Report - 1xlite-248336.bar/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com

Report Overview

Visitedpublic

2025-07-16 20:50:52

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.googletagmanager.com	75	2011-11-11	2012-10-04	2025-07-16	447 B	466 kB	142.250.178.72
1xlite-248336.bar	unknown	2025-04-29	2025-07-16	2025-07-16	24 kB	1.2 MB	83.147.224.233
v3.traincdn.com	unknown	2022-11-10	2022-11-25	2025-07-11	32 kB	5.2 MB	185.244.209.62
region1.analytics.google.com	unknown	1997-09-15	2022-03-17	2025-07-16	1.5 kB	851 B	216.239.34.36
radar.cedexis.com	3035	2009-01-07	2013-11-27	2025-07-11	868 B	1.4 kB	45.54.49.5
www.google.no	25607	2001-02-26	2012-06-26	2025-07-16	891 B	580 B	142.250.74.131

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-07-16	medium	1xlite-248336.bar	Sinkholed

ThreatFox

No alerts detected

JavaScript (49)

	URL	From	Size	First Seen	Last Seen
	1xlite-248336.bar/hd-api/external/assets/hdf.js	ScriptElement	4.1 kB	2025-06-05	2025-07-24
URL 1xlite-248336.bar/hd-api/external/assets/hdf.js IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded false Resource Info First Seen 2025-06-05 Last Seen 2025-07-24 Times Seen 1121 Size 4.1 kB (4083 bytes) MD5 40eaa62ed21bd753172f4c307e2a41d0 SHA1 f7b03c6b004562311c8ca00466179629738b2a40 SHA256 60fed8cb321dc09e4e1d910b5822bd8f67d53d0962a41ddc9f5ac33edd4e2213 Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Eval	305 kB	2025-07-16	2025-07-16
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Eval Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 1 Size 305 kB (305145 bytes) MD5 168f4e0e685071e8fb56fb2e53245148 SHA1 18f8a92d2916872a0e8a45ee34f04fd62042cc86 SHA256 35128b0145513aea0698760ad46f552fbbfb30f0f8fda6b92ff56e751d60f800 Format Code Loading...

	data:text/javascript,export const meta = import.meta;	ScriptElement	32 B	2023-12-06	2025-08-03
URL data:text/javascript,export const meta = import.meta; IP / ASN 0.0.0.0 #0 Introduced by ScriptElement Embedded false Resource Info First Seen 2023-12-06 Last Seen 2025-08-03 Times Seen 4170 Size 32 B (32 bytes) MD5 6d772b7d405b447ecee54ab61cdd5108 SHA1 dd65fb9cd5a7cb94a40fe161f4f72303a61eb3b7 SHA256 b90ff694e492935b6036fb7e878d365dab51aafa46f0afb1e33414e7ecc3307b Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/app-b97c4b18.js	ScriptElement	805 kB	2025-07-16	2025-07-16
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/app-b97c4b18.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 805 kB (805156 bytes) MD5 a355d23ded8f16c0ebf2ac895e502769 SHA1 4843ea749665a5e526e9fd3fb3f9423ae7b2cf3f SHA256 7ac4976ada69f3f7cbb845c42dd502d6fc634f8adec820889a155ef8ac3c80ce Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/Betting.Core-a5333299.js	ScriptElement	2.3 kB	2025-07-16	2025-07-16
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/Betting.Core-a5333299.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 2.3 kB (2294 bytes) MD5 75254c626d57105e3ba530ab99a5ee12 SHA1 f78245146c1061afd83c9a144971ef34c7f6c8c0 SHA256 c91fd77dede849d9750e47c6baf2a40c418e9408b07ea22b37e809dbe29a336d Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_dc8f5562a3.js	ScriptElement	918 B	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_dc8f5562a3.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 918 B (918 bytes) MD5 b006c84a572ea171849e59ee8e2a6cef SHA1 1e96a6887544d808c9bd793cd950ac3898b30c7f SHA256 8353695425f0a3e552dbc8b25e0011a307c0cb95533c4f323894565317b2a5ae Format Code Loading...

