Report - tinyurl.com/5n7xr279??domain=mail.aten.com&user=russia&email=russia@slurpmail.net

Report Overview

Submitted URL
tinyurl.com/5n7xr279??domain=mail.aten.com&user=russia&email=russia@slurpmail.net
IP
172.67.1.225
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-25 21:58:48
Access
public
Website Title
pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Final URL
pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Tags
suspicious
urlquery detections
Suspicious - Anti-debugging code

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ka-f.fontawesome.com	3598	2012-10-18	2019-12-17	2024-04-25	1.7 kB	127 kB	104.21.26.223
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	950 B	15 kB	142.250.74.74
pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev	unknown	unknown	No data	No data	1.1 kB	246 kB	104.18.2.35
encrypted-tbn0.gstatic.com	unknown	2008-02-11	2013-05-31	2024-04-25	1.0 kB	15 kB	142.250.74.142
kit.fontawesome.com	1868	2012-10-18	2019-12-16	2024-04-25	495 B	12 kB	104.18.40.68
tinyurl.com	10084	2002-01-27	2012-05-21	2024-04-24	535 B	220 kB	104.20.138.65

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	kit.fontawesome.com/585b051251.js	12 kB	2023-11-29	2024-05-05
Pretty URL kit.fontawesome.com/585b051251.js IP 104.18.40.68 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-29 01:32:53 Last Seen2024-05-05 10:18:12 Times Seen8705 Hash 55d343a40c7166a79fd314f13cbb2e93 96904a849c32ca220e0aaa2ae3e81cf2b5cdf764 a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a Loading...

	pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net	456 B	2023-09-03	2024-04-25
Pretty URL pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net IP 104.18.2.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-03 08:41:14 Last Seen2024-04-25 23:58:54 Times Seen13 Hash cea427bd9dfd29ad285959a6eb573a95 1770f0ee5f1aa0ba56784de8d25f4598e77f1e9c ad2d2818fe7e9c020a1b5dfbc337ffed576345f6022b72986bd33030824cc25a Loading...

	pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net	382 B	2024-04-25	2024-04-25
Pretty URL pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net IP 104.18.2.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-25 10:30:39 Last Seen2024-04-25 23:58:54 Times Seen2 Hash 937b8795a2469613bb89f0e951d45bbb 0437309e13412ea495a027cc50c6c5182c417bdb a656191c451edd23dd3816a527e3a94287246026fb0fbddac732f8dc29cf4eaa Loading...

	pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net	138 B	2024-04-25	2024-04-25
Pretty URL pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net IP 104.18.2.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-25 10:30:39 Last Seen2024-04-25 23:58:54 Times Seen2 Hash 7fb4cb7080b857e9deca0c0c5f6046a0 818a372ef910f208034a2914e18b34eb934fb094 a016f53dffc120ccc3135e643501d1e55af79a18a3130def2ed3682c26125ad3 Loading...

HTTP Transactions (11)

URL IP Response Size

tinyurl.com/5n7xr279??domain=mail.aten.com&user=russia&email=russia@slurpmail.net

104.20.138.65

301 Moved Permanently

219 kB

URL User Request GET HTTP/2
tinyurl.com/5n7xr279??domain=mail.aten.com&user=russia&email=russia@slurpmail.net
IP
104.20.138.65:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjecttinyurl.com
Fingerprint84:03:D8:A5:59:CC:8A:4A:44:A5:81:7D:68:AA:A0:B7:86:A6:AA:44
ValiditySun, 31 Mar 2024 23:28:39 GMT - Sat, 29 Jun 2024 23:28:38 GMT

File type
HTML document, ASCII text, with very long lines (37265), with CRLF, LF line terminators
Size
219 kB (218816 bytes)
Hash
741419d3f8e4d33ae30090f15be69737
e6f90046d4783af6c95db226f33c1863f2bcc8d3
4c3bc1b09b1b8ae34b7ca1f84be39fc1830858ef09753cb70df185112842bb4c

HTTP Headers

GET /5n7xr279??domain=mail.aten.com&user=russia&email=russia@slurpmail.net HTTP/1.1
Host: tinyurl.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
date: Thu, 25 Apr 2024 21:58:22 GMT
content-type: text/html; charset=UTF-8
location: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
referrer-policy: unsafe-url
x-robots-tag: noindex
x-tinyurl-redirect-type: redirect
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
x-tinyurl-redirect: eyJpdiI6ImxXbU1qVHFjdm9lUzc0ajh4cENEbUE9PSIsInZhbHVlIjoidlBDZ2llekdKZlhqYVc3S2s4Y3N2eXJqY1diM09KZWtVM05iS3B3UWx2K2xMRS9rbHpieTJQeU53SkI2TURlRE1tbFJ2RWxCWGNQb1grMVJSMjVjYlE9PSIsIm1hYyI6IjRiNjJiMjYwYTkzMDc1NzFkODQyN2UwYzFlOTlhNjkzMzIxODc4OThhMjBjZTA0Y2EzZTdkZDYzNTlhOTQ0MjYiLCJ0YWciOiIifQ==
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: MISS
set-cookie: __cf_bm=mOrnA8feOZ.xUNMpec6HnU6KYrSdyG.lSohHCR76uJc-1714082302-1.0.1.1-c49VbvWH7FywIWbzuyE2tByx4rU.7uMlrIcfESyOyL.cLFnzs7fuzLNWgpsVmILfvxgX_ZJzKrLmDllC9kCG.Q; path=/; expires=Thu, 25-Apr-24 22:28:22 GMT; domain=.tinyurl.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 87a19817ec24b503-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2

104.21.26.223

200 OK

78 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
IP
104.21.26.223:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196
Size
78 kB (78168 bytes)
Hash
a9fd1225fb2cd32320e2b931dca01089
44ec5c6a868b4ce62350d9f040ed8e18f7a1d128
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

HTTP Headers

GET /releases/v5.15.4/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 25 Apr 2024 21:58:25 GMT
content-type: font/woff2
content-length: 78168
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:58:24 GMT
etag: "a9fd1225fb2cd32320e2b931dca01089"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 a2b4f68a89fc87406bff22c95fc07fba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: ii0cjzGtwkQYeHMchgmZeVgKGF_OIf1yPW9yDWxDs_mVVFPADYViow==
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oP89WmRTMXqjUj1EYTI%2B0e51L6oHSh0JC0eypu9NpUW4yeGiy5Sh7gNJf9SvuVf5R7TeVyI8zkTiTh2%2BxX%2B2x9AgEJmEeHUg9u0G3FGbMEsUW%2BJmrpRX9%2F9Mquxmy0fr67GPxzWsjg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a19828dba2b515-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

142.250.74.74

200 OK

8.4 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
IP
142.250.74.74:443
ASN
#15169 GOOGLE

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
8.4 kB (8410 bytes)
Hash
88ea620ae6f07886fa51cc129ef7afba
422c049c6a79cfa4a3a071b25a30b398b67ed02b
ea3895d621a7ffed99ae1ce4002b56956491bcb75a1c0fdca4931339958bbcd9

HTTP Headers

GET /css?family=Archivo+Narrow&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 21:58:25 GMT
date: Thu, 25 Apr 2024 21:58:25 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251

104.21.26.223

200 OK

18 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
IP
104.21.26.223:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
ASCII text, with very long lines (60130)
Size
18 kB (18548 bytes)
Hash
a12ec7ebe75a4d59a5dd6b79e2ba2e16
28f5dcc595ee6d4163481ef64170180502c8629b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

HTTP Headers

GET /releases/v5.15.4/css/free.min.css?token=585b051251 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Origin: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 21:58:25 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aa34a836095df9de9d246a53dd63f1d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 5XZNG7WXkQwjpVdZ9Bu2NldxKBkhEv3Z8Y5jWwUpfWlTCQ3JLprClw==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nYl%2B29PCOC%2B5z2dAm7Pu0FmxsggFU%2FMWqz5hRlaqtg59VyyZBAiVLPeoPWl0ZdpQsgWhc1TaWJquM2Qqysz%2FMvc7FVDgJKgVBeBYqYnx0DTTMT0O2vulLvGaAtfE0sx3QRrjistxUA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a19828bb9ab515-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

142.250.74.74

200 OK

5.1 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Archivo+Narrow&display=swap
IP
142.250.74.74:443
ASN
#15169 GOOGLE

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
5.1 kB (5117 bytes)
Hash
01b0876bf6aa3ad895fefb717ae8e07d
c69978bb3b65b4cc033551e2064330e887d28a2e
be7ce6d9475b0af779e01aa4f07de35a3e64fb1427f21d86bd0e1b5d51fe4358

HTTP Headers

GET /css?family=Archivo+Narrow&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 21:58:25 GMT
date: Thu, 25 Apr 2024 21:58:25 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/favicon.ico

104.18.2.35

404 Not Found

27 kB

URL GET HTTP/1.1
pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/favicon.ico
IP
104.18.2.35:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with very long lines (611)
Size
27 kB (27242 bytes)
Hash
df3d48946e8d3f5a83608308edbb4b86
47b9c40c97abf2658df96b1c06109324e15e1a00
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 21:58:25 GMT
Content-Type: text/html
Content-Length: 27242
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87a198296a9e5687-OSL

encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRVWa0KS-gYJCvaW5Lgx15zYZiDHdxDBoTNWH_BeMnU5c46nWDW4x6-fQvgjw&s

142.250.74.142

200 OK

5.7 kB

URL GET HTTP/2
encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRVWa0KS-gYJCvaW5Lgx15zYZiDHdxDBoTNWH_BeMnU5c46nWDW4x6-fQvgjw&s
IP
142.250.74.142:443
ASN
#15169 GOOGLE

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 204x192, components 3
Size
5.7 kB (5655 bytes)
Hash
3f1a30bc572a123cf57e301d782f238f
c25f2d51cb0bfb7c7e7947b2590599581cd5e34e
cc7694bd168ad8b32ddf9eacae3ed9d513959c3fcf8d21fe178e5af524a17575

