GET city-mall.top/red/new/logo.png
200 OK 154 kB URL GET HTTP/2 city-mall.top/red/new/logo.png
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type gzip compressed data, from Unix
Size 154 kB (153735 bytes)
Hash 736aa97630c3c588ab6a17767fb289cd
8dc3d9f0e0c1aa6b7e0cf78f0bab2187c4cf5122
2fcb8aa307afd43d1620d24abd2ed4121f5856d51b93b32ad6cf817ecc73dfc4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/new/logo.png HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: image/png
last-modified: Tue, 12 Nov 2024 06:41:23 GMT
vary: Accept-Encoding
etag: W/"6732f893-881c"
expires: Tue, 07 Jan 2025 23:46:57 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 18 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint2A:56:7F:C1:73:8D:7A:48:D9:E7:52:83:15:27:9D:C3:C9:23:71:52
ValidityMon, 21 Oct 2024 08:37:59 GMT - Mon, 13 Jan 2025 08:37:58 GMT
File type Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Hash 8eff0b8045fd1959e117f85654ae7770
227fee13ceb7c410b5c0bb8000258b6643cb6255
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
GET /s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://city-mall.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18536
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 05 Dec 2024 11:37:11 GMT
expires: Fri, 05 Dec 2025 11:37:11 GMT
cache-control: public, max-age=31536000
age: 303000
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET city-mall.top/red/bootstrap/js/bootstrap.min.js
200 OK 37 kB URL GET HTTP/2 city-mall.top/red/bootstrap/js/bootstrap.min.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type gzip compressed data, from Unix
Hash 0efcc1669639fbdf1174179bca06c9df
846d9945eeb5ae5db6073675834b8a97c9e3cce1
4618ced6a769cc77512c1092c0cbf5a96bb5f7e311e2f7a63198672c7de086bb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/bootstrap/js/bootstrap.min.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Sat, 06 Mar 2021 02:08:34 GMT
vary: Accept-Encoding
etag: W/"6042e422-f7eb"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/static_new/js/dialog.min.js
200 OK 7.0 kB URL GET HTTP/2 city-mall.top/static_new/js/dialog.min.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type gzip compressed data, from Unix
Hash 8bbb093b8c2b09dab6151da4db05f5ac
abef1291c3bad8e34d4dacc72c1c591236df713b
a8d46ce008cf6c6a0f4411f22c59853e71f5b47e03e8dd98bf99f1e4bc5225f7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /static_new/js/dialog.min.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Sat, 15 Feb 2020 10:13:12 GMT
vary: Accept-Encoding
etag: W/"5e47c438-6cfa"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/favicon.ico
200 OK 179 kB URL GET HTTP/2 city-mall.top/favicon.ico
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type PNG image data, 626 x 626, 8-bit/color RGB, non-interlaced
Size 179 kB (178864 bytes)
Hash 07c66d5db572f6433720633f826367f5
cbe1bf65bd9dc117ea15729a7f757c7f5a2eca80
fc39f0d3fa41a261afdecb09107271197266c6364cf835f0de5794a5c490c695
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:58 GMT
content-type: image/x-icon
content-length: 178864
last-modified: Mon, 17 Oct 2022 05:55:28 GMT
etag: "634cee50-2bab0"
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
accept-ranges: bytes
X-Firefox-Spdy: h2
GET city-mall.top/red/new/form-bg.png
200 OK 271 kB URL GET HTTP/2 city-mall.top/red/new/form-bg.png
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type gzip compressed data, from Unix
Size 271 kB (271161 bytes)
Hash a858222f3095392f259b5f147fab25b1
e49d86f8d6d23a4b3bd7754c49ba1b1360beff5f
3e1577e0ac375df70b87fea31565f9718766fd6e9a4c5eae73dba73a2228fbc4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/new/form-bg.png HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:58 GMT
content-type: image/png
last-modified: Tue, 12 Nov 2024 14:17:33 GMT
vary: Accept-Encoding
etag: W/"6733637d-4040b"
expires: Tue, 07 Jan 2025 23:46:58 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/popper.min.js
200 OK 21 kB URL GET HTTP/2 city-mall.top/red/popper.min.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, ASCII text, with very long lines (20831)
Hash 56456db9d72a4b380ed3cb63095e6022
6dbce88aee15b42f29083df7a07513cf3b486ba0
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/popper.min.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Fri, 05 Mar 2021 15:34:56 GMT
vary: Accept-Encoding
etag: W/"60424fa0-520c"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/swiper/swiper-bundle.min.js
200 OK 140 kB URL GET HTTP/2 city-mall.top/red/swiper/swiper-bundle.min.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, ASCII text, with very long lines (65278)
Size 140 kB (139961 bytes)
Hash c4358cb63a4b96c5d71a2fb630871f30
be3b7d9d5bbd680d035f768345778d84eb08fe23
c26293076ae548cd0614c5946e9c16f34bd7810fd2f63deeaa28df61ce935229
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/swiper/swiper-bundle.min.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Fri, 05 Mar 2021 15:40:04 GMT
vary: Accept-Encoding
etag: W/"604250d4-222b9"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/main.js?v=V1.24
200 OK 9.9 kB URL GET HTTP/2 city-mall.top/red/main.js?v=V1.24
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, ASCII text, with very long lines (10194), with no line terminators
Hash 064d0058166ab3b3b9849e822261e808
61bb23d45cb3d768c5216b2ba1f2f2e2ede51c17
f58bd812eb5aff67ce289c50f1c12d7c4de5b40123bbc5e92d980cf8bd4fe5d2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/main.js?v=V1.24 HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Wed, 19 Jan 2022 04:58:46 GMT
vary: Accept-Encoding
etag: W/"61e79a86-269b"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/bootstrap/css/bootstrap.min.css
200 OK 161 kB URL GET HTTP/2 city-mall.top/red/bootstrap/css/bootstrap.min.css
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type ASCII text, with very long lines (65326)
Size 161 kB (161409 bytes)
Hash d432e4222814b62dd30c9513dcc29440
2cac4afc120983921411296bd4e8fd8a94ba237e
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/bootstrap/css/bootstrap.min.css HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/css
last-modified: Sat, 06 Mar 2021 02:08:24 GMT
vary: Accept-Encoding
etag: W/"6042e418-27681"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/jquery-3.3.1.min.js
200 OK 87 kB URL GET HTTP/2 city-mall.top/red/jquery-3.3.1.min.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, ASCII text, with very long lines (65451)
Hash a09e13ee94d51c524b7e2a728c7d4039
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/jquery-3.3.1.min.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Fri, 05 Mar 2021 15:34:38 GMT
vary: Accept-Encoding
etag: W/"60424f8e-1538f"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/public/js/layer_mobile/need/layer.css
200 OK 5.3 kB URL GET HTTP/2 city-mall.top/public/js/layer_mobile/need/layer.css
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type ASCII text, with very long lines (5260), with no line terminators
Hash 633915e62d14a714594b95b974ee0836
e11ebb64a70272c4f35b92fea064f27c4b87efad
eecc7effcae5f246e6212c30c525cee9e11cadedc7d32aa6def213f1a90d98f6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /public/js/layer_mobile/need/layer.css HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/css
last-modified: Tue, 10 Dec 2019 03:14:46 GMT
vary: Accept-Encoding
etag: W/"5def0da6-148c"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
200 OK 128 kB URL GET HTTP/2 fonts.gstatic.com/s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
IP
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint2A:56:7F:C1:73:8D:7A:48:D9:E7:52:83:15:27:9D:C3:C9:23:71:52
ValidityMon, 21 Oct 2024 08:37:59 GMT - Mon, 13 Jan 2025 08:37:58 GMT
File type Web Open Font Format (Version 2), TrueType, length 128352, version 1.0
Size 128 kB (128352 bytes)
Hash 53436aca8627a49f4deaaa44dc9e3c05
0bc0c675480d94ec7e8609dda6227f88c5d08d2c
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
GET /s/materialicons/v142/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://city-mall.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 128352
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 06 Dec 2024 18:20:39 GMT
expires: Sat, 06 Dec 2025 18:20:39 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 08 Apr 2024 19:04:47 GMT
content-type: font/woff2
age: 192392
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET city-mall.top/index/user/login.html
200 OK 8.3 kB URL User Request GET HTTP/2 city-mall.top/index/user/login.html
IP
ASN #55933 Cloudie Limited
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (8474), with no line terminators
Hash b74fb8e6cd72e232dd2d3336928366be
66081561dd947312db9946effab0ba3d227285d9
2efc3e6b139c4901bc5127d568808cd527ce3b965e95483572e91493c91ff549
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /index/user/login.html HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:56 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 19 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint2A:56:7F:C1:73:8D:7A:48:D9:E7:52:83:15:27:9D:C3:C9:23:71:52
ValidityMon, 21 Oct 2024 08:37:59 GMT - Mon, 13 Jan 2025 08:37:58 GMT
