Report - poppy73.culturainaturarejhen.life/TUFyNLpTu4sCTFRla29lbm5lbEBrMmNvbnN1bHRpbmcuY29tXXBvbGxvcwECAyZzMz1td3o

Report Overview

Submitted URL
poppy73.culturainaturarejhen.life/TUFyNLpTu4sCTFRla29lbm5lbEBrMmNvbnN1bHRpbmcuY29tXXBvbGxvcwECAyZzMz1td3o
IP
172.67.166.174
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-08 21:21:55
Access
public
Website Title
Rub my back
Final URL
girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
girlsnear4ycouf2.click	unknown	2023-12-22	2023-12-22	2024-03-17	4.4 kB	405 kB	172.67.213.226
svntrk.com	105291	2018-04-18	2018-04-27	2024-05-01	420 B	109 kB	104.21.82.62
pornhub.com	4903	2000-10-31	2012-05-22	2024-05-07	416 B	201 B	66.254.114.41
www.xvideos.com	11464	1997-12-30	2012-05-21	2024-02-12	422 B	17 kB	185.88.181.2
www.pornhub.com	10781	2000-10-31	2012-05-21	2024-05-08	850 B	83 kB	66.254.114.41
o.pki.goog	unknown	2016-06-13	2024-04-24	2024-05-07	650 B	1.4 kB	216.58.211.3
accounts.google.com	81	1997-09-15	2016-03-20	2024-05-07	488 B	1.9 kB	64.233.164.84

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	svntrk.com/assets/ser1_663becdb1dbe3.js	0 B	2023-03-07	2024-05-20
Pretty URL svntrk.com/assets/ser1_663becdb1dbe3.js IP 104.21.82.62 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 00:22:38 Times Seen37847217 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	girlsnear4ycouf2.click/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js	40 kB	2023-04-05	2024-05-19
Pretty URL girlsnear4ycouf2.click/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 13:38:28 Last Seen2024-05-19 21:11:55 Times Seen2861 Hash 1d8ad98fe3471d1a74d485f9b4737bfc a1190f7bb41660f682d59e15c2606279da0792f7 9aa12d141f3c41629c83ac95bf3bebab2b33bca7f8f8988bf64b53b57c73714c Loading...

	girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D	0 B	2023-03-07	2024-05-20
Pretty URL girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 00:22:38 Times Seen37847217 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	girlsnear4ycouf2.click/landings/64/js/vendor.c646da3c88b8155a753aeef51880893f.js	94 kB	2023-04-28	2024-05-19
Pretty URL girlsnear4ycouf2.click/landings/64/js/vendor.c646da3c88b8155a753aeef51880893f.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-28 18:18:59 Last Seen2024-05-19 21:11:55 Times Seen1068 Hash 94f50ecc482c512d032b592127573281 343f7ec692078fc1d28a55eb7c9204db7efd5ea2 a58da45b28f71ef9815097a0eee0d846978d8ec34b8648edf35dd51711e78c62 Loading...

	girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D	0 B	2023-03-07	2024-05-20
Pretty URL girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 00:22:38 Times Seen37847217 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (12)

URL IP Response Size

girlsnear4ycouf2.click/favicon.ico

172.67.213.226

0 B

URL
girlsnear4ycouf2.click/favicon.ico
IP
172.67.213.226:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D
Cookie: XSRF-TOKEN=eyJpdiI6ImgwYTY5bEE2aWo4aFNvOEdrMDhMa3c9PSIsInZhbHVlIjoiWG05SFF1N1lCYmpYZVdaRFk0VlJGQms2OWdxK0VJVUlVVFA0Yk9meTNwNmZHb3lmV0pOdjYwRFBiWHNxVG1SQSIsIm1hYyI6ImI3NTNkNDViZmZmY2Y2OTM3YTU3M2Y5MjQ4YjYyY2RhNTAyN2ZmYTFjNTk1MGViYTdkYTE1YTdmNTUyYWRmODkifQ%3D%3D; laravel_session=eyJpdiI6IlpjdEZ6cmJzMUJxaDFsdXh2Y3YxNVE9PSIsInZhbHVlIjoiSTNkRlZhV0ZVM2VzM0lkTzJvNkhsalVySmJkZkhoR1pWUS84SUpOVGJpV1ZkVGdkb29jRi94aHJCVEthS0hOTSIsIm1hYyI6ImI1YjkwNjIwZWE5YWE2MWUwMDE3YjkzYzBkMDA1OTM2MmZmNWNmMjc0NGRkY2NkYTEyZGYwN2YyMmIxNjE2YjAifQ%3D%3D; SRVNAME=w1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:21:32 GMT
content-type: image/x-icon
content-length: 0
last-modified: Tue, 09 Apr 2024 11:05:59 GMT
etag: "66152117-0"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1066
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JyBzVPgk6r%2FZJ1X0754A60LW1KVNmQSofIfhJBih1nI%2Foqyz%2BVFMGKQMWqsiKc9qTn%2B1aJL8duGLsMmU3JIgL1EsKYv9cP3g4wJlfgZtYxg8FuE75DccFOoS%2BznFHDygX%2BPLeZT4stVq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c8000c8aeb511-OSL
alt-svc: h3=":443"; ma=86400