HTTP Headers

GET /images?q=tbn:ANd9GcRVWa0KS-gYJCvaW5Lgx15zYZiDHdxDBoTNWH_BeMnU5c46nWDW4x6-fQvgjw&s HTTP/1.1
Host: encrypted-tbn0.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-length: 5655
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 08:30:11 GMT
expires: Fri, 25 Apr 2025 08:30:11 GMT
cache-control: public, max-age=31536000
age: 48494
last-modified: Sun, 14 Jan 2024 20:57:09 GMT
content-type: image/jpeg
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net

104.18.2.35

200 OK

218 kB

URL User Request GET HTTP/1.1
pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
IP
104.18.2.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, ASCII text, with very long lines (38267), with CRLF line terminators
Size
218 kB (217814 bytes)
Hash
34caf691d75ee0c4872eeda3d2ee681b
7a640597431af90a38970b7a1a30d8001295cf27
7ab2441b9f484d90e9e5fdb9be38c2fb990cbb582817a13d92fc72a5a6298301

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Anti-debugging code

HTTP Headers

GET /2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net HTTP/1.1
Host: pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 21:58:24 GMT
Content-Type: text/html
Content-Length: 217814
Connection: keep-alive
Accept-Ranges: bytes
ETag: "34caf691d75ee0c4872eeda3d2ee681b"
Last-Modified: Tue, 23 Apr 2024 12:11:21 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87a19819be675687-OSL

kit.fontawesome.com/585b051251.js

104.18.40.68

200 OK

12 kB

URL GET HTTP/2
kit.fontawesome.com/585b051251.js
IP
104.18.40.68:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerDigiCert Inc
Subject*.fontawesome.com
Fingerprint93:F9:69:8C:73:B0:08:60:65:F3:39:41:39:66:D3:2B:78:3A:6E:3D
ValidityMon, 04 Dec 2023 00:00:00 GMT - Fri, 03 Jan 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (11461)
Size
12 kB (11893 bytes)
Hash
55d343a40c7166a79fd314f13cbb2e93
96904a849c32ca220e0aaa2ae3e81cf2b5cdf764
a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a

HTTP Headers

GET /585b051251.js HTTP/1.1
Host: kit.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 21:58:25 GMT
content-type: text/javascript
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, stale-while-revalidate=30
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
x-request-id: F8mkxmaRdg_WGEQCfW6C
cf-cache-status: MISS
server: cloudflare
cf-ray: 87a198270b05b4fa-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251

104.21.26.223

200 OK

27 kB

URL GET HTTP/2
ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
IP
104.21.26.223:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subjectka-f.fontawesome.com
Fingerprint8D:43:33:42:48:C0:F5:34:71:EC:49:69:9C:62:01:4A:6F:41:11:98
ValidityTue, 05 Mar 2024 09:23:28 GMT - Mon, 03 Jun 2024 09:23:27 GMT

File type
ASCII text, with very long lines (26500)
Size
27 kB (26682 bytes)
Hash
76f34b71fc9fb641507ff6a822cc07f5
73ed2f8f21cd40fb496e61306acbb5849d4dbff4
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

HTTP Headers

GET /releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Origin: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 21:58:25 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 0ee5V4Lm_1bRgf6d9kE1Cn8Rac6d_V_zDwdB1xHRi9csxnqP2bB8fQ==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B%2FqRMhJuocHuE1AZ9fTG39ZUcc3h8g4Tg6%2BBemAoqbyoS0IeGZSgBzh0xB4gUAWHX%2BfrqDzip3j8MCGGICx5Am5pj%2FosXDwICjHgPdVKsIY8Ne6L2R5WBQQbvqesigkd73%2FDGu8uxA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a19828cb9bb515-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ0Ic36DMjM-hj8Kj7skh11nPiz4G8ruqNFfg&usqp=CAU

142.250.74.142

200 OK

7.9 kB

URL GET HTTP/2
encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ0Ic36DMjM-hj8Kj7skh11nPiz4G8ruqNFfg&usqp=CAU
IP
142.250.74.142:443
ASN
#15169 GOOGLE

Requested by
https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/2_5474357000.html?domain=mail.aten.com&user=russia&email=russia@slurpmail.net
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
PNG image data, 259 x 194, 8-bit colormap, non-interlaced
Size
7.9 kB (7944 bytes)
Hash
456c75188eac8be4fb026e7d070ad2f2
4b5dbe2a43cc0a9ec4a07e0bad3c337ba49e7eac
f172cd1acb6022b518801ff76a14ee58ceb90f4295fd83b9b445b5653653569c

HTTP Headers

GET /images?q=tbn:ANd9GcQ0Ic36DMjM-hj8Kj7skh11nPiz4G8ruqNFfg&usqp=CAU HTTP/1.1
Host: encrypted-tbn0.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-1fc584a6f8d64bdcbecefa7861d9c525.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-length: 7944
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 08:30:11 GMT
expires: Fri, 25 Apr 2025 08:30:11 GMT
cache-control: public, max-age=31536000
age: 48494
last-modified: Sat, 15 Feb 2020 18:50:09 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash