WEBSITE ANALYSIS REPORT

http://xyzkooora4liv-com.smartagro.mov/?m=30696&lang=ar

02 Jul 2026 · 23:16:15.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

a11.kora-plus.app8 captured requests
accounts.google.com3 captured requests
acscdn.com2 captured requests
adexchangerapid.com1 captured requests
b7510.com1 captured requests
bvtpk.com1 captured requests
cdn.jsdelivr.net8 captured requests
cdn.redgarto.com4 captured requests
cdn.show-sb.com1 captured requests
cdn.socket.io1 captured requests
cdn.storageimagedisplay.com2 captured requests
chat.kora-api.top1 captured requests
fiscalexplanation.com5 captured requests
flushpersist.com1 captured requests
fonts.googleapis.com2 captured requests
fonts.gstatic.com7 captured requests
kettledroopingcontinuation.com4 captured requests
kora-api.space1 captured requests
nj.throwaflaunt.com1 captured requests
opensignal.meshify.cloud1 captured requests
play.google.com1 captured requests
portalfluently.com1 captured requests
protrafficinspector.com2 captured requests
signalcloud.meshify.cloud1 captured requests
slayingbugeyes.com1 captured requests
strm02.app2 captured requests
us.meshify.cloud1 captured requests
usrpubtrk.com1 captured requests
ws.kora-api.top1 captured requests
xyzkooora4liv-com.smartagro.mov1 captured requests

Connections

a11.kora-plus.app → acscdn.comLoads from2 captured connections
a11.kora-plus.app → adexchangerapid.comCalls1 captured connections
a11.kora-plus.app → b7510.comCalls1 captured connections
a11.kora-plus.app → bvtpk.comLoads from1 captured connections
a11.kora-plus.app → cdn.jsdelivr.netLoads from3 captured connections
a11.kora-plus.app → nj.throwaflaunt.comLoads from1 captured connections
a11.kora-plus.app → opensignal.meshify.cloudCalls1 captured connections
a11.kora-plus.app → signalcloud.meshify.cloudCalls1 captured connections
a11.kora-plus.app → us.meshify.cloudCalls1 captured connections
a11.kora-plus.app → usrpubtrk.comCalls1 captured connections
accounts.google.com → fonts.gstatic.comLoads from2 captured connections
accounts.google.com → play.google.comCalls1 captured connections
chat.kora-api.top → accounts.google.comEmbeds1 captured connections
chat.kora-api.top → accounts.google.comLoads from2 captured connections
chat.kora-api.top → cdn.jsdelivr.netLoads from4 captured connections
chat.kora-api.top → cdn.socket.ioLoads from1 captured connections
chat.kora-api.top → fonts.googleapis.comLoads from1 captured connections
chat.kora-api.top → fonts.gstatic.comLoads from3 captured connections
strm02.app → a11.kora-plus.appEmbeds1 captured connections
strm02.app → cdn.jsdelivr.netLoads from1 captured connections
strm02.app → cdn.redgarto.comCalls3 captured connections
strm02.app → cdn.redgarto.comLoads from1 captured connections
strm02.app → cdn.show-sb.comCalls1 captured connections
strm02.app → cdn.storageimagedisplay.comLoads from2 captured connections
strm02.app → chat.kora-api.topEmbeds1 captured connections
strm02.app → fiscalexplanation.comCalls1 captured connections
strm02.app → fiscalexplanation.comLoads from4 captured connections
strm02.app → flushpersist.comLoads from1 captured connections
strm02.app → fonts.googleapis.comLoads from1 captured connections
strm02.app → fonts.gstatic.comLoads from2 captured connections
strm02.app → kettledroopingcontinuation.comLoads from4 captured connections
strm02.app → kora-api.spaceCalls1 captured connections
strm02.app → portalfluently.comLoads from1 captured connections
strm02.app → protrafficinspector.comCalls2 captured connections
strm02.app → slayingbugeyes.comLoads from1 captured connections
strm02.app → ws.kora-api.topCalls1 captured connections
ws.kora-api.top → kora-api.spaceRedirects to1 captured connections
xyzkooora4liv-com.smartagro.mov → strm02.appRedirects to1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

23:15:50.448 GET 200 document 0 B 0 ms —

23:15:51.093 GET 200 document 98.0 KB 103 ms —

23:15:51.874 GET 200 script 512.8 KB 21 ms —

23:15:51.877 GET 200 script 91.3 KB 562 ms 1 alerts

Transaction #53

Request / response

URL

GET HTTPS

https://fiscalexplanation.com/7c/de/e1/7cdee121cec3460941807a332080c42f.js

IP / ASN

172.240.108.84

AS7979 · SERVERS-COM

Requested by: https://strm02.app/?m=30696&lang=ar

Resource information

File type: JavaScript source, ASCII text, with very long lines (65536), with no line terminators
MIME type: application/javascript
First seen (UTC): 02 Jul 2026 · 23:16:27.800 UTC
Last seen (UTC): 02 Jul 2026 · 23:16:27.800 UTC
Times seen: 1