svntrk.com/assets/ser1_663becdb1dbe3.js

104.21.82.62

109 kB

URL
svntrk.com/assets/ser1_663becdb1dbe3.js
IP
104.21.82.62:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
109 kB (108588 bytes)
Hash
1234c579e87a34e88210cca829751a0d
40654328e69d126f8865cfe5eae10f539e58c6bd
f84a0ad432895dd0b6ebffe35c500be4964e772d9bdd8dd5048093b4f4f4e7ea

HTTP Headers

GET /assets/ser1_663becdb1dbe3.js HTTP/1.1
Host: svntrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 08 May 2024 21:21:31 GMT
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: BYPASS
set-cookie: svnimp=663becdb8ccb6; path=/; secure; httponly; samesite=none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fs8oOVgAyLFFRcQ1X2Bz0XWLCdnYq2AicY%2BeizGyPOzQYBihc5e8iLvUaRSfR7rZM44kV%2FCLFZsVqO1jE3%2FjPSSfVAQteYqxwUj6pNTgsqPkWgRz2yrM7mlHYs92"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c7ffaeefe0b06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

girlsnear4ycouf2.click/landings/64/fonts/Montserrat-Bold.ttf

172.67.213.226

198 kB

URL
girlsnear4ycouf2.click/landings/64/fonts/Montserrat-Bold.ttf
IP
172.67.213.226:0
ASN
#13335 CLOUDFLARENET

File type
TrueType Font data, 16 tables, 1st "GDEF", 18 names, Microsoft, language 0x409, Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)Montserr
Size
198 kB (198072 bytes)
Hash
1f023b349af1d79a72740f4cc881a310
04052dc3b846609216de1e0cbcec337c6b6e74f6
189aeb285be99f0b58e454dd2dc3cbf34a6db844a9ef26ebc5909178ff77c5be

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/64/fonts/Montserrat-Bold.ttf HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/landings/64/fonts/vendor.b294a8fe11965d4b08a1705c05b0e360.css
Cookie: XSRF-TOKEN=eyJpdiI6ImgwYTY5bEE2aWo4aFNvOEdrMDhMa3c9PSIsInZhbHVlIjoiWG05SFF1N1lCYmpYZVdaRFk0VlJGQms2OWdxK0VJVUlVVFA0Yk9meTNwNmZHb3lmV0pOdjYwRFBiWHNxVG1SQSIsIm1hYyI6ImI3NTNkNDViZmZmY2Y2OTM3YTU3M2Y5MjQ4YjYyY2RhNTAyN2ZmYTFjNTk1MGViYTdkYTE1YTdmNTUyYWRmODkifQ%3D%3D; laravel_session=eyJpdiI6IlpjdEZ6cmJzMUJxaDFsdXh2Y3YxNVE9PSIsInZhbHVlIjoiSTNkRlZhV0ZVM2VzM0lkTzJvNkhsalVySmJkZkhoR1pWUS84SUpOVGJpV1ZkVGdkb29jRi94aHJCVEthS0hOTSIsIm1hYyI6ImI1YjkwNjIwZWE5YWE2MWUwMDE3YjkzYzBkMDA1OTM2MmZmNWNmMjc0NGRkY2NkYTEyZGYwN2YyMmIxNjE2YjAifQ%3D%3D; SRVNAME=w1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:21:32 GMT
content-type: application/octet-stream
content-length: 198072
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-305b8"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NHiGK%2BsfUhyLJ%2FKNZeLXyfdy7j7URO3DCMwW1enZTo2wQt4x1mfRKOPVl3TEuav%2Bd5yD509HHANGrlvoDNSokBuigS%2Bmt1M84khsFHts66zh3SXDAhwgn5LfDhCaVmb2YBw5cd7v9Dkr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c7ffeedcdb511-OSL
alt-svc: h3=":443"; ma=86400

girlsnear4ycouf2.click/landings/64/fonts/Montserrat-Regular.ttf

172.67.213.226

198 kB

URL
girlsnear4ycouf2.click/landings/64/fonts/Montserrat-Regular.ttf
IP
172.67.213.226:0
ASN
#13335 CLOUDFLARENET

File type
TrueType Font data, 16 tables, 1st "GDEF", 18 names, Microsoft, language 0x409, Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)Montserr
Size
198 kB (197976 bytes)
Hash
3fe868a1a9930b59d94d2c1d79461e3c
de57aa03e4821fdbe6c34ec2c895e8b5c914e837
dcfe8df29e553fbd655212f94300cb1e704c6cd147fa7a98cb4bcd9eb92c6707

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/64/fonts/Montserrat-Regular.ttf HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/landings/64/fonts/vendor.b294a8fe11965d4b08a1705c05b0e360.css
Cookie: XSRF-TOKEN=eyJpdiI6ImgwYTY5bEE2aWo4aFNvOEdrMDhMa3c9PSIsInZhbHVlIjoiWG05SFF1N1lCYmpYZVdaRFk0VlJGQms2OWdxK0VJVUlVVFA0Yk9meTNwNmZHb3lmV0pOdjYwRFBiWHNxVG1SQSIsIm1hYyI6ImI3NTNkNDViZmZmY2Y2OTM3YTU3M2Y5MjQ4YjYyY2RhNTAyN2ZmYTFjNTk1MGViYTdkYTE1YTdmNTUyYWRmODkifQ%3D%3D; laravel_session=eyJpdiI6IlpjdEZ6cmJzMUJxaDFsdXh2Y3YxNVE9PSIsInZhbHVlIjoiSTNkRlZhV0ZVM2VzM0lkTzJvNkhsalVySmJkZkhoR1pWUS84SUpOVGJpV1ZkVGdkb29jRi94aHJCVEthS0hOTSIsIm1hYyI6ImI1YjkwNjIwZWE5YWE2MWUwMDE3YjkzYzBkMDA1OTM2MmZmNWNmMjc0NGRkY2NkYTEyZGYwN2YyMmIxNjE2YjAifQ%3D%3D; SRVNAME=w1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:21:32 GMT
content-type: application/octet-stream
content-length: 197976
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-30558"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20znPhJruXmuESTUXuXPYY3fXTVZJXzPLLXY5vem%2Fn2ri0Je9MCYtjaR79AL8yBAGyM8LzrT2brdrIeM18w1seOEKnvyhkaqhNhsfOTW9R61CFiLvFCS87PFetsv6DXBPlyGPqpqhnN2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c7ffeedd0b511-OSL
alt-svc: h3=":443"; ma=86400

pornhub.com/video/manage?o=mr&t=pr2

66.254.114.41

0 B

URL
pornhub.com/video/manage?o=mr&t=pr2
IP
66.254.114.41:0
ASN
#29789 REFLECTED

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /video/manage?o=mr&t=pr2 HTTP/1.1
Host: pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-length: 0
location: https://www.pornhub.com/video/manage?o=mr&t=pr2
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

www.xvideos.com/favorite/90902157/mk_1123

185.88.181.2

15 kB

URL
www.xvideos.com/favorite/90902157/mk_1123
IP
185.88.181.2:0
ASN
#46652 SERVERSTACK-ASN

File type
data
Size
15 kB (14648 bytes)
Hash
f1701b7f96cddaec7ec1d4066d7815c5
c9bdddc49861c95787263e3eeac34b3f2977bad2
a9baa32a0446fa7a36c87ee7c902834e6a887fa436f129e27e1e3cd68dfe4ecc

HTTP Headers

GET /favorite/90902157/mk_1123 HTTP/1.1
Host: www.xvideos.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 21:21:32 GMT
P3p: policyref="/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Accept-Ch: Viewport-Width, Width, Device-Memory, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness
Vary: Accept-Encoding,User-Agent,Accept-Language,Cookie
X-Frame-Options: SAMEORIGIN
Report-To: {"group": "csp-endpoint", "max_age": 10886400, "endpoints": [ { "url": "https://www.xvideos.com/csp-reports" } ] }
Content-Security-Policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com 1868565294.rsc.cdn77.org static.cloudflareinsights.com www.google.com www.gstatic.com fonts.gstatic.com fonts.googleapis.com ajax.googleapis.com fcm.googleapis.com accounts.google.com *.cdn77.org  *.nk-img.com  *.segpay.com  *.online-metrix.net *.vscdns.com *.vsmvideo.com www.tjk-njk.com *.orbsrv.com *.opoxv.com *.exdynsrv.com *.afcdn.net *.aucdn.net *.tf4srv.com *.aacdn.net *.adglare.net www.flirt4free.com www.ohmybutt.com www.secretpartners.com *.asf4f.us *.livejasmin.com *.jsmcrptjmp.com *.awemwh.com etahub.com ctrack.trafficjunky.net tracking.sexcash.com *.gtflixtv.com wss://*.1ka.com https://*.1ka.com https://media.1ka.com https://u.1ka.com https://n.1ka.com;img-src 'self' 'unsafe-inline' data: blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com *.cdn77.org www.google.com www.google-analytics.com ssl.gstatic.com *.nk-img.com *.camster.com data-cdn.pornbiz.com *.vscdns.com *.vsmvideo.com *.doubleclick.net *.google.fr *.google.com *.segpay.com *.online-metrix.net cdn.asf4f.us *.gtflixtv.com *.1ka.com *.orbsrv.com *.exdynsrv.com *.afcdn.net *.aucdn.net *.justservingfiles.net *.tf4srv.com *.aacdn.net *.rtbsuperhub.com; report-uri https://www.xvideos.com/csp-reports; report-to csp-endpoint
Referrer-Policy: no-referrer-when-downgrade
X-Robots-Tag: noindex
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Server: nginx

www.pornhub.com/login

66.254.114.41

79 kB

URL
www.pornhub.com/login
IP
66.254.114.41:0
ASN
#29789 REFLECTED

File type
gzip compressed data, max speed, from Unix
Size
79 kB (78934 bytes)
Hash
91a869bc58961e47d5da7dfaf5c98bf2
0495e43dd513b24f590ea17e22b064cf4dd22fd4
c094727f38f2a36def336c3a53d586289c6d919a7fa1fe017a37d544662a0b5a

HTTP Headers

GET /login HTTP/1.1
Host: www.pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://girlsnear4ycouf2.click/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Wed, 08 May 2024 21:21:33 GMT
content-type: text/html; charset=UTF-8
set-cookie: platform=pc; expires=Wed, 15-May-2024 21:21:33 GMT; Max-Age=604800; path=/; domain=pornhub.com; secure
ss=766328284102969300; expires=Thu, 08-May-2025 21:21:33 GMT; Max-Age=31536000; path=/; domain=pornhub.com; secure
fg_0d2ec4cbd943df07ec161982a603817e=97823.100000; expires=Fri, 07-Jun-2024 21:21:33 GMT; Max-Age=2592000; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=663BECDC-42FE722901BB3CE278-1AA9CAC3; Secure; Samesite=None
__l=663BECDC-42FE722901BB3CE278-1AA9CAC3; Secure; Samesite=None; Max-Age=31556926
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
content-encoding: gzip
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

o.pki.goog/wr2

216.58.211.3

471 B

URL
o.pki.goog/wr2
IP
216.58.211.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f276d15245c6ec1add5b5814bb8444eb
975c127eec9cc6514f4092ed034df575bcdeacd7
a77526d25e2226cff93318a2e87ab8d03eac1796e44fd997c5428693ddb61bd0

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 May 2024 21:21:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en

64.233.164.84

0 B

URL
accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en
IP
64.233.164.84:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:kDkJNwQbtdrBT-56TPeLRGlhHhNKFg:EBFDd-uKClKFp4dL; Expires=Fri, 08-May-2026 21:21:33 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 08 May 2024 21:21:33 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQxH246YRsyQvXToPAyg9ZS62wabAwHNfwbVxthx3HzeIhWzUimWZJot0rKglei0uniw84HSiA
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-DXOCSWtbivdfZIyDzr5d6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: unsafe-none
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.pornhub.com/video/manage?o=mr&t=pr2

66.254.114.41

441 B

URL
www.pornhub.com/video/manage?o=mr&t=pr2
IP
66.254.114.41:0
ASN
#29789 REFLECTED