	1xlite-248336.bar/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js	ScriptElement	760 B	2025-05-21	2025-07-24
URL 1xlite-248336.bar/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded false Resource Info First Seen 2025-05-21 Last Seen 2025-07-24 Times Seen 1326 Size 760 B (760 bytes) MD5 0b911773e0df627d77f8306c86e228aa SHA1 0d584bb1a3294e4fe42df4582dcc8a2c8f77f7bb SHA256 01e4926540498a77d866259516007d41fae1213ab9607db826f011d926fd6006 Format Code Loading...

	v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/ab3a9ece24.js	ImportedModule	3.6 kB	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/ab3a9ece24.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 14 Size 3.6 kB (3550 bytes) MD5 c32095a14de24cee6ab79c4ca2f132df SHA1 9fd424b3ea8aef027b1a2f37ba385a961f43fda3 SHA256 149b1dddb8a13ef86e3f7f379019e71d2a416343674e98dd655d27d13ac80033 Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/runtime-ac7ca5a7.js	ScriptElement	19 kB	2025-07-16	2025-07-16
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/runtime-ac7ca5a7.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 19 kB (18840 bytes) MD5 051e48afee482a12fa6fbeddd50df126 SHA1 709f18f26f7181cc24626e77fe844fb43eae57d7 SHA256 cc580836a4030758c06d690fb3f3d42bfbb46ec5b921fb6dfbe5e2c56ff7a68c Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/commons/app-7355368e.js	ScriptElement	138 kB	2025-07-16	2025-07-21
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/commons/app-7355368e.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 138 kB (137774 bytes) MD5 ad01c020d5875aa2ef7b446a018775a8 SHA1 f82e42d6d1b107aaf65e6f6a6918818370912450 SHA256 601411e27033123ba941805129209c8a9cf61951c61705a8cc314b0db1802b85 Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-js-modal-f0e7d6a4.js	ScriptElement	27 kB	2025-07-16	2025-07-23
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-js-modal-f0e7d6a4.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-23 Times Seen 16 Size 27 kB (26667 bytes) MD5 bf36daa969f7f46af40f3b297e65fe4d SHA1 4a0e9af2cd532e40645bc8a47674a81b7da3b23a SHA256 533344750c0ece83c79331f6ab4a177494908d492196ff35de7f2d798a6ee505 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/__shared_chunk_7HDOEZTP.js	ImportedModule	1.2 kB	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/__shared_chunk_7HDOEZTP.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1478 Size 1.2 kB (1194 bytes) MD5 7e76c08e7f16815131a5f13a10c1efba SHA1 5f800877b78a0713157fe119bc1a2d9a260f72e1 SHA256 c6f29a0c7c3ed884ccffd7a529fd2fc599e2da1f31af658146f0e36a3f4c00dc Format Code Loading...

	v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/entry-1defa6e1c0.js	ScriptElement	30 kB	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/entry-1defa6e1c0.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 14 Size 30 kB (30039 bytes) MD5 295a457abccc11f066dc1344a75cb138 SHA1 9f7b6f46eb9641aafd008fcfc56e6cf1d640324b SHA256 49721749cee6bedf3f5939fd84d8b0bc327cae759cf74ece33d2ddcb891c0fff Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	96 B	2023-12-06	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2023-12-06 Last Seen 2025-08-03 Times Seen 4171 Size 96 B (96 bytes) MD5 94361ed86ab9b2fbb8d805c2025df46a SHA1 3f428332f7a1c7196a85c93a373a966d75708c19 SHA256 eee4d228a49a86625f29410cf9a23d145e821a09cbb1f7a4d7557d206872715a Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	ScriptElement	1.6 kB	2025-07-16	2025-07-16
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded true Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 1.6 kB (1648 bytes) MD5 3c3088454fd83fd3dfa302b92cd6f15a SHA1 fe0fb4ba44e87d31aec21a1223822357ef5f3086 SHA256 2c62288bc6eb063263c1c5abcf5f814356902e29f3576f5a8f1802911d860042 Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-notification-38652366.js	ScriptElement	13 kB	2025-07-16	2025-07-23
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-notification-38652366.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-23 Times Seen 16 Size 13 kB (12563 bytes) MD5 dbac73425b7edc69c86c1f84db58c00a SHA1 20600863d4a31f34435c40a1a6872b32261f713b SHA256 044eca4e831dbfed4331761134e0e2f6a3e453c7e410ba54fac446b55d49aa53 Format Code Loading...