Size: 91.3 KB (93465 bytes)
MD5: f569ce9ce95ef01ca4cac9b884829427
SHA1: 01d9291d237aeb1d764178d716ef5b99b54cbe2a
SHA256: a4a054466bde584cb12446f040151e39afd6a78f62815b8ba7d5817c0053461f

Certificate information

Issuer: Let's Encrypt · R12
Subject: fiscalexplanation.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 5B:34:7C:A5:77:60:1A:25:74:67:F3:E5:3B:79:C4:42:87:11:6A:F9
Valid from: Wed, 13 May 2026 11:37:47 GMT
Valid until: Tue, 11 Aug 2026 11:37:46 GMT

Technology fingerprints

HSTS (Security)
Nginx:1.28.2 (Web servers, Reverse proxies)
Envoy (Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /7c/de/e1/7cdee121cec3460941807a332080c42f.js HTTP/1.1
Host: fiscalexplanation.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-Fetch-Storage-Access: none
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.28.2
Date: Thu, 02 Jul 2026 23:15:52 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
accept-ch: Sec-CH-UA-PlatformUser-Agent,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Device-Stock-UA,X-UCBrowser-Device-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Platform,X-Device-User-Agent,X-OperaMini-Phone-UA,User-Agent,Sec-CH-UA-Platform-Version
access-control-allow-origin: *
content-encoding: zstd
vary: Accept-Encoding
x-envoy-upstream-service-time: 3
Host: fiscalexplanation.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: efa1ca7106cc74288ea96eec9971b933
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

23:15:51.878 GET 200 script 6 B 106 ms —

23:15:52.465 GET 200 script 83.4 KB 120 ms —

23:15:52.469 GET 200 xhr 40 B 117 ms —

23:15:52.473 GET 301 fetch 0 B 328 ms —

23:15:52.611 GET 200 xhr 40 B 22 ms —

23:15:52.740 GET 404 img 236 B 7 ms —

23:15:52.796 GET 200 fetch 5.3 KB 87 ms —

23:15:52.816 GET 200 img 0 B 0 ms 3 alerts

23:15:52.911 GET 200 subdocument 85.4 KB 253 ms —

23:15:52.931 GET 200 subdocument 4.9 KB 119 ms —

23:15:52.981 GET 200 xhr 5.6 KB 354 ms 1 alerts

23:15:53.141 GET 200 script 721.9 KB 18 ms —

23:15:53.146 GET 200 script 29.7 KB 14 ms —

23:15:53.149 GET 200 script 203.3 KB 11 ms —

23:15:53.151 GET 200 script 163.5 KB 102 ms 2 alerts

23:15:53.154 GET 200 script 6 B 170 ms 1 alerts

23:15:53.276 GET 200 stylesheet 227.5 KB 9 ms —

23:15:53.278 GET 200 stylesheet 96.0 KB 7 ms —

23:15:53.281 GET 200 stylesheet 21.8 KB 89 ms —

23:15:53.283 GET 200 script 258.0 KB 123 ms —

23:15:53.285 GET 200 script 78.8 KB 8 ms —

23:15:53.287 GET 200 script 48.6 KB 92 ms —

23:15:53.354 GET 200 xhr 1.2 KB 25 ms 2 alerts

23:15:53.355 GET 200 img 0 B 0 ms 1 alerts

23:15:53.416 GET 200 xhr 76.8 KB 24 ms —

23:15:53.418 GET 200 xhr 5.6 KB 26 ms —

23:15:53.422 GET 200 xhr 386 B 18 ms —

23:15:53.427 GET 200 img 0 B 428 ms 4 alerts

23:15:53.430 GET 200 font 127.5 KB 9 ms —

23:15:53.431 GET 200 font 42.1 KB 86 ms —

23:15:53.433 GET 200 font 42.1 KB 85 ms —

23:15:53.484 GET 200 font 42.1 KB 39 ms —

23:15:53.492 GET 200 script 96.5 KB 28 ms 1 alerts

23:15:53.494 GET 200 script 67.5 KB 13 ms 2 alerts

23:15:53.495 GET 200 img 0 B 450 ms 4 alerts

23:15:53.496 GET 200 img 0 B 447 ms 4 alerts

23:15:53.526 GET 200 img 0 B 433 ms 4 alerts

23:15:53.563 GET 200 xhr 531 B 63 ms —

23:15:53.573 GET 200 stylesheet 16.4 KB 35 ms —

23:15:53.584 GET 200 img 3.9 KB 8 ms —

23:15:53.589 GET 200 img 38.3 KB 118 ms —

23:15:53.590 GET 200 img 63.1 KB 337 ms —

23:15:53.717 GET 200 xhr 512.0 KB 116 ms —

23:15:53.796 GET 200 stylesheet 696 B 169 ms —

23:15:53.802 GET 200 subdocument 189.4 KB 249 ms —

23:15:53.910 POST No response xhr 0 B 0 ms 1 alerts

http://xyzkooora4liv-com.smartagro.mov/?m=30696&lang=ar

Domain graph

Hostnames

Connections

Network requests

Transaction #53

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://xyzkooora4liv-com.smartagro.mov/?m=30696&lang=ar

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #53

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://xyzkooora4liv-com.smartagro.mov/?m=30696&lang=ar

Domain graph

Network requests