File type
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Size
441 B (441 bytes)
Hash
882bb93f684a4ed75dc8aa90fc715cd7
affb0cce6317576ce849fa33e3235fe50637035c
e561cd1cae544150826bd03cded49165a4d5873d8fe2befe6ad419f594b7e458

HTTP Headers

GET /video/manage?o=mr&t=pr2 HTTP/1.1
Host: www.pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://girlsnear4ycouf2.click/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
server: openresty
date: Wed, 08 May 2024 21:21:32 GMT
content-type: text/html; charset=UTF-8
set-cookie: platform=pc; expires=Wed, 15-May-2024 21:21:32 GMT; Max-Age=604800; path=/; domain=pornhub.com; secure
ss=592043609736670591; expires=Thu, 08-May-2025 21:21:32 GMT; Max-Age=31536000; path=/; domain=pornhub.com; secure
fg_0d2ec4cbd943df07ec161982a603817e=26631.100000; expires=Fri, 07-Jun-2024 21:21:32 GMT; Max-Age=2592000; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=663BECDC-42FE722901BB3CE278-1AA9C8F3; Secure; Samesite=None
__l=663BECDC-42FE722901BB3CE278-1AA9C8F3; Secure; Samesite=None; Max-Age=31556926
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
ph-redirect: 1041
location: /login
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

o.pki.goog/wr2

216.58.211.3

471 B

URL
o.pki.goog/wr2
IP
216.58.211.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
295c1ab534489dc31c4940823ae306a6
f64846d666665600e9b3191323707b0312ea2103
f71d58c2003e0da135fb8f57ef576b17eebe7916ced184c7bf99f603049eaddb

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 May 2024 21:21:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

girlsnear4ycouf2.click/landings/64/fonts/vendor.b294a8fe11965d4b08a1705c05b0e360.css

172.67.213.226

6.6 kB

URL
girlsnear4ycouf2.click/landings/64/fonts/vendor.b294a8fe11965d4b08a1705c05b0e360.css
IP
172.67.213.226:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (10074)
Size
6.6 kB (6584 bytes)
Hash
306f4c99a088a54ab79e2c0460eddcfc
ab9e1f94377575275adf9f3fb38504bd73790ac8
cc5e158191e1c24d896f794b3233d45add46709a3e1157f6a0ee260c83cc8c6e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/64/fonts/vendor.b294a8fe11965d4b08a1705c05b0e360.css HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/?s1=ser1&i_W=ZWtvZW5uZWxAazJjb25zdWx0aW5nLmNvbQ%3D%3D
Cookie: XSRF-TOKEN=eyJpdiI6ImgwYTY5bEE2aWo4aFNvOEdrMDhMa3c9PSIsInZhbHVlIjoiWG05SFF1N1lCYmpYZVdaRFk0VlJGQms2OWdxK0VJVUlVVFA0Yk9meTNwNmZHb3lmV0pOdjYwRFBiWHNxVG1SQSIsIm1hYyI6ImI3NTNkNDViZmZmY2Y2OTM3YTU3M2Y5MjQ4YjYyY2RhNTAyN2ZmYTFjNTk1MGViYTdkYTE1YTdmNTUyYWRmODkifQ%3D%3D; laravel_session=eyJpdiI6IlpjdEZ6cmJzMUJxaDFsdXh2Y3YxNVE9PSIsInZhbHVlIjoiSTNkRlZhV0ZVM2VzM0lkTzJvNkhsalVySmJkZkhoR1pWUS84SUpOVGJpV1ZkVGdkb29jRi94aHJCVEthS0hOTSIsIm1hYyI6ImI1YjkwNjIwZWE5YWE2MWUwMDE3YjkzYzBkMDA1OTM2MmZmNWNmMjc0NGRkY2NkYTEyZGYwN2YyMmIxNjE2YjAifQ%3D%3D; SRVNAME=w1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:21:31 GMT
content-type: text/css
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: W/"6615211a-275b"
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IH%2FA8Z3EoYDgN2GRECq8za3MpViUOr%2F0%2B4wZeNV6gS8iH9F3r8lOaJyg6flsrhTOYiuBK6VW3eXo1IM7GXvV%2F5kAbN8smp%2FYmrQXkqOjyLeF%2FrNiGakXvjwUH%2Bn1nhUy66cW1NsvB5aT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c7ffadf09b511-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (12)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN