| www-3659m.com/ |  20.197.90.236 | | 595 B |
IP20.197.90.236:0 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typeHTML document, ASCII text, with very long lines (593), with CRLF line terminators Hashfb01b2c9ad1b0535c13f16ac3cf04936 11a132db0e572faf7a7f11b6f3613c5d7bfd00c7 f7b85354a9db610249f54a192073cfff92a810d349c550ea62d4c5fd44df990c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: www-3659m.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 595
Cache-Control: max-age=10
Connection: close
Server: openresty tg@tenfyBot
|
|
| 20.197.90.236:33886/?u=aHR0cDovL3d3dy0zNjU5bS5jb20v&p=Lw== | 20.197.90.236 | | 236 B |
URL 20.197.90.236:33886/?u=aHR0cDovL3d3dy0zNjU5bS5jb20v&p=Lw== IP20.197.90.236:0 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typeHTML document, ASCII text, with very long lines (318), with CRLF line terminators Hash775a7716de97f7434beea32e1ceb9c6d 67fe43188c8188c7b60258eea2b49cab9d01938c 89567a250921bffdf0972d7250e73811cc0b0618e9ec9035bd201f5bc93fe72c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /?u=aHR0cDovL3d3dy0zNjU5bS5jb20v&p=Lw== HTTP/1.1
Host: 20.197.90.236:33886
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www-3659m.com/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Thu, 25 Apr 2024 16:48:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
|
|
| |  20.239.71.172 | 301 Moved Permanently | 58 B |
URL User Request GET HTTP/1.1IP20.239.71.172:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeHTML document, ASCII text Hashc5608ae41b3b16da715fc3ccb7918f9b 05a6ab5ee62ee7b8466557fb8478d942bc3f4f58 f56a842de94acd8046d6932c5bd760836ee3e1c789540477f319b590cee52de6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 3115vv.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://20.197.90.236:33886/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=utf-8
Location: https://3115vv.cc:8989/
Date: Thu, 25 Apr 2024 16:48:48 GMT
Content-Length: 58
|
|
| | 20.239.71.172 | 301 Moved Permanently | 166 B |
URL User Request GET HTTP/1.1IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash3ea1c8d079b38532a6e01a96216ba5e2 598d3ff91d3e252f1e13df8cf0348b270ff2da3f 87a9323ac85ce28867d5d7ce590c8f29b8d1a999961fca71bb33adef48683691
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://20.197.90.236:33886/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate
Content-Length: 166
Content-Type: text/html
Date: Thu, 25 Apr 2024 16:48:48 GMT
Location: /verify-page/index.html
X-Frame-Options: SAMEORIGIN
|
|
| 3115vv.cc:8989/verify-page/index.html | 20.239.71.172 | 200 OK | 1.9 kB |
URL User Request GET HTTP/1.13115vv.cc:8989/verify-page/index.html IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeHTML document, Unicode text, UTF-8 text Hash9ee338fc4704fef71aae2a38898f0a99 4acbb628f474386e6f6616688b2dbe1f478a7983 088fc0afd875cf577190e7904ab4c7b1ae941038eab14b90f99a4c1917c66084
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/index.html HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://20.197.90.236:33886/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:49 GMT
Etag: W/"646c2fb9-10cc"
Last-Modified: Tue, 23 May 2023 03:15:05 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-1714063729bf0b
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Length: 1928
|
|
| code.jquery.com/ui/1.13.2/themes/base/jquery-ui.css |  151.101.2.137 | 200 OK | 36 kB |
URL GET HTTP/2code.jquery.com/ui/1.13.2/themes/base/jquery-ui.css IP151.101.2.137:443
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File typeASCII text, with very long lines (2363) Hashd933811bd3d6e357ad39601d152ce3ff e097a676f5d9eb96cecc7fbb2b73a9fc8db4b018 c8c2157918c9fed0bb9dcc56c96b52dc7af70b05ca0228e467eaf91777751ad7
GET /ui/1.13.2/themes/base/jquery-ui.css HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: "28feccc0-8d03"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 25 Apr 2024 16:48:49 GMT
age: 6847800
x-served-by: cache-lga21933-LGA, cache-hel1410034-HEL
x-cache: HIT, HIT
x-cache-hits: 990, 2008
x-timer: S1714063730.600912,VS0,VE0
vary: Accept-Encoding
content-length: 36099
X-Firefox-Spdy: h2
|
|
| 3115vv.cc:8989/verify-page/index.css | 20.239.71.172 | 200 OK | 1.4 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/index.css IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
Hash563e1e89cd19ebe1109b4d323aadc1b5 0b54d74d45d37e7dcb164b90306902f1c87a0379 5dfe5c34512cfdca7ec57d05b1c166579edbb3eb0497bc8a2f995a300dff6b38
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/index.css HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/css
Date: Thu, 25 Apr 2024 16:48:49 GMT
Etag: W/"6465b33e-1c2a"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-1714063729aa71
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Length: 1425
|
|
| code.jquery.com/ui/1.13.2/jquery-ui.js | 151.101.2.137 | 200 OK | 529 kB |
URL GET HTTP/2code.jquery.com/ui/1.13.2/jquery-ui.js IP151.101.2.137:443
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (1004) Size529 kB (529159 bytes) Hashcbc65ff85e08b21d7e0c0394fbf3a371 0ebabcd2c6da47bde11fadf331a02c98845b0a8d c4b0fb9e123ad9f72c1192b6feff0bb0171be251bb76050b92e5e85c1fe3f757
GET /ui/1.13.2/jquery-ui.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: "28feccc0-81307"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 25 Apr 2024 16:48:49 GMT
age: 718600
x-served-by: cache-lga21926-LGA, cache-hel1410034-HEL
x-cache: HIT, HIT
x-cache-hits: 221, 22
x-timer: S1714063730.605920,VS0,VE0
vary: Accept-Encoding
content-length: 529159
X-Firefox-Spdy: h2
|
|
| 3115vv.cc:8989/verify-page/jquery-3.6.0.min.js | 20.239.71.172 | 200 OK | 34 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/jquery-3.6.0.min.js IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hashe86504b92c4745b9315d7f4f9b73fc2a b9b4714b5c1cbc03d9444c9f60a17eecb8e0750d 878796facbcbeadeddda79c14175bb3967519b61d1db46ae49a36b5dc84e5dd9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/jquery-3.6.0.min.js HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:49 GMT
Etag: W/"6465b33e-1a4e4"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-1714063729c05e
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/verify-page/layer.js | 20.239.71.172 | 200 OK | 8.1 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/layer.js IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (25644) Hashd0e127ecee9830b69990e59dac9e927c afca21ea76fa29e067f632defe9f5bda74abbcc5 6286d9bc968547cc39d3c6e76f606d7f0ee63affb5b5cb082cadb16cfa349781
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/layer.js HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: W/"6465b33e-6481"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-17140637306f03
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/verify-page/gb.validation.min.css | 20.239.71.172 | 200 OK | 3.8 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/gb.validation.min.css IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeUnicode text, UTF-8 text, with very long lines (2295) Hashc862a8441f3f03ae94d71c7569583b71 4a8e8bcf393d18836bef2d0b46c31362df40e109 abc56da6a27aa3997710f9acb485670e32a6e0dbd72f1b239ff87677be13675f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/gb.validation.min.css HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/css
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: W/"6465b33e-2d42"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-17140637304247
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/verify-page/gb.validation.min.js | 20.239.71.172 | 200 OK | 5.2 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/gb.validation.min.js IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (801) Hash30be40425b37bee4158676082cef1f4d b41ed46721936872d5d7eadf303ce22938240d2a f5ca5f543161a6b37ca2bf26c4f3c630fe08323108c77dac1fba6ce755ce6f47
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/gb.validation.min.js HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: W/"6465b33e-7fd7"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-1714063730ae50
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/verify-page/captcha.js | 20.239.71.172 | 200 OK | 3.0 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/captcha.js IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
Hash78f0e1408a7b795bf6ba44b5e8b19107 41937ca433d78a8b700dd8c897cb39562b3a3073 9cdc699c023ad4e13002d970078b363e0ff74de23ebe13fdb4236f957f17da1a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/captcha.js HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: W/"646c6101-2e4e"
Last-Modified: Tue, 23 May 2023 06:45:21 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-1714063730e3f8
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/verify-page/api.js | 20.239.71.172 | 200 OK | 381 B |
URL GET HTTP/1.13115vv.cc:8989/verify-page/api.js IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
Hashd2cb45273037dbdd95e09eb43ebbe91d 2cae60aa072f0babeef78b85ee03a2854c8fef7f 44c37a1c09792bd8653567437d6dc5a44e20e915307da0a861973fb3721ebdf7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/api.js HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: br
Content-Type: application/javascript; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: "646c36c0-371"
Last-Modified: Tue, 23 May 2023 03:45:04 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-171406373060cf
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Length: 381
|
|
| 3115vv.cc:8989/verify-page/theme/default/layer.css?v=3.1.0 | 20.239.71.172 | 200 OK | 3.1 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/theme/default/layer.css?v=3.1.0 IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
Hash5cf9259b7dd27aacd46161ec23d261cf ba0c399616a5ae9cdd8aec5b76ba4aae4822367c 7f73a66b3a9a38576d124b6243a8984d795028e3493b8fa3f688d8dbe10cbccc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/theme/default/layer.css?v=3.1.0 HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/css
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: W/"6465b33e-48e4"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-17140637301b2b
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/mobile-api/origin/customerService.html | 20.239.71.172 | 200 OK | 251 B |
URL GET HTTP/1.13115vv.cc:8989/mobile-api/origin/customerService.html IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
Hash8bd9d8c5a0abcb3b410d4be89c00fea5 e4d71266a17db71447e0a34ba05a943892feec43 a535566fe4d15caf4158ac47788e7f2b43cd5569d528efb798c3783c1d269d64
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mobile-api/origin/customerService.html HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Content-Type,Access-Token,X-Requested-With
Access-Control-Allow-Methods: *
Access-Control-Max-Age: 3600
Content-Disposition: inline;filename=f.txt
Content-Encoding: br
Content-Type: text/html;charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
Out-Line: gb-cdn-806
Set-Cookie: route=66776b881a59021b52807ef9298664ac; Path=/
Sub-Sys: mobile
Uuid: 00141-01-00000000-171406373042d9
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Length: 251
|
|
| 3115vv.cc:8989/mobile-api/v5/captcha/initWithoutSwitch.html | 20.239.71.172 | 200 OK | 38 kB |
URL POST HTTP/1.13115vv.cc:8989/mobile-api/v5/captcha/initWithoutSwitch.html IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
Hash024117e719c91fb3eea58f8873967ca1 45a5a24635ae90e2d959977a8bfbfb85ea206381 00e66a4f31468972a122d85d7987ee619ecac367b170334cff55523f195bb4b2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /mobile-api/v5/captcha/initWithoutSwitch.html HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 79
Origin: https://3115vv.cc:8989
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Content-Type,Access-Token,X-Requested-With
Access-Control-Allow-Methods: *
Access-Control-Allow-Origin: https://3115vv.cc:8989
Access-Control-Max-Age: 3600
Content-Disposition: inline;filename=f.txt
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
Out-Line: gb-cdn-806
Set-Cookie: route=61ee84c9f68236309da705261df10e5a; Path=/
Sub-Sys: mobile
Uuid: 00141-01-00000000-17140637303d19
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
|
|
| 3115vv.cc:8989/favicon.ico | 20.239.71.172 | 404 Not Found | 150 B |
URL GET HTTP/1.13115vv.cc:8989/favicon.ico IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash597ba0d4396e9c906225140ce907092c 28ae2ba65ccdb583d79f85b8cc9509fae697493b ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.html
Cookie: route=61ee84c9f68236309da705261df10e5a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Length: 150
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Apr 2024 16:48:50 GMT
X-Frame-Options: SAMEORIGIN
|
|
| 3115vv.cc:8989/verify-page/theme/default/icon.png | 20.239.71.172 | 200 OK | 12 kB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/theme/default/icon.png IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typePNG image data, 210 x 61, 8-bit/color RGBA, non-interlaced Hash551539f873d9ebe0792b120a9867d399 fe47ec617507e9ce5f6ce7ac9b179a3c9231882b 99942159547fc45a02ddeb5af9570b6c870b18c36f83fd53ccb7c0644d346c89
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/theme/default/icon.png HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/theme/default/layer.css?v=3.1.0
Cookie: route=61ee84c9f68236309da705261df10e5a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 11493
Content-Type: image/png
Date: Thu, 25 Apr 2024 16:48:51 GMT
Etag: "6465b33e-2ce5"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-17140637314a37
X-Frame-Options: SAMEORIGIN
|
|
| 3115vv.cc:8989/verify-page/theme/default/bg1.jpg | 20.239.71.172 | 200 OK | 2.7 MB |
URL GET HTTP/1.13115vv.cc:8989/verify-page/theme/default/bg1.jpg IP20.239.71.172:8989 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerLet's Encrypt Subject3115vv.cc FingerprintB0:8C:08:C1:96:DA:3E:B6:79:53:54:64:18:60:B9:32:8A:CB:C7:42 ValiditySun, 03 Mar 2024 02:24:52 GMT - Sat, 01 Jun 2024 02:24:51 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 5472x2976, components 3 Size2.7 MB (2722653 bytes) Hasha8c42a8705bfac721b57b48b45f910f7 4c331f3ac4a1f0a71b85a918cc5020bb0ee6b7cc 66afb131d4a4bf1818ea567083956e4956e280b748187871fc15f3435eef80c6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /verify-page/theme/default/bg1.jpg HTTP/1.1
Host: 3115vv.cc:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/verify-page/index.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 2722653
Content-Type: image/jpeg
Date: Thu, 25 Apr 2024 16:48:50 GMT
Etag: "6465b33e-298b5d"
Last-Modified: Thu, 18 May 2023 05:10:22 GMT
Out-Line: gb-cdn-806
Uuid: 00141-01-00000000-17140637308164
X-Frame-Options: SAMEORIGIN
|
|
| use.fontawesome.com/releases/v5.0.10/js/all.js |  104.21.27.152 | 200 OK | 700 kB |
URL GET HTTP/2use.fontawesome.com/releases/v5.0.10/js/all.js IP104.21.27.152:443
Requested byhttps://3115vv.cc:8989/verify-page/index.html CertificateIssuerCloudflare, Inc. Subjectuse.fontawesome.com FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78 ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65355) Size700 kB (700147 bytes) Hashd179b64ca38524da0d5cd0ea1e9051df fee145dabca02c109d7aecd0e279c5b373f2f0ac 9b9030ab4c0619108eec0b4df769a185d1adf93242ef4853a2eeffb79335d566
GET /releases/v5.0.10/js/all.js HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://3115vv.cc:8989
DNT: 1
Connection: keep-alive
Referer: https://3115vv.cc:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 25 Apr 2024 16:48:49 GMT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31556926
etag: W/"d179b64ca38524da0d5cd0ea1e9051df"
last-modified: Fri, 22 Sep 2023 01:44:05 GMT
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 38507
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t0RaFDtV8kuOyjrHJdxmuUEeUdtuJoJ%2BOy4XtBVBkiH%2BPvJ56cVhMbJULEya2bQEoIi%2BTDOddTU9ejfWNOMe08XlqFbmC645lx9bthCAzRVbh2LKi%2BbD5GdcIc%2Bf5T77YWuYto6%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879fd2a54b90712d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|