SPAilpHKcprKqhbHtVnKlqyEaHoVj29U8DRs9g9Rm4ehm0CkDHNeinNab5N9qYgXSm6FrlJISpUbgO3N3WoV6Qjdn1m1d_XvG4vP0tJP-VrBd4WaMoa9xWvxDs6Xvf7xZODdWULnt7w1EnnwNVj3afgKuGPPvk1dWQXboegxf7sMW_mWbaFg2RP70PawhY0YZWBFpefEVZDfufM7uID-0D7JUdMN2ZMV12jpgu9VerdCvKDZGLHxvy-g8PYNW554tYBjylSS-TSZKwJA55ljG_F2ZRFPZTONvc_uL0y38CAAD__1C-ic3-AwAA

IP / ASN

23.111.84.4

AS7979 · SERVERS-COM

Requested by: https://c94hwz4.pages.dev/

Resource information

File type: Not recorded
MIME type: image/gif
First seen (UTC): Not recorded
Last seen (UTC): 22 Oct 2026 · 13:07:51.045 UTC
Times seen: 19283510

Size: 0 B (0 bytes)
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate information

Issuer: Let's Encrypt · YR2
Subject: furiousexpansion.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 81:6B:A0:BD:75:1F:EB:D5:DD:2D:06:86:4C:AC:44:33:8B:11:5A:CF
Valid from: Thu, 25 Jun 2026 21:40:07 GMT
Valid until: Wed, 23 Sep 2026 21:40:06 GMT

Technology fingerprints

HSTS (Security)
Nginx:1.30.2 (Web servers, Reverse proxies)
Envoy (Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /ren.gif?sid=H4sIAAAAAAAC_1xSPYwbRRQeG0NDgUBHSrRCCIGU8-3v2Uu6iJ-G3EESlAJRzN8eE493NjuztuPqQiJEeUIUlHuf73IVB0gIWuSjQ0LKdlfEDSUdSCglsmNxiJHmvTfzjd5833vv88NqQbqo6PkH18xUaU23kq7vvXFL5cKMrbdz0wv8rn_Fu6Xy7fiKN1macvRWEMVd_03vPckHZiv0A98P_MB7V5UyM5OtFQpVnAZp0t2Ou0HQ7wZJiEn5_xtbtWBpC2K0IC9BieaF37OPofgc-fC7t6UdOFNcfmdYaepMiZE4-Sgf5GacY3gRZmULWX6yfg1jG0K-bsPkJ2sVMKOjpQow1ZD2pcdg-cmaKtjo-ClbpiFzMPE8xqM5pJ5D0Tm4uQ8lHhGAC-zsIh8-3DHlmN59itIl2pDO339BjRvSebyBfHh6VauJd8PoyimTW0yyGmoyh9qbo6jO4KZtqPEZuPsMSvxG_PYryIfH12hVUihRr-SrbA5qW6iWW7VQZW1URRtDce7RtJ-xdDumqcx6mfCDHqdJFKW9OAmzbZ6g4vegxAF4uY-i3MdAHcCKFqxrSOvDfYxEfSy0DW39UGhbsWDtw7WP6plxe4f02Lg9mRPQ8gClqI9UccfeB3fPzKaZFTOzNJS5ekaZqGdKOILyzvlrfkD9MJHppqT9YLMno2Cz3_ejzTjlrJ_yOIri9CizrqoPiwV5cVXCP_qfYCDPPcnjjKc8yHzWFyHrhVmP09SPAilpHKcprKqhbHtVnKlqyEaHoVj29U8DRs9g9Rm4ehm0CkDHNeinNab5N9qYgXSm6FrlJISpUbgO3N3WoV6Qjdn1m1d_XvG4vP0tJP-VrBd4WaMoa9xWvxDs6Xvf7xZODdWULnt7w1EnnwNVj3afgKuGPPvk1dWQXboegxf7sMW_mWbaFg2RP70PawhY0YZWBFpefEVZDfufM7uID-0D7JUdMN2ZMV12jpgu9VerdCvKDZGLHxvy-g8PYNW554tYBjylSS-TSZKwJA55ljG_F2ZRFPZTONvc_uL0y38CAAD__1C-ic3-AwAA HTTP/1.1
Host: furiousexpansion.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://c94hwz4.pages.dev/
Sec-Fetch-Storage-Access: none
Sec-GPC: 1
Connection: keep-alive
Cookie: pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; u_pl15415389=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Priority: u=5, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.30.2
Date: Fri, 21 Aug 2026 20:01:22 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
accept-ch: Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model,X-Device-User-Agent,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,Sec-Ch-Ua,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Mobile,Device-Stock-Ua,User-Agent,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Full-Version-List
access-control-allow-credentials: true
access-control-allow-origin: *
vary: Origin
x-envoy-upstream-service-time: 2
Host: furiousexpansion.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 4503dc8e0f52b185c30d278906381ba1
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

20:01:22.125 GET 200 img 0 B 0 ms 1 alerts

20:01:22.126 GET 200 img 0 B 0 ms 1 alerts

20:01:22.127 GET 200 img 0 B 0 ms 1 alerts

20:01:22.128 GET 200 img 0 B 0 ms 1 alerts

20:01:22.129 GET 200 img 0 B 0 ms 1 alerts

20:01:22.130 GET 200 img 0 B 0 ms 1 alerts

20:01:22.140 GET 200 script 83.4 KB 28 ms 1 alerts

20:01:22.141 GET 200 img 0 B 0 ms —

20:01:22.144 GET 200 xhr 76 B 94 ms —

20:01:22.181 GET 200 img 136.1 KB 105 ms —

20:01:22.182 GET 200 img 160.0 KB 105 ms —

20:01:22.185 GET 200 img 112.1 KB 100 ms —

20:01:22.187 GET 200 img 94.2 KB 100 ms —

20:01:22.190 GET 200 img 0 B 0 ms 1 alerts

20:01:22.191 GET 200 img 0 B 0 ms 1 alerts

20:01:22.192 GET 200 img 0 B 0 ms 1 alerts

20:01:22.193 GET 200 img 0 B 0 ms 1 alerts

20:01:22.194 GET 200 img 0 B 0 ms 1 alerts

20:01:22.195 GET 200 img 0 B 0 ms 1 alerts

20:01:22.196 GET 200 img 0 B 0 ms 1 alerts

20:01:22.197 GET 200 img 0 B 0 ms 1 alerts

20:01:22.422 GET 200 xhr 5.1 KB 323 ms 2 alerts

http://c94hwz4.pages.dev/

Domain graph

Hostnames

Connections

Network requests

Transaction #30

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://c94hwz4.pages.dev/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #30

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://c94hwz4.pages.dev/

Domain graph

Network requests