	1xlite-248336.bar/captcha-api/assets/hunt-captcha.js	ScriptElement	87 kB	2025-07-16	2025-07-21
URL 1xlite-248336.bar/captcha-api/assets/hunt-captcha.js IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 151 Size 87 kB (86579 bytes) MD5 463ec5b64c24135eb67e671110b5d44b SHA1 a7bd6aa5fc80405ffcb6d9e5ad1c51590e00ef7c SHA256 117405693cdc1b81d14087d8fd50ecb1709a19fb6d7adb936ef31d7e8f6ab3c7 Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	39 B	2023-04-14	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2023-04-14 Last Seen 2025-08-03 Times Seen 6521 Size 39 B (39 bytes) MD5 bc51ed8c76553717f10d58b2df60fd76 SHA1 e2d03a8fd8d280074b226c288880f9df299c7cb1 SHA256 bee994eaf88453f6343ba57571a069054c12c9b4e42f8cbad4f2ad75c7fb264c Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	44 B	2023-04-14	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2023-04-14 Last Seen 2025-08-03 Times Seen 6518 Size 44 B (44 bytes) MD5 00beb9884d0391b342eadd30744b539a SHA1 3124c0bd593822379d22f13d3e08e70a1bf5ea14 SHA256 92394eec5690449a4f6cfc9a7f97497a69e926b2365cb9a9aad3507a844f835c Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	ScriptElement	7.1 kB	2025-07-16	2025-07-16
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded true Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 7.1 kB (7117 bytes) MD5 4fed13da1ac140ce1b46b7ee8165f1fb SHA1 97319d852da0974cd43a706ea36db32b6e2a9ac3 SHA256 ea62af330a5795448a14d4d5e3fcb3985edf9781951a054db4412c6493f79fd9 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/__shared_localforage_FJKG5M2E.js	ImportedModule	30 kB	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/__shared_localforage_FJKG5M2E.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1478 Size 30 kB (30277 bytes) MD5 02cf95f00794b77df34632e34a59c5be SHA1 b64889fb6cbe78a141688ea761a627997ef8a8af SHA256 bf78b7b3dd6ecbdea04c575edfb6022ed1b2e98c7a9cb9f02ab851ca638f1b83 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_0e05b6f8a4.js	ImportedModule	355 B	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_0e05b6f8a4.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 355 B (355 bytes) MD5 cb123e3d49fca716429cc9792d0c2ead SHA1 34023307d812b041e1068a39ba6ec1ba21512bb6 SHA256 5f1f70d1e543cc47431f32230317fa9247a4c3597d7216023ca16bf75e9a9b9e Format Code Loading...

	v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2cc79f22e4.js	ScriptElement	12 kB	2025-07-16	2025-07-16
URL v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2cc79f22e4.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 12 kB (12172 bytes) MD5 82881e99bdb13905b30023566562b455 SHA1 c18b7d4527b7d23b6e7d9095afcb080cfbfdce2a SHA256 de3fe791874e61ab280ca345f3ff4c5fbb71b2c9bfa1f49110debe1fa88418b4 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_4e6bc58081.js	ScriptElement	943 B	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_4e6bc58081.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 943 B (943 bytes) MD5 09671f9d760794dc31a5d1572e178de6 SHA1 f938a9119a39ed2a37818dd7250009f49d64bbf5 SHA256 90930ed29777d5825e8bb77e8a95b3eb7a96e8185af45ea83c613e0130659e78 Format Code Loading...

