Report - immediate-urex.org/

Report Overview

Visited public
2025-02-27 03:36:20
Tags
URL
immediate-urex.org/
Finishing URL
immediate-urex.org/
IP / ASN
104.21.58.191
#13335 CLOUDFLARENET
Title
Immediate Ursa ™ | The Official & Updated Website 2025 🥇

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
immediate-urex.org	unknown	2024-01-15	2024-01-15	2024-09-23	21 kB	684 kB	104.21.58.191
fonts.gstatic.com	unknown	2008-02-11	2014-04-02	2025-02-26	1.6 kB	26 kB	142.250.178.67
fonts.googleapis.com	8877	2005-01-25	2012-05-23	2025-02-26	477 B	4.9 kB	142.250.74.10

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed
2025-02-27	medium	immediate-urex.org	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	unknown	EventHandler	19 B	2023-07-02	2025-05-09
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-07-02 07:28 Last Seen2025-05-09 14:37 Times Seen206 Hash d340024e4734e72c0555fc2a541e74a1 995e53f4089e42f677947a6f48e5ff2a25ed9ab0 8a04e32acd55cec723824bb94592371f3dc9ab66e579560075bd3c8e54efb9a6 Loading...

	immediate-urex.org/	ScriptElement	518 B	2023-11-27	2025-05-09
Pretty URL immediate-urex.org/ IP 104.21.58.191 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-27 07:36 Last Seen2025-05-09 14:37 Times Seen128 Hash ebc7f5f82eaf0d72fc8a26fbc8000373 2a827a815d3d5fa9d3238c9159f4f4af9e0a7e02 e5ce9dfe4654166829bf24d8ea5907448883be3ed668ed8b3a85bc7f316edd2d Loading...

	immediate-urex.org/	ScriptElement	559 B	2023-08-05	2025-05-09
Pretty URL immediate-urex.org/ IP 104.21.58.191 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-08-05 11:28 Last Seen2025-05-09 14:37 Times Seen129 Hash af1b93af1acd7d0445a034f1189db7fa 6da3e6a232c589bba587ca70ff28b52650d26276 49246c311e933296183985354f49e4df6af3ce50733b57928200d6c22510b5f0 Loading...

	immediate-urex.org/static/assets/app-6256b172.js	ScriptElement	17 kB	2023-08-05	2025-05-09
Pretty URL immediate-urex.org/static/assets/app-6256b172.js IP 104.21.58.191 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-05 11:28 Last Seen2025-05-09 14:37 Times Seen121 Hash 3e2d482771a47ba9b3a2bce1db19e0d2 3509e9194d4a793ffd94a62ff64826a7591d35b9 b1dc3a468eb8949e17762628c68205ee4ffad52ec1cdbe48e3456bf96c1c9603 Loading...

	immediate-urex.org/form.js	ScriptElement	280 kB	2023-11-27	2025-05-09
Pretty URL immediate-urex.org/form.js IP 104.21.58.191 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-27 07:36 Last Seen2025-05-09 14:37 Times Seen129 Hash 57222cd559e3a912092239fcdb6706de d65d9e06d224a9a7e22916dc04eae83d1f26d6c7 81a17cfaf5731292df919a903727b86550d2a57e1ad29893dc693ef9c2013113 Loading...

HTTP Transactions (48)

URL IP Response Size

immediate-urex.org/flags/ar.png

104.21.58.191

200 OK

1.5 kB

URL GET HTTP/3
immediate-urex.org/flags/ar.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.5 kB (1480 bytes)
Hash
7fec8a94e0af73b8647803e1ff9887be
aca14e7523e0bff0a9399a0998b49387d636da9e
f093a618390e4ef10ee984262dd3334074536f565eb0ecf6cbd0939597073b3d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/ar.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 1480
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-5c8"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jgrnv66lDSpwqvtFQMPsOm8ExK1Vd%2BCG%2FXGLdcnFHWg0%2FN%2Bo3qwyDvCqFdulghGT4z72c0Fk4sVtN85HH%2BV4S%2Bib1%2B%2BQzXGnLhhqKRG3sb6T1SDZpOOGg4hdpMi2HogZQpxcamg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208389890b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3841&min_rtt=595&rtt_var=2500&sent=38&recv=41&lost=0&retrans=0&sent_bytes=4819&recv_bytes=11420&delivery_rate=77&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=493&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/lt.png

104.21.58.191

200 OK

560 B

URL GET HTTP/3
immediate-urex.org/flags/lt.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
560 B (560 bytes)
Hash
a07934e15a82eaa9d991f14b8738a6c2
7cab59a83cf48a81e775a194bf74ab60d7348541
2a58af20a8b362e09b7face70ed010abc065f364a89a0bc839fa1fab162d1ed4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/lt.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 560
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-230"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4gQuNuaRm%2BOv6e6C8iL1l7yjKo9mhf8H5aXYa30AtTMj08cobOyI7zMDdVujiAR9oB0%2BknsMN1Y97HeVwA7C6nH8K1CBCqWMVdNqRHNJQGRjAN%2BsHWzAljWI3i3a5f2mzc8AtGc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083999e0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3841&min_rtt=595&rtt_var=2500&sent=40&recv=41&lost=0&retrans=0&sent_bytes=7104&recv_bytes=11420&delivery_rate=77&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=493&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/

104.21.58.191

200 OK

15 kB

URL User Request GET HTTP/2
immediate-urex.org/
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (2794)
Size
15 kB (15294 bytes)
Hash
05967fa965cdcf3c9e2b88d621a82b61
9587fd216bb31e94b6d5ac4f7516f43cf556cfef
cf190a191c0ef3570a703a41bf3dae3ee085191480ad8e7c9450dc7b7ab79751

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 27 Feb 2025 03:35:48 GMT
content-type: text/html
last-modified: Fri, 10 Jan 2025 17:01:06 GMT
set-cookie: lang_fx=;Path=/;Max-Age=2592000
x-geoip: NO
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qcxBkUahV%2BOK5LsjT57gtlmgeW2hNW%2FhGx57wD%2FMyoPp2%2BBfIdIEEcNpg5c4DxM%2Fmf3FQEJ9hzSw%2BAnaHuKu8fPnjqh8KVlrkmnBDujm8Wx8po8IlPbresiUkXKJ2lFHSYhxQvg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 918520802e651c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5719&min_rtt=487&rtt_var=10487&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3218&recv_bytes=1127&delivery_rate=7276381&cwnd=254&unsent_bytes=0&cid=9e8b64a800897ea9&ts=195&x=0"
X-Firefox-Spdy: h2

immediate-urex.org/flags/zh-TW.png

104.21.58.191

200 OK

870 B

URL GET HTTP/3
immediate-urex.org/flags/zh-TW.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
870 B (870 bytes)
Hash
2a2b643bc15c7363c9e58e6b47d7de30
506ab44f76022397b3aa9682e8972d7944703d54
c63293f5412adc096b8e492e88b8d8edfca5367a491acdd9071ef8d31b4ba9a1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/zh-TW.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 870
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-366"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S0HNc%2BLSuUzHquJGy7X0RpSn2zPZCNtVeUZDD60sc7WHsxb%2FXaNLOZpcJq65SH5OtfhX8lHw7LmXrjVa2EuavLyBH8mKeIsgqAlK9bfPAhm5yDscLORccDmSR9j1O7hfHQyWGzk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083898a0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3841&min_rtt=595&rtt_var=2500&sent=45&recv=41&lost=0&retrans=0&sent_bytes=10979&recv_bytes=11420&delivery_rate=77&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=495&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/sk.png

104.21.58.191

200 OK

942 B

URL GET HTTP/3
immediate-urex.org/flags/sk.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
942 B (942 bytes)
Hash
f505130ed0303fde84806046537f1af0
2571608ca84fa979a602373536380578ed7f3e53
f264c92b7384498c50a373a441de7963aa8d20225884b59affadbb0e04de2a70

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/sk.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 942
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-3ae"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=idDFonswdmSFEyTGwiaDSSZxpJCb89ZwxT1YjP86CnxifF4iUXfBTJCWkVEa3ijvKhxcpnmnb%2FVdscrwZTFv6uAcDwDswR31Ktqgvq8uoOeqpIP7An0ut%2F5bv6VMAfzQordFeoM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a60b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3841&min_rtt=595&rtt_var=2500&sent=47&recv=41&lost=0&retrans=0&sent_bytes=12610&recv_bytes=11420&delivery_rate=77&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=495&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/es.png

104.21.58.191

200 OK

873 B

URL GET HTTP/3
immediate-urex.org/flags/es.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
873 B (873 bytes)
Hash
8bf31a924501d6db655fe75696b5f046
94ba0f8d4db0c35c1246a55fcbd6e0ef3cd7f0e2
5ae9561f31199bf8a892f797a69db1bc5d477e2f8318f2b7e95487f025f66f28

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/es.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 873
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-369"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMvwSbJGQ1B894IGkBxBNi8qBwhioHWBC1VBNpNtiZGxX1BlPXNCkLuqsmm5prjY9Z1RYlkgK27yzAXXlntXqq4I394wRgCJoYRMk95aZNCAIjgxKBvtMzFu25qqbQWQixMVMa4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a90b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3841&min_rtt=595&rtt_var=2500&sent=49&recv=41&lost=0&retrans=0&sent_bytes=14312&recv_bytes=11420&delivery_rate=77&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=495&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/fr.png

104.21.58.191

200 OK

637 B

URL GET HTTP/3
immediate-urex.org/flags/fr.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
637 B (637 bytes)
Hash
930f08c6829077e96cf25d58f26bd6d3
0dfa244548435053bbebd2ed5914e2785f0f3dc3
594f333e3a8fe65a0466e4f9c140dab97e6b6a073579edf130a87b86614d7ec8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/fr.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 637
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-27d"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lHBPA938G5DtSgg0E5BZ0ZLqWBkIwZqd%2BYH48hbI%2FNhl2GBbRSWlvwzX0B%2FFIm03EOVpB6hFjdmAk7zxd087BGcYNU3KUP%2F4VqPmZbselEjD741vKJsOqnZYiKgWLlrXsRthyfw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399950b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=51&recv=42&lost=0&retrans=0&sent_bytes=15947&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=497&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/el.png

104.21.58.191

200 OK

775 B

URL GET HTTP/3
immediate-urex.org/flags/el.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
775 B (775 bytes)
Hash
2a53590607a148f0533ed4748d8aa209
bac5251024524bb9f5c39535cb99be24d10c92f7
aa9fcea0dd91bdb0749763eff1466b252e00096d762946f1eb6f5330834d9161

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/el.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 775
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-307"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dyq3XY%2B%2BPHD7wI3bSV%2B2EEZjSMxmwtcme%2Faw3CNLfsG9rdmx6xrEtL4ubHE0lPazC0wgvF6SKL0j0WMMjHgeESby%2FCztQhVHyt%2BEcaJcTLRb1FJLi3w4bELlhPIm3UmeuoLpuww%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399960b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=53&recv=42&lost=0&retrans=0&sent_bytes=17352&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=497&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/pl.png

104.21.58.191

200 OK

380 B

URL GET HTTP/3
immediate-urex.org/flags/pl.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
380 B (380 bytes)
Hash
44c8193715ca274b0074f1bb80c9e597
e0ad2c0c5ba99953d42dfafde03b81289e180168
3cd67729cd6ce09de1e48b04d1246a349597239241989e61356b99b588c0d90f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/pl.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 380
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-17c"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BCJ59ZsBjRELHMjsPAhobbEX1jn18iy3robvmljriJBgFbw6ymGKq%2F6TEr0zXCx9dY5qf2VjFLQ%2FljmNzUzosBmnkLAp%2BWR50MIsjMKaNRr0R01VGRHxsTkBiT%2BXK0fP553GO5I%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a10b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=55&recv=42&lost=0&retrans=0&sent_bytes=18896&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=498&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/cs.png

104.21.58.191

200 OK

849 B

URL GET HTTP/3
immediate-urex.org/flags/cs.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
849 B (849 bytes)
Hash
4be819ea527d8a704539f3ce154c6a82
882f02dee6104dfcda844e466b4ae8dd1e3f69c5
2db01ff2e46696a2a9ffa5d4f5af6f2e95bef36e12aa0eb7e05045e73c0396ad

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/cs.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 849
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-351"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vmhkbFxQgIywYtTk8jpZ1ScoOTbntCFYSqSu9wUgLFVnLgHudDwjO%2BOneYAVDxyTm1KZ1SppjOUaod%2F5c7baHlC2txc8dypYWiQnaOqGrUIn5MTdmaN9V%2BPV8BSle4dqu%2B7NM6A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083898d0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=517&x=1", cfExtPri, cfHdrFlush;dur=1

immediate-urex.org/flags/da.png

104.21.58.191

200 OK

595 B

URL GET HTTP/3
immediate-urex.org/flags/da.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
595 B (595 bytes)
Hash
a30b08094003e6cfa25800109f955b7a
4d43a76c0889bd20f88905cf6ad76b4e0ccd8597
a981b9c5114a52486766b43af45545d454234f8d99cb405f24382b225394f117

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/da.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 595
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-253"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eXm3jpOFizOnvUShchrXPrcn6UD58I9Z8DbPhqqXvJPSkIcfX0Zz%2F6p0UsVBT%2B7PZ%2Fbx94CHm8j6R9iOGcWMx%2BDoUdm2OzaSLIJZzZ684uVuFg%2Fc81nDfG314DPoV02MVVZXtcM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083898e0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=505&x=1", cfExtPri, cfHdrFlush;dur=13

immediate-urex.org/flags/nl.png

104.21.58.191

200 OK

469 B

URL GET HTTP/3
immediate-urex.org/flags/nl.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
469 B (469 bytes)
Hash
213b7e930b8a41dcf4c9f95ac76dbe6b
eccf14152b6ba26fe8a7d02f79586992be40db20
5d75fea10bb270c341503bda4357e90bb069e3e46c7a670a3583f924f3524bd3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/nl.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 469
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-1d5"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yOV3C3ThfvQUNWfyEnuU91b17ZTnf6BMdpn5w6dA%2BUrDx8gQo3t%2BookTZe7wYrK3UTEqCGVXt7HcSQFzc0QILoyvH66sQZ6PXBJq9JwUzjxM9%2BlAUqhXcBmEACvmADd%2BS2gvy9Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399900b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=501&x=1", cfExtPri, cfHdrFlush;dur=17

immediate-urex.org/flags/et.png

104.21.58.191

200 OK

522 B

URL GET HTTP/3
immediate-urex.org/flags/et.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
522 B (522 bytes)
Hash
3dc9c2f215da1556d324e0f48ca7f0a4
3576caa6334d061fc86b4f3140968a989e07e189
9d6e5b81b5b11a75fe5f89ca592837df3070467960556e6f0aa27d561c6c9a96

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/et.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 522
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-20a"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DQizaIvYqlYkcyUsLcTSGv4LOBG%2F8j7UpYlV1YCAU4TDzhYDSe%2Bd91FKIuRmpfrMRhou%2F9q0zBTNxdn395Fv%2BTab95RVXRHy2udyviyTJ27GXGeHep2vbQ7H9P%2BDf8BEeoA0qu4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399920b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=508&x=1", cfExtPri, cfHdrFlush;dur=10

immediate-urex.org/flags/fi.png

104.21.58.191

200 OK

523 B

URL GET HTTP/3
immediate-urex.org/flags/fi.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
523 B (523 bytes)
Hash
605699c0baa63458c609512fc19363c8
b920ed840cba7fa302d5e6eca3b51a7c64095f64
5bf3510eaa1ec9cb53c13393d67ab23ced2c1912bcc614828707ce0bcec20119

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/fi.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 523
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-20b"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IG%2BASPLAqvmDLAM4r0alnkKGJVmb3L7xg2o6Jx3CnkJVxx%2B60YLlMlCpgAjzGhGPfKkmoyODmncwJ%2Bbed%2Fvh0zm7oYpapn9y8gBD0XZqqQWuCEBMKFUWtg7GA03dekDC01i0SrM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399930b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=503&x=1", cfExtPri, cfHdrFlush;dur=15

immediate-urex.org/flags/hi.png

104.21.58.191

200 OK

701 B

URL GET HTTP/3
immediate-urex.org/flags/hi.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
701 B (701 bytes)
Hash
79777c74b380b937c38b2eab06975935
ac6ae14f67313ad088c273c33768cdf592560ebc
cf916648517414e341d51a40821bfb3be8a487aa1c024c2d488d1bc2ee17fdef

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/hi.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 701
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-2bd"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jI9%2BacJq2aon12T1RGNOwYmUul3Y2SCOG83YbumePpLRJO7DJhs1Kwzh9W%2Fniw3bYFH5yBkFRfktfvSda7ee4GfQFOm2XSaKOMFa8pUDyrp9WAdEtUnyKW7QpK5OycRdfFLvIHM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399970b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=502&x=1", cfExtPri, cfHdrFlush;dur=16

immediate-urex.org/flags/hu.png

104.21.58.191

200 OK

505 B

URL GET HTTP/3
immediate-urex.org/flags/hu.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
505 B (505 bytes)
Hash
c789a334c212492af26b433c5e2b4d5b
7bc986549c06acb5f13c177af6793be159f7c480
e911743b60f76ab09482b0abdc256e58e9abcd693c8a382547180d18f0eef14a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/hu.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 505
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-1f9"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YQClyTtGst9pdFnTaWcz36DcOClm85uCmELm%2Fkq69bpzjI2ZBT%2FAWCmTuxG8hqTNqSb6cpe6kDWQMxF6vyhRuXIwjwYFEPTvJHqdzcAWMYP3VszGmiivPJuVC7u2NRu7RGPWDtI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208399980b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=504&x=1", cfExtPri, cfHdrFlush;dur=16

immediate-urex.org/media/2200/conversions/45_41_45__662a16b1ecbfc_immediate-ursa.webp

104.21.58.191

200 OK

2.3 kB

URL GET HTTP/3
immediate-urex.org/media/2200/conversions/45_41_45__662a16b1ecbfc_immediate-ursa.webp
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
RIFF (little-endian) data, Web/P image
Size
2.3 kB (2270 bytes)
Hash
7ecc85225e2d2a4966cff3d44b890042
2c657e6d427a19fd28dab618f266a76247dc8834
d7d2a201fcf62dd42541742c2726e6eb652aac677ab7938adb15838241ef2c62

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/2200/conversions/45_41_45__662a16b1ecbfc_immediate-ursa.webp HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/webp
content-length: 2270
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-8de"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HbcKY3VXz%2FlhZpGR1HFi40OsoA31OJbcjIhvhwgOFQHM4oM6kto701gGyl7GfVZKXVtXYFXnJkWw18BbzI47PTb9eTozvqp6OdvD78UffxJNz9DjZOS4ZhpdiHf5Kq7dN1CSUwM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208389860b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5989&min_rtt=595&rtt_var=6165&sent=76&recv=44&lost=0&retrans=0&sent_bytes=35616&recv_bytes=11552&delivery_rate=88017&cwnd=15600&unsent_bytes=0&cid=1a433235f7583d47&ts=523&x=1", cfExtPri, cfHdrFlush;dur=4

immediate-urex.org/flags/hr.png

104.21.58.191

200 OK

982 B

URL GET HTTP/3
immediate-urex.org/flags/hr.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
982 B (982 bytes)
Hash
41a7b90f600ed32eefb5e620a4f653fc
7a6ab7cfc55a1239de75e073430c9634d5c18746
63e36970eea32e52849d7b4d3a15d1da36be12ad3078df8c2b848aa7e9baa19b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/hr.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 982
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-3d6"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2F9%2FzYf0fyGgtiOaF3j7PcmIbWdqfitHSvqXbUmSIcEFfWwRtf64Lip9Cbpq1sa1DP6Rao%2BOBW7blp8T1g4vGsKXyqIjM3W3JztDERuMiF0j9usKIEQeeQSZgBQAbSMCCQ4%2F0EM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083898b0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5989&min_rtt=595&rtt_var=6165&sent=76&recv=44&lost=0&retrans=0&sent_bytes=35616&recv_bytes=11552&delivery_rate=88017&cwnd=15600&unsent_bytes=0&cid=1a433235f7583d47&ts=525&x=1", cfExtPri, cfHdrFlush;dur=2

immediate-urex.org/flags/de.png

104.21.58.191

200 OK

602 B

URL GET HTTP/3
immediate-urex.org/flags/de.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
602 B (602 bytes)
Hash
8a2ba86f3b7de7562445967e2c21843b
3046cd0b51721f180c2dc75513fd4bfd316b45b5
cc318f3be9ba75def2af54bd9d0fab4f3e316517de9bf138e40dee06d332602d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/de.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 602
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-25a"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CHHoFZd6b9hQx7h6SU8BzHg%2FBXty38lG8Hxoej6IFkEs%2BOeGS%2BOglTCVGl%2BNh8t%2Fs41gu7yCfCkzBchYfHcWPVRieZ2TlhJJJ3Gi6mut6%2FJ6SMgTrRReZJ4c9ScD1kDQ9aged%2Fw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083998f0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5989&min_rtt=595&rtt_var=6165&sent=71&recv=44&lost=0&retrans=0&sent_bytes=32725&recv_bytes=11552&delivery_rate=88017&cwnd=15600&unsent_bytes=0&cid=1a433235f7583d47&ts=521&x=1", cfExtPri, cfHdrFlush;dur=6

immediate-urex.org/flags/it.png

104.21.58.191

200 OK

642 B

URL GET HTTP/3
immediate-urex.org/flags/it.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
642 B (642 bytes)
Hash
922efc02f080135a63137dde4ffea287
a4583be3e579a69a03a0d1f09995fdb6d1244f7d
510116996dc4979a225c07962d84bb76e2b6340234c2c5e4280596ad08a632cb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/it.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 642
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-282"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xSXqKzsNDEJIR4hnccorJ7L%2BUkOlnNYqxLbByLMGCLdUSl3QeMAzx4uGyTawv50pHOmfZX%2FxOtBpq7thAvKUr7PJ3QV%2Bxvo2PYRR1dPR7Gt8MQPPY40XyQbT%2FgV4UdJe5zoH5yk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083999b0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=503&x=1", cfExtPri, cfHdrFlush;dur=17

immediate-urex.org/flags/ja.png

104.21.58.191

200 OK

705 B

URL GET HTTP/3
immediate-urex.org/flags/ja.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
705 B (705 bytes)
Hash
125d3bb3275409f964ec5023de1762c9
f06d834f76897f2e8417a70b59b47419ad668ace
4461385ad6fdaab33bd89e593c3fe1c14021644444d779584ddaec3cd4fe91f4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/ja.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 705
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-2c1"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cfeqXwT1cQinMA6Mdxf9OGO38tontjBUI7CvjbUs%2BoLdRcBvOhiuCGs17kS3m7pWNSUM9EAZfsDM%2BZ6ibFP2eN%2FzpE5Oa2%2BW0FFu17zAYIQxzk5bhmz0goenOwXjYB9%2FDdOVui4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083999c0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=502&x=1", cfExtPri, cfHdrFlush;dur=25

immediate-urex.org/flags/ko.png

104.21.58.191

200 OK

1.4 kB

URL GET HTTP/3
immediate-urex.org/flags/ko.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1361 bytes)
Hash
ed87e4c8a4dd16c9c3f8499a0aaa28bd
f818a0782047c159ed8e5cd041ad7f09e8fe52fb
eb59eb7dcf155a7b38c8f4c9db869ed942bf55a4457e3f4ff0791be4f2c736d5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/ko.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 1361
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-551"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ecIHvuqtUpP2oUkkeVC3ZNB9MkQmQnlU9ztkHu71wgS1KGUi51ufROT1asazJVkJIb8KZUTOx6TZmopf3PyGf7jqPTJHmgLOHni4e4d370SiuKoY1lwFR1MT93c6ufhQ1u7Tvyc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083999d0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=509&x=1", cfExtPri, cfHdrFlush;dur=18

immediate-urex.org/flags/ms.png

104.21.58.191

200 OK

1.0 kB

URL GET HTTP/3
immediate-urex.org/flags/ms.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.0 kB (1043 bytes)
Hash
3570bf54c536dcbd24f7ea9ddb7c2f41
806758cc4afa15db5c70cc5330031a267d497237
ed7928914d2ed92a77f00113d2e4811bd6e43180d03f3ec47e584fdb730a11fb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/ms.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 1043
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-413"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oCAzFN4lBLxHArQik%2FTVDAuNtZyK3OZi3sHGYfynnb3YRzGrEVCM2%2BXnNcP%2FVkEcquiN8OBErMDEm8suQI6tCHFJYlCuApoxuDTpJuXFuYay4B42lX0IJDEYHa5EGTRY1FVS%2FfU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a99f0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5989&min_rtt=595&rtt_var=6165&sent=76&recv=44&lost=0&retrans=0&sent_bytes=35616&recv_bytes=11552&delivery_rate=88017&cwnd=15600&unsent_bytes=0&cid=1a433235f7583d47&ts=527&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/no.png

104.21.58.191

200 OK

743 B

URL GET HTTP/3
immediate-urex.org/flags/no.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
743 B (743 bytes)
Hash
d3b58f803a9a01a59210dd673998a229
6caddb6c8e749e9c5b786a3984bb7bdbba2bafc5
3cf52e677d7f7be201cbf6e3ec56ed1f48b95c47e5969ef2c2510e270133c4f0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/no.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 743
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-2e7"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KifkClV3eocbvrSsKxBmKyNbTLSU%2FfbI3yWqM%2BGIo0ZAZdaF0Gg%2FUU8kW%2FutUy7oUnOOZ%2FGDHPV2QbVyBXGTlSlwHkbxM4q068p5wJ2yBn5pIUVg1Jjl3txLw05xQex35uk1pBM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a00b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=516&x=1", cfExtPri, cfHdrFlush;dur=11

immediate-urex.org/flags/pt.png

104.21.58.191

200 OK

1.1 kB

URL GET HTTP/3
immediate-urex.org/flags/pt.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.1 kB (1076 bytes)
Hash
bb3cb490b63a8f51283c686b916cf4ff
f325c9d27acb1d3e03a3481eb2c240368ae8460f
f06d3def1549dd1b0a108ddc645d2e8906fb631e5812df19cdcbd887f3700bd8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/pt.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 1076
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-434"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CUcg9jtNrany0JIagZMhFZQeE%2FMh2udoolKQGBDt8oUWvpL2yGV5agq7PzgtQxLdXMvPv1fvcylYPQMEZFT1kJ6Z529asmkq4EunR86T%2FD9lM%2F57XjuV9OwEl8Vn4krHZCHlxKg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a20b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=504&x=1", cfExtPri, cfHdrFlush;dur=23

immediate-urex.org/flags/ru.png

104.21.58.191

200 OK

487 B

URL GET HTTP/3
immediate-urex.org/flags/ru.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
487 B (487 bytes)
Hash
5ddf50d1327e2ecc28a980e93b9f538a
581fa9ecc609a1a07fca205b6c9751e8c28f1ebb
1bdc7040f02e999a17f291b59767d4101adefa2d89775272ac7c66f37c710fff

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/ru.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 487
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-1e7"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=osEtehrw2MmHQBIb7FYLlYjxZx6lnJXhDPQMB6FoVyBm9NzFn2F1q4j0OcZOSm27%2BI37Dh9R4%2BVSE8PzhHRxbVCBh14PEXkjwcwMrQ4ac1PGgkmsKAL3QnwT33n6npxYsTZe9Lw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a30b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=510&x=1", cfExtPri, cfHdrFlush;dur=17

immediate-urex.org/flags/sr.png

104.21.58.191

200 OK

1.0 kB

URL GET HTTP/3
immediate-urex.org/flags/sr.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.0 kB (1009 bytes)
Hash
0c5055eb6380dc316b78186e47738aca
6130e54d0a11874109a7b9be82fa15e8e2d93fc7
724fd2c83f9ca340c60f394c06dd5987b771f57f237e8b5f33e156b0b4c9fd79

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/sr.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 1009
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-3f1"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L8IJRFvB2wlzasnkVRT4UQiSqacy8S8oAgVnq8tlolXeUj5PUkSrfknuRssvZnYgtmcqAOCJdF8AlR2jNrcseGtCqSdmSkSJXgrb1MZOx4DgM%2FF1RVvx3WAldX6ybbVWGYQtzCw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a50b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=517&x=1", cfExtPri, cfHdrFlush;dur=10

immediate-urex.org/flags/sl.png

104.21.58.191

200 OK

730 B

URL GET HTTP/3
immediate-urex.org/flags/sl.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
730 B (730 bytes)
Hash
b578df2953e85fcf5d265ed486a6fe61
975e2ec9592cba08ce67a8d5296b78b77e4c28d7
bc8eca69c4ee13e933dbbc783c5bb22a10cb1dd70db91e987c77adf19e4ff9f8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/sl.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 730
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-2da"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=emORu74tlyBdsPO%2FI7zEr7lLrbJ0NRAgm6MleVyPuXSiX0SYjsqL8YW8TIN1XBaK8lqFjiTspEUZpbrInGRvbllAqM%2FCvfyntHpyWISbiJB%2BNQApPWTEh8Do8nl9Kjt%2B7UIQoWY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9a70b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=499&x=1", cfExtPri, cfHdrFlush;dur=28

immediate-urex.org/flags/th.png

104.21.58.191

200 OK

524 B

URL GET HTTP/3
immediate-urex.org/flags/th.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
524 B (524 bytes)
Hash
1c7933a528550f950ffb12cdde1c74c2
3098d40b7cafe07f1c6579f2ed6ffcc9fb65745a
f6e31ccc4d7a997049f3331ccf9b0e987d84f72620deee4359628f72f5aa6dac

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/th.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 524
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-20c"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y253fhTXpOEl0r8cQFt2TdlVKiSHx5LIUn%2FEPkKWQG1MiBpsEK1pI0T80piTyG8G5WeE7l90fPEjPkkC8lx2X7pspmqb6CO29nuVL1zs5Q7tjU2yk9sbZK1h55wcUkKGHd33Ca8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9ac0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3547&min_rtt=595&rtt_var=2463&sent=56&recv=42&lost=0&retrans=0&sent_bytes=20016&recv_bytes=11464&delivery_rate=27713&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=509&x=1", cfExtPri, cfHdrFlush;dur=18

immediate-urex.org/flags/tr.png

104.21.58.191

200 OK

923 B

URL GET HTTP/3
immediate-urex.org/flags/tr.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
923 B (923 bytes)
Hash
f9619dd9adc7fbb5244483ca00cace60
4970f612a0e86100cf07629da3b9ea12af8891e5
d11d2b8956d975cff1ea2a49763f6eec736506498be297be7ac1c4363cc95ee5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/tr.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 923
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-39b"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xOMqX27976bb5BjsbBqdC99RNnenTAoX7dyr72iwmdPZ2w9aJvMWWgWNil763%2FiSQRLe1q0OBZ%2B5KocyBPruEZeMitHR7IbjHaLa69Oi%2FcRmQ%2FSQYOSVuWCaWYe1bG6esKgtPR0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9ad0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3757&min_rtt=595&rtt_var=2268&sent=67&recv=43&lost=0&retrans=0&sent_bytes=27947&recv_bytes=11508&delivery_rate=85546&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=519&x=1", cfExtPri, cfHdrFlush;dur=8

immediate-urex.org/flags/uk.png

104.21.58.191

200 OK

574 B

URL GET HTTP/3
immediate-urex.org/flags/uk.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
574 B (574 bytes)
Hash
e2b587a3b15e34cb226afa3e572af279
192d98c5d5d5b34123e8717c38b6733d8f7e5648
4ec4c568d064866640e472adfb0b9f0f11162a94f179ea925f7b50cfe60fc470

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/uk.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 574
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-23e"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UNHujbtPMLE8RNbVizxyal7%2F%2Fi%2F4S5NbuwffMDznCqGFSC1Gb%2FLmNdepi1NKPxook42MR77wpOTgsLpGxfGdtWw%2BxS2uYYR1vLLrKEYU9grsPyXZJPZid%2Fok1C%2FhN7wueBhHxTo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083b9b10b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5989&min_rtt=595&rtt_var=6165&sent=76&recv=44&lost=0&retrans=0&sent_bytes=35616&recv_bytes=11552&delivery_rate=88017&cwnd=15600&unsent_bytes=0&cid=1a433235f7583d47&ts=523&x=1", cfExtPri, cfHdrFlush;dur=4

immediate-urex.org/flags/sv.png

104.21.58.191

200 OK

715 B

URL GET HTTP/3
immediate-urex.org/flags/sv.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
715 B (715 bytes)
Hash
191c145f7eb3f4755cc9a019a42259ad
3ab0abaf3d362e2f59284949f3f62779af5dbedd
c6897e837702d73a8dad3043ec690277cecff9ef960555169cba79d4fa9c62a3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/sv.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 715
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-2cb"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J5QTZQVPvhiDTy4FY7cesB8eqluc%2BAlk9DtEBWgFwuZ%2BvmN9VmDsaaW6Af%2FVz2l6wL4E7vZHxVwgwJcviXqaeFGIJpqK5oWCqvKBcpiLqvEEkpWPe8fPCWNYh8oBdqp5dy51Sho%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083a9aa0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5867&min_rtt=595&rtt_var=4868&sent=113&recv=45&lost=0&retrans=0&sent_bytes=66816&recv_bytes=11598&delivery_rate=737047&cwnd=31200&unsent_bytes=0&cid=1a433235f7583d47&ts=537&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/flags/vi.png

