200 OK 0 B URL cagrep.com/rpe?a=1&s=1&act=18&src=2&p=1010256&st=1373924&wd=655274&d=uddeve.com&tpl=78&rnd=0.30502951346588836&sbid=13371&sbid2=intent%3A%2F%2Fuddeve.com%2Fplay-2_1
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /rpe?a=1&s=1&act=18&src=2&p=1010256&st=1373924&wd=655274&d=uddeve.com&tpl=78&rnd=0.30502951346588836&sbid=13371&sbid2=intent%3A%2F%2Fuddeve.com%2Fplay-2_1 HTTP/1.1
Host: cagrep.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://uddeve.com
DNT: 1
Connection: keep-alive
Referer: https://uddeve.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.18.0
date: Wed, 06 Nov 2024 16:35:30 GMT
content-length: 0
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2
200 OK 2 B URL wokoez.com/phtbload?a=1&e=aeyJwaWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzR9
IP
ASN #39572 DataWeb Global Group B.V.
Hash d751713988987e9331980363e24189ce
97d170e1550eee4afc0af065b78cda302a97674c
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /phtbload?a=1&e=aeyJwaWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzR9 HTTP/1.1
Host: wokoez.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://uddeve.com/
Origin: https://uddeve.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.18.0
date: Wed, 06 Nov 2024 16:35:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 2
access-control-allow-origin: *
accept-ch: Sec-CH-UA-Platform-Version
X-Firefox-Spdy: h2
200 OK 0 B URL cagrep.com/rpe?a=1&s=1&act=7&src=2&p=1010256&st=1373924&wd=655274&d=uddeve.com&tpl=78&rnd=0.15802703187058975&sbid=13371&sbid2=intent%3A%2F%2Fuddeve.com%2Fplay-2_1
IP
ASN #39572 DataWeb Global Group B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /rpe?a=1&s=1&act=7&src=2&p=1010256&st=1373924&wd=655274&d=uddeve.com&tpl=78&rnd=0.15802703187058975&sbid=13371&sbid2=intent%3A%2F%2Fuddeve.com%2Fplay-2_1 HTTP/1.1
Host: cagrep.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://uddeve.com
DNT: 1
Connection: keep-alive
Referer: https://uddeve.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx/1.18.0
date: Wed, 06 Nov 2024 16:35:30 GMT
content-length: 0
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2
GET iaqcfo.com/tb?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=
302 Found 0 B URL User Request GET HTTP/1.1 iaqcfo.com/tb?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerLet's Encrypt
Subjectiaqcfo.com
Fingerprint2D:61:45:BB:2A:80:8F:69:98:D7:24:96:2E:E1:39:EE:31:5E:1A:31
ValidityThu, 19 Sep 2024 22:03:24 GMT - Wed, 18 Dec 2024 22:03:23 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tb?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2=intent://uddeve.com/play-2_1?h=waWQiOjEwMTAyNTYsInNpZCI6MTM3MzkyNCwid2lkIjo2NTUyNzQsInNyYyI6Mn0=eyJ&click_id=M7434184765546168352&si1=13371&si2= HTTP/1.1
Host: iaqcfo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://uddeve.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.15.0
Date: Wed, 06 Nov 2024 16:35:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://track.wbdpnz.com/0f72aceb-1686-4bca-a918-ff82f889bf8f?source_id=&campaign_id=&country=&browser=&zone_id=&creative_id=&format=&os=&partner_id=1010256&sub_period=&cost=&click_id=
X-Zone: eu
GET track.wbdpnz.com/0f72aceb-1686-4bca-a918-ff82f889bf8f?source_id=&campaign_id=&country=&browser=&zone_id=&creative_id=&format=&os=&partner_id=1010256&sub_period=&cost=&click_id=
302 Found 0 B URL User Request GET HTTP/2 track.wbdpnz.com/0f72aceb-1686-4bca-a918-ff82f889bf8f?source_id=&campaign_id=&country=&browser=&zone_id=&creative_id=&format=&os=&partner_id=1010256&sub_period=&cost=&click_id=
IP
Certificate IssuerAmazon
Subjecttrack.wbdpnz.com
FingerprintC8:81:F6:79:E2:7A:64:3E:95:34:AA:C4:2E:5E:20:88:55:9B:AB:7E
ValidityWed, 17 Apr 2024 00:00:00 GMT - Fri, 16 May 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /0f72aceb-1686-4bca-a918-ff82f889bf8f?source_id=&campaign_id=&country=&browser=&zone_id=&creative_id=&format=&os=&partner_id=1010256&sub_period=&cost=&click_id= HTTP/1.1
Host: track.wbdpnz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://uddeve.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-length: 0
location: https://rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
date: Wed, 06 Nov 2024 16:35:31 GMT
server: nginx
cache-control: no-store, no-cache, pre-check=0, post-check=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: 0f72aceb-1686-4bca-a918-ff82f889bf8f-v4=fxC2zKNAdjVxdDCbqPG8rNztTvLB1-ZdQh_ii7yY-Ko; Max-Age=86400; Expires=Thu, 07 Nov 2024 16:35:31 GMT; Domain=track.wbdpnz.com; Path=/; Secure; HttpOnly;SameSite=None
cc-v4=7c4PglG%2BlhhAUlXlLXWlbK7GN1KIC%2FMBmCSUzuScPqShYPnjZSW6LyUn1T6qpND0URT4htmfhwFIDwVvyITaqmEe7N1Lt3U0HwPACSBKFpJA83jDvX%2B99tgaIApgtAvlUHXEopC0kYin7Tq%2FXEtQHg%3D%3D; Max-Age=31536000; Expires=Thu, 06 Nov 2025 16:35:31 GMT; Domain=track.wbdpnz.com; Path=/; Secure; HttpOnly;SameSite=None
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: aGUvN5HDyUbM-KtkkhaWdZqY8oYQPsI-pq4Q8yaSBnDd3lv3pyhKPQ==
X-Firefox-Spdy: h2
GET rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
200 OK 15 kB URL User Request GET HTTP/1.1 rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
IP
Certificate IssuerLet's Encrypt
Subjectrt.betulinherl.shop
Fingerprint68:48:1A:9B:23:76:7A:E4:27:57:FC:A1:7D:31:88:DB:D1:3A:C9:00
ValidityMon, 30 Sep 2024 10:42:24 GMT - Sun, 29 Dec 2024 10:42:23 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (39798)
Hash 94fd8b1b21335e169ee71d93dbb84b83
d172b094d3e4dbe4fbeac38f26a6601685c959b0
fd0a52e75884e37c26237308a41fd39bc5e12894942b1170feaa6685401b24e7
GET /ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635 HTTP/1.1
Host: rt.betulinherl.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://uddeve.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Thu, 07-Nov-2024 16:35:31 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Thu, 07-Nov-2024 16:35:31 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
POST oontenrobe.top/cuid/?f=https%3A%2F%2Frt.betulinherl.shop
200 OK 0 B URL POST HTTP/1.1 oontenrobe.top/cuid/?f=https%3A%2F%2Frt.betulinherl.shop
IP
Requested by https://rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
Certificate IssuerZeroSSL
Subjectoontenrobe.top