	radar.cedexis.com/1/23802/radar.js	ScriptElement	390 B	2024-02-13	2025-08-03
URL radar.cedexis.com/1/23802/radar.js IP / ASN 45.54.49.5 #63911 NetActuate, Inc Introduced by ScriptElement Embedded false Resource Info First Seen 2024-02-13 Last Seen 2025-08-03 Times Seen 3409 Size 390 B (390 bytes) MD5 82dec77fd0353c7c71ce053b8601387e SHA1 fbbca95419e1d0c042e0a5fdf10f380aca66188c SHA256 39f2b7b0fa78d37d0c84d2d6618bd635d86fd683d9bcdd5729850cb2a62522f7 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_c29ed659a5.js	ImportedModule	16 kB	2025-07-01	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_c29ed659a5.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-01 Last Seen 2025-08-03 Times Seen 670 Size 16 kB (16157 bytes) MD5 b95f2867a4f69c6f87508d4376778ab8 SHA1 34b733244053bb0634826b593e14e88782e81680 SHA256 f318dcd075506078ef1811c0a12962c5fed8811ee39cc3c77691a81063e05340 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js	ImportedModule	19 kB	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1478 Size 19 kB (19175 bytes) MD5 1580a3cfe81fd30910a49dfe64cc8e7b SHA1 314144dc49595482ba46c0b85b38d5f73ef73a7b SHA256 8989a021d20f0fc08c43966a287cbd99e43142a5a0ff42eb232756a101de6035 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_037e7ae64c.js	ScriptElement	988 B	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_037e7ae64c.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 988 B (988 bytes) MD5 c125f0a7d824ba12473c9b3afc2aa261 SHA1 906eb5b740f2bc4bf1c7d833990c74be3ef3f39c SHA256 e6d1f4330c0505336b37abd6cd00876ecfc9448d8573cd3c153c752b5e0753fa Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	ScriptElement	195 kB	2025-07-16	2025-07-16
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded true Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 1 Size 195 kB (195179 bytes) MD5 fd5d56c1e9bd19c78cad85555a77e097 SHA1 0f503a4f8dbdecb1bcfae83ba1a381bd5f8424f8 SHA256 a3486879df09c41a3fb8813b04e083ad518e7a296c4306540c90e7f2788c3682 Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/app-2fafc41b.js	ScriptElement	520 kB	2025-07-16	2025-07-16
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/app-2fafc41b.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 2 Size 520 kB (520179 bytes) MD5 dda434077c5a6f1b13177737601ddf09 SHA1 e4f1bd4e08763f09e68fec48c6a1ff2875b7958c SHA256 5bb93595418180570b3cb62c165566eadffed3f8be78dacc6ff100793f153226 Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Eval	2.6 kB	2025-07-14	2025-07-16
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Eval Embedded false Resource Info First Seen 2025-07-14 Last Seen 2025-07-16 Times Seen 4 Size 2.6 kB (2572 bytes) MD5 20fa0112b1f6b0ed6a22a38ef133fd39 SHA1 348afe65691cef1562ce952758d2e1794377bcde SHA256 a0ae6a83d8682b2901f1cfc87ef3d29a7a8c7a2c4965b1b45c3012a1b8a05291 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js	ImportedModule	865 B	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1478 Size 865 B (865 bytes) MD5 0af3fe0c072a5bb3b6c731767187982f SHA1 55db5afb57265dc92fd121fe9ae565ffb2f53b2c SHA256 655bbe85da91e863401c6f96e24b41f5c2fe51a4245cecc2deb2b8c9600fef30 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js	ImportedModule	1.3 kB	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1478 Size 1.3 kB (1297 bytes) MD5 e3f1c4089db6b910890e85d97a2e2066 SHA1 85828920da3c3fd7856acde184e835ac314295cd SHA256 6c28afe5a52e0f9b1138fe498b254c8671058a058b555651ccae8e91e7534614 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_9a042c387f.js	ImportedModule	1.1 kB	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_9a042c387f.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 1.1 kB (1086 bytes) MD5 151e9c94f88543e420df7057f24cf740 SHA1 1c5ca46913db9eb7db938c634de722655a8f7a21 SHA256 7cc3f3502895d9a5656b3904d6a193be27835e85f23d6c9c5a8ae7b5e1f5b613 Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	85 kB	2025-07-16	2025-07-21
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 151 Size 85 kB (84758 bytes) MD5 6cc39c97d24ea677a3b8b33bc06ebe37 SHA1 753a3cc5a6c5cabf40beab71d3955f0d0b9301ee SHA256 b2c91f15882c6636b78fc8ba29b53382acd75a4b97ead9121199b1a1781be2fa Format Code Loading...

	v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2b6bc77c22.js	ImportedModule	1.5 kB	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2b6bc77c22.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 14 Size 1.5 kB (1464 bytes) MD5 6111b84894a9374e4509b51adeb41c3a SHA1 0c446813c598998a630078a25213d82d200317cb SHA256 5a1746cd52bc1a85ae15cc12a9e1bb32ad14cb7609332266b1a08635d2529b6c Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	293 kB	2025-07-16	2025-07-16
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 1 Size 293 kB (293198 bytes) MD5 a5c6d16fd20cf55d41c143eae4d535ca SHA1 c2bbc5786ce69483d0e3439e08abf7a559a0f9fe SHA256 b68ed1feae21cd732e3a6f5668bc780c66e71a06b27424d0d591947a17f60b95 Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	47 B	2023-04-14	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2023-04-14 Last Seen 2025-08-03 Times Seen 6515 Size 47 B (47 bytes) MD5 a01893d8e129ad16c1e0fc5c7537f411 SHA1 0e46d1bf2718f848d9d596fa269eaedb31204772 SHA256 cbe7b89533bcd75b69f3e54807308551d68242ec1761e63bee1a99fc6e560175 Format Code Loading...