104.21.58.191

200 OK

818 B

URL GET HTTP/3
immediate-urex.org/flags/vi.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
818 B (818 bytes)
Hash
931fa5c7d5aa2805b11fbc974b816d77
8eb02f52bbe074b5dd681b95c6196890e49651fa
06fc7512126a48e27890c8ac939d5821da05cc0b08d4d11698b2d95b32c3ab66

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/vi.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 818
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-332"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yhISWorihWbdJ7QSukiCdT4I0B%2BEyKEds%2F2dXQLryhmfeft3pvC%2Ban1pTmAHo9KLTO2ZP%2BT8POdfQe8NfS4%2B20m8PuISgNFzt6RzVTM3GAs%2BsBDbytsxKzoPhcNXGkZe0Ftq8gA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852083b9b20b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5867&min_rtt=595&rtt_var=4868&sent=111&recv=45&lost=0&retrans=0&sent_bytes=65504&recv_bytes=11598&delivery_rate=737047&cwnd=31200&unsent_bytes=0&cid=1a433235f7583d47&ts=529&x=1", cfExtPri, cfHdrFlush;dur=0

fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2

142.250.178.67

200 OK

7.9 kB

URL GET HTTP/2
fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2
IP
142.250.178.67:443
ASN
#15169 GOOGLE

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
FingerprintE1:4C:7D:BD:65:DC:FC:CD:59:FD:40:F4:A9:EE:C2:BA:91:98:B2:3D
ValidityMon, 03 Feb 2025 08:37:09 GMT - Mon, 28 Apr 2025 08:37:08 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7884, version 1.0
Size
7.9 kB (7884 bytes)
Hash
9212f6f9860f9fc6c69b02fedf6db8c3
ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

HTTP Headers

GET /s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://immediate-urex.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7884
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Feb 2025 18:15:57 GMT
expires: Fri, 20 Feb 2026 18:15:57 GMT
cache-control: public, max-age=31536000
age: 551992
last-modified: Wed, 04 Dec 2024 06:53:08 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

142.250.178.67

200 OK

7.8 kB

URL GET HTTP/2
fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
IP
142.250.178.67:443
ASN
#15169 GOOGLE

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
FingerprintE1:4C:7D:BD:65:DC:FC:CD:59:FD:40:F4:A9:EE:C2:BA:91:98:B2:3D
ValidityMon, 03 Feb 2025 08:37:09 GMT - Mon, 28 Apr 2025 08:37:08 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7816, version 1.0
Size
7.8 kB (7816 bytes)
Hash
25b0e113ca7cce3770d542736db26368
cb726212d5d525021752a1d8470a0fb593e0c49e
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

HTTP Headers

GET /s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://immediate-urex.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7816
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Feb 2025 18:16:17 GMT
expires: Fri, 20 Feb 2026 18:16:17 GMT
cache-control: public, max-age=31536000
age: 551972
last-modified: Wed, 04 Dec 2024 06:53:03 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2

142.250.178.67

200 OK

7.8 kB

URL GET HTTP/2
fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
IP
142.250.178.67:443
ASN
#15169 GOOGLE

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
FingerprintE1:4C:7D:BD:65:DC:FC:CD:59:FD:40:F4:A9:EE:C2:BA:91:98:B2:3D
ValidityMon, 03 Feb 2025 08:37:09 GMT - Mon, 28 Apr 2025 08:37:08 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7840, version 1.0
Size
7.8 kB (7840 bytes)
Hash
8d91ec1ca2d8b56640a47117e313a3e9
a9e9bafe64666f4595051a0e895b47a5fa39e67e
78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb

HTTP Headers

GET /s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://immediate-urex.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7840
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Feb 2025 17:59:56 GMT
expires: Fri, 20 Feb 2026 17:59:56 GMT
cache-control: public, max-age=31536000
age: 552953
last-modified: Wed, 04 Dec 2024 06:53:49 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

immediate-urex.org/media/1478/conversions/484_1450__1450_65e70568bf024_bg-phone-last.webp

104.21.58.191

200 OK

28 kB

URL GET HTTP/3
immediate-urex.org/media/1478/conversions/484_1450__1450_65e70568bf024_bg-phone-last.webp
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
RIFF (little-endian) data, Web/P image
Size
28 kB (27600 bytes)
Hash
99d96e95dbc72ea762436699708bd7db
b9b452031a3ee54fa61c3d1cbef31b62b3bc141e
77689de6cd8433108f9b8267ffbf0ab7c18a3fe915c6122ed281809d86721699

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/1478/conversions/484_1450__1450_65e70568bf024_bg-phone-last.webp HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/webp
content-length: 27600
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-6bd0"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
accept-ranges: bytes
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FFtfXmzUMhyu3maukkVnAhN%2Bc6Xu9sEPgoBI0BIrBpnMX5OAzlOpeLlLfhW8Uvb%2FdvR%2Fiyq6S%2F5A6QofZ72KlPsipHqNV3s9IItroKA%2FngJQ1XQ5CzsyRLxohG1t88R1RTNbLGQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852086ba8a0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1591&min_rtt=460&rtt_var=1779&sent=277&recv=88&lost=0&retrans=1&sent_bytes=188618&recv_bytes=14685&delivery_rate=21732&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=1021&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/media/1457/conversions/1280_1920__1920_65e6ebcdbed52_banner-digits.webp

104.21.58.191

200 OK

52 kB

URL GET HTTP/3
immediate-urex.org/media/1457/conversions/1280_1920__1920_65e6ebcdbed52_banner-digits.webp
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
RIFF (little-endian) data, Web/P image
Size
52 kB (52548 bytes)
Hash
c98afd8c475b991fbe975c2f4f9bedde
adb9b3cddca25a3b35598bad7af536b9dec9e57a
4e324a236a44498b2916d8f15f80935c8863b694f91195c4fb32c8675cdb7e4a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/1457/conversions/1280_1920__1920_65e6ebcdbed52_banner-digits.webp HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/webp
content-length: 52548
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-cd44"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HlAaqfdJxU5w5Kxgw2zVoxQHom53PfBNJe1wa%2FZgPcSXEHcL%2BApiZHR4it5FkzHd4akJqPkqhg%2Fi72jEyavdkXl3joPnLFfdlclpXktkY2MRFFpRgNOmjl9Rylj6nETddLusOHc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852086ba890b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1425&min_rtt=460&rtt_var=988&sent=308&recv=91&lost=0&retrans=1&sent_bytes=217864&recv_bytes=14822&delivery_rate=6607269&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=1116&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/media/2202/conversions/459_459__459_662a16c8bd62b_immediate_ursa.webp