File type Web Open Font Format (Version 2), TrueType, length 18596, version 1.0
Hash c83e4437a53d7f849f9d32df3d6b68f3
fabea5ad92ed3e2431659b02e7624df30d0c6bbc
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
GET /s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://city-mall.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18596
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 06 Dec 2024 08:44:50 GMT
expires: Sat, 06 Dec 2025 08:44:50 GMT
cache-control: public, max-age=31536000
age: 226941
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET city-mall.top/public/js/layer_mobile/layer.js
200 OK 3.3 kB URL GET HTTP/2 city-mall.top/public/js/layer_mobile/layer.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (3435), with no line terminators
Hash 13fd3d5b0fb763160395abbad25d8e57
6bc56d44091c873f6b5496ef8be2ed9f36e5220b
f1757725deb30f2928f10e427b253f153b0466a60a1c399e9f6bb6cbf5908941
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /public/js/layer_mobile/layer.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Tue, 10 Dec 2019 03:14:46 GMT
vary: Accept-Encoding
etag: W/"5def0da6-ce8"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/index/rot_order/index.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/
301 Moved Permanently 8.3 kB URL User Request GET HTTP/2 city-mall.top/index/rot_order/index.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/
IP
ASN #55933 Cloudie Limited
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /index/rot_order/index.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/index/user/login.html/ HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
server: nginx
date: Sun, 08 Dec 2024 23:46:56 GMT
content-type: text/html; charset=utf-8
set-cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3; path=/; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-cache,must-revalidate
location: /index/user/login.html
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
X-Firefox-Spdy: h2
GET fonts.googleapis.com/icon?family=Material+Icons
200 OK 565 B URL GET HTTP/2 fonts.googleapis.com/icon?family=Material+Icons
IP
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintE8:18:86:79:89:2E:F0:7C:66:1F:C3:43:81:D2:6D:9E:0C:9C:AB:05
ValidityMon, 21 Oct 2024 08:38:00 GMT - Mon, 13 Jan 2025 08:37:59 GMT
File type ASCII text, with very long lines (588), with no line terminators
Hash 959a533a3dc02649e0cc3f8f67d942af
34db49ff64aed8b51beaba5b9928ad504a4df335
24864ed3ee6fab66640980d4c24640e579e5583764a8ee8c4f09decf27977247
GET /icon?family=Material+Icons HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 08 Dec 2024 23:47:10 GMT
date: Sun, 08 Dec 2024 23:47:10 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET city-mall.top/red/swiper/swiper-bundle.min.css
200 OK 14 kB URL GET HTTP/2 city-mall.top/red/swiper/swiper-bundle.min.css
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type ASCII text, with very long lines (13663)
Hash 4d0619d7577a990881a0079718c5c92e
02553ae8ed1026ae5e1fe6cc5883fd42379e5e68
f9a55bcc80d6d8b2815299c5501cddaa8e5f3f697cdb8f5ce1e3e924097117ba
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/swiper/swiper-bundle.min.css HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/css
last-modified: Fri, 05 Mar 2021 15:40:04 GMT
vary: Accept-Encoding
etag: W/"604250d4-3661"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/statics/intl-tel-input-master/css/intlTelInput.css
404 Not Found 0 B URL GET HTTP/2 city-mall.top/statics/intl-tel-input-master/css/intlTelInput.css
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /statics/intl-tel-input-master/css/intlTelInput.css HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-cache,must-revalidate
location: /index/user/login.html
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/statics/intl-tel-input-master/css/demo.css
404 Not Found 0 B URL GET HTTP/2 city-mall.top/statics/intl-tel-input-master/css/demo.css
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /statics/intl-tel-input-master/css/demo.css HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-cache,must-revalidate
location: /index/user/login.html
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/style.css?v=V2.0
200 OK 160 kB URL GET HTTP/2 city-mall.top/red/style.css?v=V2.0
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
Size 160 kB (160179 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/style.css?v=V2.0 HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/css
last-modified: Tue, 12 Nov 2024 01:56:04 GMT
vary: Accept-Encoding
etag: W/"6732b5b4-271b3"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/static_new/css/public.css?v=V1.24
200 OK 16 kB URL GET HTTP/2 city-mall.top/static_new/css/public.css?v=V1.24
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type ASCII text, with CRLF line terminators
Hash 8d9acb36e3f61379b86658df119cbe5f
4b40186551b53328baedb162e495dd276620c3fe
2509b72d37e08bbb3d3107b1cf2a5412c2cd17ca5b2949857b37557e192152d0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /static_new/css/public.css?v=V1.24 HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/css
last-modified: Sat, 15 Feb 2020 10:13:12 GMT
vary: Accept-Encoding
etag: W/"5e47c438-3f5a"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/static_new/js/jquery.progressBarTimer.js
200 OK 1.9 kB URL GET HTTP/2 city-mall.top/static_new/js/jquery.progressBarTimer.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, ASCII text, with very long lines (1964), with no line terminators
Hash 7ef8f542b5e02727508b108913d19dec
a65ad9d24c66408b2a4156a763dd56d7387f4f3f
55243594fcb2da2fa6915b028bbda68713f7a96b9530a3a92fd78e5b5c0e8e4a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /static_new/js/jquery.progressBarTimer.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Sat, 03 Apr 2021 06:32:48 GMT
vary: Accept-Encoding
etag: W/"60680c10-784"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/static_new/js/common.js
200 OK 2.1 kB URL GET HTTP/2 city-mall.top/static_new/js/common.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (2192), with no line terminators
Hash 1602305add4522cf987af4464aa97131
b6c0c2c23b29bde23f0142b6ce7a57315856285f
ebf9a4d2dc159edb856909b907d4b8d844f5197bee62df0b2f02e559c9c3739b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /static_new/js/common.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Sun, 29 Mar 2020 13:03:20 GMT
vary: Accept-Encoding
etag: W/"5e809c98-84e"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap
200 OK 9.6 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap
IP
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintE8:18:86:79:89:2E:F0:7C:66:1F:C3:43:81:D2:6D:9E:0C:9C:AB:05
ValidityMon, 21 Oct 2024 08:38:00 GMT - Mon, 13 Jan 2025 08:37:59 GMT
File type ASCII text, with very long lines (9828), with no line terminators
Hash 2868680b0ad7c149310bfb73fe8bae8e
444e92e0f1d6545f19f64066af94d6937949906a
604a43d34d4cb1dee0fde051fb3b16e30bc283e66ed7f9f6540ebe07ad2405c9
GET /css?family=Roboto:300,400,500,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 08 Dec 2024 23:47:10 GMT
date: Sun, 08 Dec 2024 23:47:10 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET city-mall.top/public/js/layer_mobile/need/layer.css?2.0
200 OK 5.3 kB URL GET HTTP/2 city-mall.top/public/js/layer_mobile/need/layer.css?2.0
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type ASCII text, with very long lines (5260), with no line terminators
Hash 633915e62d14a714594b95b974ee0836
e11ebb64a70272c4f35b92fea064f27c4b87efad
eecc7effcae5f246e6212c30c525cee9e11cadedc7d32aa6def213f1a90d98f6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /public/js/layer_mobile/need/layer.css?2.0 HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: text/css
last-modified: Tue, 10 Dec 2019 03:14:46 GMT
vary: Accept-Encoding
etag: W/"5def0da6-148c"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
GET city-mall.top/red/jquery.cookie.js
200 OK 3.1 kB URL GET HTTP/2 city-mall.top/red/jquery.cookie.js
IP
ASN #55933 Cloudie Limited
Requested by https://city-mall.top/index/user/login.html
Certificate IssuerLet's Encrypt
Subjectcity-mall.top
FingerprintCC:F7:58:98:46:57:4A:F1:45:66:D5:62:25:79:34:9E:26:DA:2C:55
ValidityWed, 13 Nov 2024 01:30:13 GMT - Tue, 11 Feb 2025 01:30:12 GMT
File type JavaScript source, ASCII text, with very long lines (3441), with no line terminators
Hash c70a657c6ff1764a238929b6e46fb8e4
e2a8eb96b388abf14690ea14fe4af3f600296235
466840a5176a0d6bd70e2d5ade5928ad656ca6b9cd3040a241e33478c63f5813
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /red/jquery.cookie.js HTTP/1.1
Host: city-mall.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://city-mall.top/index/user/login.html
Cookie: sa4ee0276=durnlkngn18m6p2j1m7ot2ehj3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 08 Dec 2024 23:46:57 GMT
content-type: application/javascript
last-modified: Fri, 05 Mar 2021 15:36:06 GMT
vary: Accept-Encoding
etag: W/"60424fe6-c31"
expires: Mon, 09 Dec 2024 11:46:57 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443"
content-encoding: gzip
X-Firefox-Spdy: h2
103.246.245.91
142.250.74.131