FingerprintEA:B6:74:D5:D6:60:CF:B4:D7:B1:5D:CC:08:60:8F:74:A6:10:DD:ED
ValidityThu, 31 Oct 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /cuid/?f=https%3A%2F%2Frt.betulinherl.shop HTTP/1.1
Host: oontenrobe.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://rt.betulinherl.shop/
Origin: https://rt.betulinherl.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:31 GMT
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://rt.betulinherl.shop
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
GET rt.betulinherl.shop/favicon.ico
200 OK 1.4 kB URL GET HTTP/1.1 rt.betulinherl.shop/favicon.ico
IP
Requested by https://rt.betulinherl.shop/ilcePgojeQuFhjNeariDdAp/102305/?md=eyJ0dmMiOjAsImEiOjE3ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6Imh0dHBzOi8vdWRkZXZlLmNvbS8iLCJxIjoiaHR0cHM6Ly9ydC5iZXR1bGluaGVybC5zaG9wL2lmZE1WU0dJV005ZE5IL1dRUUVCP3BhcmFtXzQ9JnBhcmFtXzU9d3AxcWg3bDF0dHM4OG9kNWpxdW5rNjM1IiwiaCI6MzUxNywibCI6ImVuLVVTIiwidCI6MCwieiI6MTkxMCwiayI6NCwidSI6IjY3NWZjMzFkZWUyMzc0NWY3MWUwN2QiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiNG9tZG5ncnN6aWxjNnEwIiwibyI6dHJ1ZSwibSI6MTczMDkxMDkzMTkzNSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoidW5jaGVja2VkIiwidnIiOiJ1bmNoZWNrZWQiLCJhYyI6MTYsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6NjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&pdc=uPwVulxiRnQuf75wayzV*CRKXv3wx6yHLFDDIaf2NR0¶m_4=¶m_5=wp1qh7l1tts88od5jqunk635
Certificate IssuerLet's Encrypt
Subjectrt.betulinherl.shop
Fingerprint68:48:1A:9B:23:76:7A:E4:27:57:FC:A1:7D:31:88:DB:D1:3A:C9:00
ValidityMon, 30 Sep 2024 10:42:24 GMT - Sun, 29 Dec 2024 10:42:23 GMT
File type MS Windows icon resource - 1 icon, 16x16
Hash 011201ab56695ce86ea2f190bce2670b
bb8fad6accf293e619360935047c23f00da3c769
a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
GET /favicon.ico HTTP/1.1
Host: rt.betulinherl.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:31 GMT
Content-Type: application/octet-stream
Content-Length: 1406
Last-Modified: Wed, 06 Nov 2024 14:01:20 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "672b76b0-57e"
Expires: Thu, 07 Nov 2024 16:35:31 GMT
Cache-Control: max-age=86400
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
POST oontenrobe.top/cuid/?f=https%3A%2F%2Frt.betulinherl.shop
200 OK 32 B URL POST HTTP/1.1 oontenrobe.top/cuid/?f=https%3A%2F%2Frt.betulinherl.shop
IP
Requested by https://rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
Certificate IssuerZeroSSL
Subjectoontenrobe.top
FingerprintEA:B6:74:D5:D6:60:CF:B4:D7:B1:5D:CC:08:60:8F:74:A6:10:DD:ED
ValidityThu, 31 Oct 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT
Hash d950633b8b136e928d7acc0304ead982
8d194b2f12dc09477804c8237ab4150c39137dd8
c3cc4761d4c18fee7683c1d2fdaee094d87018ab5d8d65826a4d5642f79f5023
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /cuid/?f=https%3A%2F%2Frt.betulinherl.shop HTTP/1.1
Host: oontenrobe.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rt.betulinherl.shop/
Content-Type: application/json
Content-Length: 10
Origin: https://rt.betulinherl.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:31 GMT