104.21.58.191

200 OK

57 kB

URL GET HTTP/3
immediate-urex.org/media/2202/conversions/459_459__459_662a16c8bd62b_immediate_ursa.webp
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 459x459, Scaling: [none]x[none], YUV color, decoders should clamp
Size
57 kB (56574 bytes)
Hash
d8136c08655f8355be494b0c1658f525
c3bbeaec33bde0e42dd832fa56d417d2c81d707d
0f4bc9de9d351e790ecd0a722ef5f22aaa7242565a5b31e04ea5865238c5f2b4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/2202/conversions/459_459__459_662a16c8bd62b_immediate_ursa.webp HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/webp
content-length: 56574
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-dcfe"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gPgLixug10AB%2FM1Qs1xFCmFqnAqsyYvWaqzwv8ASeQJUskMeLOArAvgiNSiYzChQ0DLprUdC9skn40GSynoo7obRDhT6IYhqMQgk%2Bqq73u74P0CnKMDy91Ux2nlSI4%2BTZv5splQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 918520872aae0b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2253&min_rtt=460&rtt_var=2396&sent=355&recv=94&lost=0&retrans=1&sent_bytes=272530&recv_bytes=15976&delivery_rate=4701201&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=1224&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/media/2201/conversions/32_32_662a16b57d9ba_immediate-ursa.png

104.21.58.191

200 OK

2.8 kB

URL GET HTTP/3
immediate-urex.org/media/2201/conversions/32_32_662a16b57d9ba_immediate-ursa.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 29 x 32, 8-bit/color RGBA, non-interlaced
Size
2.8 kB (2778 bytes)
Hash
571fef01b2c33dcae1663c0e34915ae6
a3c531671afa52ef2d591481823925048305b975
c9b873b9cd4b8696d3601114117b97326e067bc3819084f30d3f5ecefc986e8c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/2201/conversions/32_32_662a16b57d9ba_immediate-ursa.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:50 GMT
content-type: image/png
content-length: 2778
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-ada"
expires: Mon, 28 Apr 2025 03:35:50 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WfUfx587qvl%2Feb%2FxEE%2FHm5hR9m2hUv5kstZLWBi9alEg5lQWvIcuVnGPth1S2fqDoCWh9K7nHcqKPDtjUFs%2FDMBA36kSo8DVQ3SFRt1cHN9UKzcMi0EFfy38hAUlaQ28sg0yiAE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208b7c170b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1029&min_rtt=460&rtt_var=342&sent=451&recv=112&lost=0&retrans=1&sent_bytes=363244&recv_bytes=17327&delivery_rate=5208&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=1771&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/action/click

104.21.58.191

200 OK

5.4 kB

URL POST HTTP/3
immediate-urex.org/action/click
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
JSON text data
Size
5.4 kB (5383 bytes)
Hash
35ad7a98201eb3a43687473e0a0e041d
2b376c0b72a38fe0bebc7b07e37183a5b15e2dbf
1e0938c8449ba46463a7d9854f22939ace10d4e262e7d3b6281bd5b253282912

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /action/click HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 2
Origin: https://immediate-urex.org
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:50 GMT
content-type: application/json
access-control-allow-origin: *
cf-cache-status: DYNAMIC
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d2%2FzFhr%2FWluMN6yVOzyNiXfqnHxhy09pdXEeHNQKQJuHEy4DGOtQJydwe2LkLlLkjTz2wZnxiq%2BE0EB3f1iqtTqicleN%2BLKN%2FN9Ufd6MyW9NK%2Fd7wO8ZttHip6UEpGBK4sNa7hs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 918520885b090b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1039&min_rtt=460&rtt_var=539&sent=448&recv=109&lost=0&retrans=1&sent_bytes=361808&recv_bytes=16907&delivery_rate=1509296&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=1504&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/form.js

104.21.58.191

200 OK

280 kB

URL GET HTTP/3
immediate-urex.org/form.js
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
280 kB (279475 bytes)
Hash
57222cd559e3a912092239fcdb6706de
d65d9e06d224a9a7e22916dc04eae83d1f26d6c7
81a17cfaf5731292df919a903727b86550d2a57e1ad29893dc693ef9c2013113

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /form.js HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: W/"2706931c9edd6c7804715d81a4fd3a4a"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A9eA7O7FeBL8fmQv3w94%2F55C26bqNDHwCprquUX3gis2LVN3%2BKAfFdc2DdXWhRZuza%2Blg7HSy%2FO07mDyFrm%2BB1InFs1t%2BxQirffHI1ozkhzegu1Plo7p%2BwfVROQq%2BuBBMQYrWgLLxlt6Nlmm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
priority: u=3,i=?0
server: cloudflare
cf-ray: 91852083b9b40b02-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=7411&min_rtt=7406&rtt_var=2788&sent=3&recv=6&lost=0&retrans=0&sent_bytes=139&recv_bytes=1235&delivery_rate=194362&cwnd=248&unsent_bytes=0&cid=f49fe05e23bbdb75&ts=24&x=0", cfL4;desc="?proto=QUIC&rtt=881&min_rtt=471&rtt_var=587&sent=166&recv=68&lost=0&retrans=0&sent_bytes=84821&recv_bytes=12636&delivery_rate=2140947&cwnd=45300&unsent_bytes=0&cid=1a433235f7583d47&ts=695&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/common/arrow-down.svg

104.21.58.191

200 OK

687 B

URL GET HTTP/3
immediate-urex.org/common/arrow-down.svg
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
SVG Scalable Vector Graphics image
Size
687 B (687 bytes)
Hash
6ed86dcdd7c4ffa1cf16cfcc5f33abea
e7d5febe689889ead7eb393ed3e4edae191eaac2
fc9296ff4dd35d165deefe34aad3d586631bc5d6e319ff2ef73500768ebc3fa9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /common/arrow-down.svg HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/static/assets/index-80aeac3d.css
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/svg+xml
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: W/"67815274-2af"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qx46F8rUiUlMLytJS86UXo0f6TcZozR37%2FnzH14ZHqsAs8xmzJEF2nEwkWPI062f%2FfDJQYOSGas7R2xNjemFmv7aozwAELnWQweOF6y6hjxTFz%2F6HeYgQt9VJ0%2BnLSLhkxVPzQ0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852086ba8b0b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=672&min_rtt=460&rtt_var=252&sent=275&recv=86&lost=0&retrans=0&sent_bytes=186305&recv_bytes=14593&delivery_rate=1200875&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=930&x=1", cfExtPri, cfHdrFlush;dur=0

fonts.googleapis.com/css?family=Poppins:300,400,600,700,800&display=swap

142.250.74.10

200 OK

4.2 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Poppins:300,400,600,700,800&display=swap
IP
142.250.74.10:443
ASN
#15169 GOOGLE

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintD9:DA:31:61:C2:D7:49:CF:50:B6:1B:FE:BA:EC:9D:12:91:8D:10:AC
ValidityMon, 03 Feb 2025 08:37:09 GMT - Mon, 28 Apr 2025 08:37:08 GMT

File type
ASCII text, with very long lines (4312), with no line terminators
Size
4.2 kB (4222 bytes)
Hash
7a52532aa5992c1cf7a99f4b18624393
9e00961ca3425922d02db104763728e756d73b11
92fac4090ff2c7b1b4203ebc8c05e53d7ff31af4fdc1aa0c24606b1257de715b

HTTP Headers

GET /css?family=Poppins:300,400,600,700,800&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 27 Feb 2025 03:35:49 GMT
date: Thu, 27 Feb 2025 03:35:49 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

immediate-urex.org/static/assets/app-6256b172.js

104.21.58.191

200 OK

17 kB

URL GET HTTP/3
immediate-urex.org/static/assets/app-6256b172.js
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
JavaScript source, ASCII text, with very long lines (3636)
Size
17 kB (16786 bytes)
Hash
3e2d482771a47ba9b3a2bce1db19e0d2
3509e9194d4a793ffd94a62ff64826a7591d35b9
b1dc3a468eb8949e17762628c68205ee4ffad52ec1cdbe48e3456bf96c1c9603

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/assets/app-6256b172.js HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: application/javascript
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: W/"67815274-4192"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n4wkD6UDaD43kf3Sq2%2Fii62zPRNijg9U0uxoqJigHnhUAAaoC4urH6w4A1okPnnLk37nIz993uDgdQLnjxw8Bz071%2FVeaGt52afppXZZ4gQJsWzCgOpDC1QELHwS%2FRYsFAW6jT8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208389850b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5989&min_rtt=595&rtt_var=6165&sent=76&recv=44&lost=0&retrans=0&sent_bytes=35616&recv_bytes=11552&delivery_rate=88017&cwnd=15600&unsent_bytes=0&cid=1a433235f7583d47&ts=522&x=1", cfExtPri, cfHdrFlush;dur=5

immediate-urex.org/static/assets/index-80aeac3d.css

104.21.58.191

200 OK

155 kB

URL GET HTTP/3
immediate-urex.org/static/assets/index-80aeac3d.css
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
155 kB (155134 bytes)
Hash
d3a35488c0d1fd37aa9e385f200ffe1d
06f40be23907ff5db00776afbe707c265a41f7ae
80aeac3d09e16b39cdd4449abd33a5f06f39748a8c33143218388ae087c75e72

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/assets/index-80aeac3d.css HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: text/css
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: W/"67815274-25dfe"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zt7za3EG7BxcOgGnKOPFo9eU7O0XRV0RgaziWisvG4Iem5Q6s9b7zFCAqFiRa15nVKUCIkx%2F0wvrDmZWmzyL5s8viKBZjf%2B3MNTL2wdkkecUUlw%2B0l2pQLBP4g%2Bt6FG7orXyzOE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208389840b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3757&min_rtt=595&rtt_var=2268&sent=67&recv=43&lost=0&retrans=0&sent_bytes=27947&recv_bytes=11508&delivery_rate=85546&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=519&x=1", cfExtPri, cfHdrFlush;dur=1

immediate-urex.org/flags/en.png

104.21.58.191

200 OK

1.8 kB

URL GET HTTP/3
immediate-urex.org/flags/en.png
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1767 bytes)
Hash
ec7233b5c80e5db85f7733b2ec25203f
d4c36fff06dc7d920b10eb13b58ea9cd9321b430
347ee97a492f79675749d03533810ff899ee6a784b4e156f3e0a7613cdfb3d40

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /flags/en.png HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:49 GMT
content-type: image/png
content-length: 1767
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: "67815274-6e7"
expires: Mon, 28 Apr 2025 03:35:49 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=09fhl1WMsVELgrdvpz9Ef0Czs1sEefWkEm6nMpVKUL42iq1lQCc9N%2FiEsjhJNKvl%2Fo5auGNrR%2BdiWYbWe44KXqO74E4yEV3u5v1fGSltTmGhe2uRp21MNIYpR5myqDWXqRjPKPM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9185208389880b02-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3841&min_rtt=595&rtt_var=2500&sent=42&recv=41&lost=0&retrans=0&sent_bytes=8424&recv_bytes=11420&delivery_rate=77&cwnd=12000&unsent_bytes=0&cid=1a433235f7583d47&ts=494&x=1", cfExtPri, cfHdrFlush;dur=0

immediate-urex.org/countries/no.svg

104.21.58.191

200 OK

333 B

URL GET HTTP/3
immediate-urex.org/countries/no.svg
IP
104.21.58.191:443
ASN
#13335 CLOUDFLARENET

Requested by
https://immediate-urex.org/
Certificate
IssuerGoogle Trust Services
Subjectimmediate-urex.org
FingerprintBB:D1:D1:E5:36:97:54:91:17:34:79:7F:9D:7F:D2:BC:9A:7D:25:7D
ValidityFri, 14 Feb 2025 09:22:26 GMT - Thu, 15 May 2025 10:19:54 GMT

File type
SVG Scalable Vector Graphics image
Size
333 B (333 bytes)
Hash
fbe574c9e42b94e897c9008ebd2c13fb
1c3e08b98270e030f127b55564270fb47297a23c
144bac748b65c5cbcf7ce1016ce55cc041d5da3788a7ded832951a1e94c2a6e1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /countries/no.svg HTTP/1.1
Host: immediate-urex.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://immediate-urex.org/
Cookie: lang_fx=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 27 Feb 2025 03:35:50 GMT
content-type: image/svg+xml
last-modified: Fri, 10 Jan 2025 17:01:40 GMT
etag: W/"67815274-14d"
expires: Mon, 28 Apr 2025 03:35:50 GMT
cache-control: public, max-age=5184000
cf-cache-status: MISS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZDXB2c7YqlbXxcRT8ElXnDY1zlvzsIrDWE60Ln4C%2B2UxqbUY9qFIN4KChPVRqsnUB3YoAP4S3PxrtRgB7fD1s9JhOTbd%2BAUrswuo9b8kEwuGqh2PzgwijtrZFLp06wPwm%2Bzzam4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 91852089db6c0b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1039&min_rtt=460&rtt_var=539&sent=447&recv=109&lost=0&retrans=1&sent_bytes=360918&recv_bytes=16907&delivery_rate=1509296&cwnd=84600&unsent_bytes=0&cid=1a433235f7583d47&ts=1504&x=1", cfExtPri, cfHdrFlush;dur=0

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (48)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type