Content-Type: application/json
Content-Length: 32
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://rt.betulinherl.shop
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: a97fa794a0f9=675fc31dee23745f71e07d; expires=Sat, 16 Mar 2052 14:23:47 GMT; domain=oontenrobe.top; path=/; secure; SameSite=None
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
GET rt.betulinherl.shop/ilcePgojeQuFhjNeariDdAp/102305/?md=eyJ0dmMiOjAsImEiOjE3ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6Imh0dHBzOi8vdWRkZXZlLmNvbS8iLCJxIjoiaHR0cHM6Ly9ydC5iZXR1bGluaGVybC5zaG9wL2lmZE1WU0dJV005ZE5IL1dRUUVCP3BhcmFtXzQ9JnBhcmFtXzU9d3AxcWg3bDF0dHM4OG9kNWpxdW5rNjM1IiwiaCI6MzUxNywibCI6ImVuLVVTIiwidCI6MCwieiI6MTkxMCwiayI6NCwidSI6IjY3NWZjMzFkZWUyMzc0NWY3MWUwN2QiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiNG9tZG5ncnN6aWxjNnEwIiwibyI6dHJ1ZSwibSI6MTczMDkxMDkzMTkzNSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoidW5jaGVja2VkIiwidnIiOiJ1bmNoZWNrZWQiLCJhYyI6MTYsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6NjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&pdc=uPwVulxiRnQuf75wayzV*CRKXv3wx6yHLFDDIaf2NR0¶m_4=¶m_5=wp1qh7l1tts88od5jqunk635
200 OK 61 B URL User Request GET HTTP/1.1 rt.betulinherl.shop/ilcePgojeQuFhjNeariDdAp/102305/?md=eyJ0dmMiOjAsImEiOjE3ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6Imh0dHBzOi8vdWRkZXZlLmNvbS8iLCJxIjoiaHR0cHM6Ly9ydC5iZXR1bGluaGVybC5zaG9wL2lmZE1WU0dJV005ZE5IL1dRUUVCP3BhcmFtXzQ9JnBhcmFtXzU9d3AxcWg3bDF0dHM4OG9kNWpxdW5rNjM1IiwiaCI6MzUxNywibCI6ImVuLVVTIiwidCI6MCwieiI6MTkxMCwiayI6NCwidSI6IjY3NWZjMzFkZWUyMzc0NWY3MWUwN2QiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiNG9tZG5ncnN6aWxjNnEwIiwibyI6dHJ1ZSwibSI6MTczMDkxMDkzMTkzNSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoidW5jaGVja2VkIiwidnIiOiJ1bmNoZWNrZWQiLCJhYyI6MTYsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6NjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&pdc=uPwVulxiRnQuf75wayzV*CRKXv3wx6yHLFDDIaf2NR0¶m_4=¶m_5=wp1qh7l1tts88od5jqunk635
IP
Certificate IssuerLet's Encrypt
Subjectrt.betulinherl.shop
Fingerprint68:48:1A:9B:23:76:7A:E4:27:57:FC:A1:7D:31:88:DB:D1:3A:C9:00
ValidityMon, 30 Sep 2024 10:42:24 GMT - Sun, 29 Dec 2024 10:42:23 GMT
File type HTML document, ASCII text, with no line terminators
Hash 86733bb66fb84b851592d733e51f0cbd
42eaf19a5ca195667a9212b0ea3557eee76954a8
927676bdf7f1bdcd71f06cc0d9fa573791b12c905629d806851624687c4b4a0d
GET /ilcePgojeQuFhjNeariDdAp/102305/?md=eyJ0dmMiOjAsImEiOjE3ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6Imh0dHBzOi8vdWRkZXZlLmNvbS8iLCJxIjoiaHR0cHM6Ly9ydC5iZXR1bGluaGVybC5zaG9wL2lmZE1WU0dJV005ZE5IL1dRUUVCP3BhcmFtXzQ9JnBhcmFtXzU9d3AxcWg3bDF0dHM4OG9kNWpxdW5rNjM1IiwiaCI6MzUxNywibCI6ImVuLVVTIiwidCI6MCwieiI6MTkxMCwiayI6NCwidSI6IjY3NWZjMzFkZWUyMzc0NWY3MWUwN2QiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiNG9tZG5ncnN6aWxjNnEwIiwibyI6dHJ1ZSwibSI6MTczMDkxMDkzMTkzNSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoidW5jaGVja2VkIiwidnIiOiJ1bmNoZWNrZWQiLCJhYyI6MTYsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6NjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&pdc=uPwVulxiRnQuf75wayzV*CRKXv3wx6yHLFDDIaf2NR0¶m_4=¶m_5=wp1qh7l1tts88od5jqunk635 HTTP/1.1
Host: rt.betulinherl.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rt.betulinherl.shop/ifdMVSGIWM9dNH/WQQEB?param_4=¶m_5=wp1qh7l1tts88od5jqunk635
Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
GET rt.betulinherl.shop/favicon.ico
200 OK 1.4 kB URL GET HTTP/1.1 rt.betulinherl.shop/favicon.ico
IP
Requested by https://rt.betulinherl.shop/ilcePgojeQuFhjNeariDdAp/102305/?md=eyJ0dmMiOjAsImEiOjE3ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6Imh0dHBzOi8vdWRkZXZlLmNvbS8iLCJxIjoiaHR0cHM6Ly9ydC5iZXR1bGluaGVybC5zaG9wL2lmZE1WU0dJV005ZE5IL1dRUUVCP3BhcmFtXzQ9JnBhcmFtXzU9d3AxcWg3bDF0dHM4OG9kNWpxdW5rNjM1IiwiaCI6MzUxNywibCI6ImVuLVVTIiwidCI6MCwieiI6MTkxMCwiayI6NCwidSI6IjY3NWZjMzFkZWUyMzc0NWY3MWUwN2QiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiNG9tZG5ncnN6aWxjNnEwIiwibyI6dHJ1ZSwibSI6MTczMDkxMDkzMTkzNSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoidW5jaGVja2VkIiwidnIiOiJ1bmNoZWNrZWQiLCJhYyI6MTYsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6NjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&pdc=uPwVulxiRnQuf75wayzV*CRKXv3wx6yHLFDDIaf2NR0¶m_4=¶m_5=wp1qh7l1tts88od5jqunk635
Certificate IssuerLet's Encrypt
Subjectrt.betulinherl.shop
Fingerprint68:48:1A:9B:23:76:7A:E4:27:57:FC:A1:7D:31:88:DB:D1:3A:C9:00
ValidityMon, 30 Sep 2024 10:42:24 GMT - Sun, 29 Dec 2024 10:42:23 GMT
File type MS Windows icon resource - 1 icon, 16x16
Hash 011201ab56695ce86ea2f190bce2670b
bb8fad6accf293e619360935047c23f00da3c769
a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
GET /favicon.ico HTTP/1.1
Host: rt.betulinherl.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rt.betulinherl.shop/ilcePgojeQuFhjNeariDdAp/102305/?md=eyJ0dmMiOjAsImEiOjE3ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6Imh0dHBzOi8vdWRkZXZlLmNvbS8iLCJxIjoiaHR0cHM6Ly9ydC5iZXR1bGluaGVybC5zaG9wL2lmZE1WU0dJV005ZE5IL1dRUUVCP3BhcmFtXzQ9JnBhcmFtXzU9d3AxcWg3bDF0dHM4OG9kNWpxdW5rNjM1IiwiaCI6MzUxNywibCI6ImVuLVVTIiwidCI6MCwieiI6MTkxMCwiayI6NCwidSI6IjY3NWZjMzFkZWUyMzc0NWY3MWUwN2QiLCJmIjpmYWxzZSwid2giOiJub3QgaW4gaWZyYW1lIiwiaWgiOiIxMjgweDEwMjQiLCJlIjoiNG9tZG5ncnN6aWxjNnEwIiwibyI6dHJ1ZSwibSI6MTczMDkxMDkzMTkzNSwidyI6IiU3QiUyMnRpdGxlJTIyJTNBJTIyJTIyJTJDJTIya2V5d29yZHMlMjIlM0ElNUIlNUQlMkMlMjJ0b3B3b3JkcyUyMiUzQSU1QiUyMmFkdmVydGlzZXIlM0ExJTIyJTVEJTdEIiwidHMiOjAsInByIjoxLCJoYyI6NDgsImJsIjotMSwiYmMiOjMsInZ2IjoidW5jaGVja2VkIiwidnIiOiJ1bmNoZWNrZWQiLCJhYyI6MTYsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6NjAsImNlIjp0cnVlLCJjZCI6MjQsIm9yIjoibGFuZHNjYXBlLXByaW1hcnkiLCJmcyI6bnVsbCwiZnNvIjpudWxsfQ&pdc=uPwVulxiRnQuf75wayzV*CRKXv3wx6yHLFDDIaf2NR0¶m_4=¶m_5=wp1qh7l1tts88od5jqunk635
Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 06 Nov 2024 16:35:32 GMT
Content-Type: application/octet-stream
Content-Length: 1406
Last-Modified: Wed, 06 Nov 2024 14:01:20 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "672b76b0-57e"
Expires: Thu, 07 Nov 2024 16:35:32 GMT
Cache-Control: max-age=86400
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
88.208.38.96
143.204.55.67
212.117.184.188