	1xlite-248336.bar/main-static/8bd3f8a1/check-ob.js	ScriptElement	219 B	2024-07-17	2025-08-03
URL 1xlite-248336.bar/main-static/8bd3f8a1/check-ob.js IP / ASN 83.147.224.233 #0 Introduced by ScriptElement Embedded false Resource Info First Seen 2024-07-17 Last Seen 2025-08-03 Times Seen 2598 Size 219 B (219 bytes) MD5 c065700c9c8c493403359e1f2baa10d9 SHA1 4630fe729e70bdf63fa7ba6c84ec277fd1f51030 SHA256 1e61f0c82ae82ffcf503fcd4b4c8ae27b32c11e19b882d5d13f3c44364c893f4 Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/DC-3d31e221.js	ScriptElement	2.7 kB	2025-07-16	2025-07-23
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/DC-3d31e221.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-23 Times Seen 16 Size 2.7 kB (2657 bytes) MD5 e4ebd52e9a81ceed08fb6e2f61297bce SHA1 fc8e74cc313b40e9c35f970fee65e111e9c9a8fe SHA256 b402aa79cb7b5642755c039b71acffeec8511430557820d034d75681ae082e39 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js	ImportedModule	159 kB	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1478 Size 159 kB (158815 bytes) MD5 1da464d70e78b04b9b808e82e4ad9487 SHA1 0c79e65516d1525ecb43d13cfb4ccb0631095a28 SHA256 b4c72b8036ca6767ab61490178f901538646f2aa1001cb042caa134174a41595 Format Code Loading...

	v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_base-app_6f8fb0c3ba.js	ImportedModule	1.4 MB	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_base-app_6f8fb0c3ba.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 15 Size 1.4 MB (1391731 bytes) MD5 528f735e080f8c6c18d700833b201866 SHA1 8e017483120f47e36057edaeee216c6137c94321 SHA256 0a6f6f8ee222cba4b49ba971444f3207abd8f726c75ae551feabbd508e4eeeb0 Format Code Loading...

	v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/65e47f9e2b.js	ImportedModule	147 B	2025-07-16	2025-07-21
URL v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/65e47f9e2b.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-21 Times Seen 14 Size 147 B (147 bytes) MD5 3460eb1763f2feb21759ecf6a24212ad SHA1 46f13c27af7ac7b24418a7b1a8140f5fd546ce74 SHA256 25b4a8dfeec5fa33cd12d65782388ab03697d0c55e444af2591c600bbd8764da Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	47 B	2023-04-14	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2023-04-14 Last Seen 2025-08-03 Times Seen 6516 Size 47 B (47 bytes) MD5 580b3e56fc9ab6e8b4655f43ee057cc1 SHA1 5dfce565e446f4a167195de9a1a5dd26163c711c SHA256 446f07b6e56de61d2c2d5b6ba408cc580b492a6d1ede8fc51cfde4ef75a2b382 Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	DomTimer	10 B	2024-09-21	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by DomTimer Embedded false Resource Info First Seen 2024-09-21 Last Seen 2025-08-03 Times Seen 2207 Size 10 B (10 bytes) MD5 01f4b51b4ba7edd00ad9f0a22259f06e SHA1 00723d0eda4be61a7b1c542b0a08a94a94a60017 SHA256 9fdac1c31a22f55dbb8ca225ee28c3f7e88b41cce82968af0018c9f8b3bd35ba Format Code Loading...

	v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/$_$.js	ImportedModule	69 B	2025-05-14	2025-08-03
URL v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/$_$.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ImportedModule Embedded false Resource Info First Seen 2025-05-14 Last Seen 2025-08-03 Times Seen 1380 Size 69 B (69 bytes) MD5 2cdaa92927f02e0b628f1ef4d7dd8caf SHA1 9104a2e16ed080b80a42588b8aeb52ebec47ab7a SHA256 ef8101ffea52addcdcfcc3a83f96ff2d4613fb3ae6d1c16bbe4852387b73a9db Format Code Loading...

	1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com	Function	34 B	2023-04-14	2025-08-03
URL 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com IP / ASN 83.147.224.233 #0 Introduced by Function Embedded false Resource Info First Seen 2023-04-14 Last Seen 2025-08-03 Times Seen 6528 Size 34 B (34 bytes) MD5 7bcdb973ab8af8e24ab11cb554a1ba6e SHA1 24e8a10f240f2b06f81d7c173cd0a90606641fc1 SHA256 916ec4eb9b485eb47f43a17fe212e84e4b72600b45eb6d4588599ad495a57fcd Format Code Loading...

	v3.traincdn.com/main-static/8bd3f8a1/mobile/default/analytics-371708e9.js	ScriptElement	7.1 kB	2025-07-16	2025-07-23
URL v3.traincdn.com/main-static/8bd3f8a1/mobile/default/analytics-371708e9.js IP / ASN 185.244.209.62 #199524 G-Core Labs S.A. Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-23 Times Seen 16 Size 7.1 kB (7104 bytes) MD5 3597af95296326bbaea7a2271c9be084 SHA1 a4f045b26628538535bad8b3fb0a742126f5539b SHA256 cc03433167c941d67ce43a469a7297ccb6fb03a1f4fae8b774d2a6c58a076dce Format Code Loading...

	www.googletagmanager.com/gtag/js?id=G-0NQW4X2MPH	ScriptElement	465 kB	2025-07-16	2025-07-16
URL www.googletagmanager.com/gtag/js?id=G-0NQW4X2MPH IP / ASN 142.250.178.72 #15169 GOOGLE Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-16 Last Seen 2025-07-16 Times Seen 1 Size 465 kB (464885 bytes) MD5 13a26926e96e418a17297862fb9960b2 SHA1 df13a5fbcc5d474e55d7cc13c752075e8de49e74 SHA256 ff1c9f63f9de64d6d8ed66cdd3dd02688d043695edd0e455d7254a3ab2841b39 Format Code Loading...

HTTP Transactions (91)

URL IP Response Size

GET 1xlite-248336.bar/hd-api/external/assets/hdf.js

83.147.224.233

200 OK

4.1 kB

URL

1xlite-248336.bar/hd-api/external/assets/hdf.js

IP / ASN

83.147.224.233

Requested byhttps://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com

Resource Info

File typeC++ source, ASCII text, with very long lines (874)

First Seen2025-06-05

Last Seen2025-07-24

Times Seen1121

Size4.1 kB (4083 bytes)

MD540eaa62ed21bd753172f4c307e2a41d0

SHA1f7b03c6b004562311c8ca00466179629738b2a40

SHA25660fed8cb321dc09e4e1d910b5822bd8f67d53d0962a41ddc9f5ac33edd4e2213

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /hd-api/external/assets/hdf.js HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332; SESSION=1ae57178b6c7f863f8d6db2e88cea16b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:23 GMT
content-type: text/javascript; charset=utf-8
content-length: 1620
cache-control: public, max-age=300
content-encoding: gzip
etag: 40eaa62ed21bd753172f4c307e2a41d0
vary: Accept-Encoding
x-dt: 672
x-request-guid: 9667b34876de7f3b815685d2726ef84e
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.005, wf-uht;dur=
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-js-modal-f0e7d6a4.js

185.244.209.62

200 OK

27 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-js-modal-f0e7d6a4.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (26667), with no line terminators

First Seen2025-07-16

Last Seen2025-07-23

Times Seen16

Size27 kB (26667 bytes)

MD5bf36daa969f7f46af40f3b297e65fe4d

SHA14a0e9af2cd532e40645bc8a47674a81b7da3b23a

SHA256533344750c0ece83c79331f6ab4a177494908d492196ff35de7f2d798a6ee505

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-js-modal-f0e7d6a4.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-7c52d9109b24312966df8f1f29e5e5ee-1e4ced5d160f273c-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"bf36daa969f7f46af40f3b297e65fe4d"
x-amz-meta-mtime: 1752647172.112835105
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:28 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50683
cache: HIT
x-cached-since: 2025-07-16T06:45:32+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js

185.244.209.62

200 OK

1.3 kB

URL

v3.traincdn.com/sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (1265)

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1478

Size1.3 kB (1297 bytes)

MD5e3f1c4089db6b910890e85d97a2e2066

SHA185828920da3c3fd7856acde184e835ac314295cd

SHA2566c28afe5a52e0f9b1138fe498b254c8671058a058b555651ccae8e91e7534614

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/__shared_accept_language_parser_B6TW5FDZ.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-ee153f4e0b4897c48d1f13c8d24eea4f-8081a0e95b304156-01
last-modified: Wed, 16 Jul 2025 17:08:22 GMT
etag: W/"e3f1c4089db6b910890e85d97a2e2066"
x-amz-meta-mtime: 1752685645.161300517
content-encoding: gzip
expires: Thu, 17 Jul 2025 19:50:29 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3587
cache: HIT
x-cached-since: 2025-07-16T19:50:29+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/Betting.Core-a5333299.js

185.244.209.62

200 OK

2.3 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/Betting.Core-a5333299.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (2294), with no line terminators

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size2.3 kB (2294 bytes)

MD575254c626d57105e3ba530ab99a5ee12

SHA1f78245146c1061afd83c9a144971ef34c7f6c8c0

SHA256c91fd77dede849d9750e47c6baf2a40c418e9408b07ea22b37e809dbe29a336d

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/Betting.Core-a5333299.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-dd21798c2c0d101b06b77f9340005560-53d3708856d92442-01
last-modified: Wed, 16 Jul 2025 06:26:13 GMT
etag: W/"75254c626d57105e3ba530ab99a5ee12"
x-amz-meta-mtime: 1752647172.088835026
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:29 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50682
cache: HIT
x-cached-since: 2025-07-16T06:45:33+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/e39ffb0da96695e69e241de88c16207d.json

185.244.209.62

200 OK

3.6 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/e39ffb0da96695e69e241de88c16207d.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-03-01

Last Seen2025-07-30

Times Seen1618

Size3.6 kB (3557 bytes)

MD54b08975411699bcd7464f49777e866bf

SHA12a9b0a0f3eadf5f3e1ef688bacd9560dd59c73d2

SHA256b6208d18413f8988db2e0040ff72516c0cb5e06d3d9692b5b098808ab46fc378

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/e39ffb0da96695e69e241de88c16207d.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
traceparent: 00-86d80bb32219cc0691519220edfd0a3b-2969d93f1e900712-01
last-modified: Thu, 27 Feb 2025 09:06:27 GMT
etag: W/"4b08975411699bcd7464f49777e866bf"
content-encoding: gzip
expires: Tue, 13 May 2025 22:39:23 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_9cf9caa17f.css

185.244.209.62

200 OK

336 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_9cf9caa17f.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (335)

First Seen2025-07-16

Last Seen2025-07-31

Times Seen24

Size336 B (336 bytes)

MD53223ef47ebe36d07ee8dad388110993d

SHA11e4d71da653b77e70fc892e7f6411f8388c8fed9

SHA256680e7f909e1b9b9bba7d9a8826d1d6017c4260e0a66dbc69e2cdbc4e665a89a5

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_9cf9caa17f.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/css; charset=utf-8
content-length: 336
traceparent: 00-34e86cf8b48defa251edbef3a2ee8432-e07686e32e0c0c5c-01
last-modified: Wed, 16 Jul 2025 07:46:28 GMT
etag: "3223ef47ebe36d07ee8dad388110993d"
x-amz-meta-mtime: 1752651659.523020482
expires: Thu, 17 Jul 2025 09:12:48 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 41848
cache: HIT
x-cached-since: 2025-07-16T09:12:48+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

POST region1.analytics.google.com/g/collect?v=2&tid=G-0NQW4X2MPH&gtm=45je57f0h1v894824481za200&_p=1752699026094&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&cid=1052265822.1752699027&ecid=644765140&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1752699026&sct=1&seg=0&dl=https%3A%2F%2F1xlite-248336.bar%2Fen%2F%2C%20https%3A%2Fcdn.brevo.com%2F%2C%20https%3A%2Fcdn.getyourguide.com%2F%2C%20https%3A%2Fhotstar.com%2F%2C%20https%3A%2Fin.pinterest.com%2F%2C%20https%3A%2Flivetileedge.dsx.mp.microsoft.com%2F%2C%20https%3A%2Fmc.webvisor.org%2F%2C%20https%3A%2Fmf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com%2F%2C%20https%3A%2Fs.lngtdv.com%2F%2C%20https%3A%2Fv3.traincdn.com%2F%2C%20https%3A%2Fwidget.suphelper.top%2F%2C%20https%3A%2Fwww.ssssa.yalla--live.com&dt=404&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.optimize_id=GTM-5R4MT54&upn.ref_id=90&tfd=12579

216.239.34.36

204 No Content

0 B

URL

region1.analytics.google.com/g/collect?v=2&tid=G-0NQW4X2MPH&gtm=45je57f0h1v894824481za200&_p=1752699026094&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&cid=1052265822.1752699027&ecid=644765140&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1752699026&sct=1&seg=0&dl=https%3A%2F%2F1xlite-248336.bar%2Fen%2F%2C%20https%3A%2Fcdn.brevo.com%2F%2C%20https%3A%2Fcdn.getyourguide.com%2F%2C%20https%3A%2Fhotstar.com%2F%2C%20https%3A%2Fin.pinterest.com%2F%2C%20https%3A%2Flivetileedge.dsx.mp.microsoft.com%2F%2C%20https%3A%2Fmc.webvisor.org%2F%2C%20https%3A%2Fmf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com%2F%2C%20https%3A%2Fs.lngtdv.com%2F%2C%20https%3A%2Fv3.traincdn.com%2F%2C%20https%3A%2Fwidget.suphelper.top%2F%2C%20https%3A%2Fwww.ssssa.yalla--live.com&dt=404&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.optimize_id=GTM-5R4MT54&upn.ref_id=90&tfd=12579

IP / ASN

216.239.34.36

#15169 GOOGLE

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5619500

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerGoogle Trust Services

Subject*.google-analytics.com

Fingerprint3A:12:37:38:16:E5:9F:51:4E:B7:1D:5F:1F:C0:84:BB:92:EA:9E:20

ValidityMon, 23 Jun 2025 08:40:16 GMT - Mon, 15 Sep 2025 08:40:15 GMT

HTTP Headers

POST /g/collect?v=2&tid=G-0NQW4X2MPH&gtm=45je57f0h1v894824481za200&_p=1752699026094&_gaz=1&gcd=13l3lPl2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&cid=1052265822.1752699027&ecid=644765140&ul=en-us&sr=1280x1024&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1752699026&sct=1&seg=0&dl=https%3A%2F%2F1xlite-248336.bar%2Fen%2F%2C%20https%3A%2Fcdn.brevo.com%2F%2C%20https%3A%2Fcdn.getyourguide.com%2F%2C%20https%3A%2Fhotstar.com%2F%2C%20https%3A%2Fin.pinterest.com%2F%2C%20https%3A%2Flivetileedge.dsx.mp.microsoft.com%2F%2C%20https%3A%2Fmc.webvisor.org%2F%2C%20https%3A%2Fmf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com%2F%2C%20https%3A%2Fs.lngtdv.com%2F%2C%20https%3A%2Fv3.traincdn.com%2F%2C%20https%3A%2Fwidget.suphelper.top%2F%2C%20https%3A%2Fwww.ssssa.yalla--live.com&dt=404&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.optimize_id=GTM-5R4MT54&upn.ref_id=90&tfd=12579 HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/2 204 No Content
access-control-allow-origin: https://1xlite-248336.bar
date: Wed, 16 Jul 2025 20:50:26 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:158:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:158:0
report-to: {"group":"ascnsrsggc:158:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:158:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/css/92d4fb67.css

185.244.209.62

200 OK

49 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/css/92d4fb67.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (49239), with no line terminators

First Seen2025-07-16

Last Seen2025-07-19

Times Seen13

Size49 kB (49239 bytes)

MD5bd672b8b20b0dd650ccec2edb0a51d86

SHA124a1f44cd655715c7a345bf1b92349a96b1159e1

SHA256391eb8a213b5b1d181e4a5ed2b2dc7455a25a98090953b2be0d59656d3e67c68

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/css/92d4fb67.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/css; charset=utf-8
traceparent: 00-e5a3d172c1766e6fb2cf833291a6119f-87f68a1a782f7c02-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"bd672b8b20b0dd650ccec2edb0a51d86"
x-amz-meta-mtime: 1752647172.096835052
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:21 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50685
cache: HIT
x-cached-since: 2025-07-16T06:45:29+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/cb86e0e498adfa0ddebd6dcd834598b2.json

185.244.209.62

200 OK

7.3 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/cb86e0e498adfa0ddebd6dcd834598b2.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-01-27

Last Seen2025-08-01

Times Seen1273

Size7.3 kB (7321 bytes)

MD50614058b667e6dfa1cdecc6e0e53131c

SHA14f20f88c436fb5cbd82cf1dcfeaa14e52195a369

SHA256be16474b0f19b7536ebdd3d0f8867b151eaa4638411ddb46845f887a5d51a653

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/cb86e0e498adfa0ddebd6dcd834598b2.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
traceparent: 00-ef43db2475932ea9dc08c347cfaadc9a-f8b09909981cd1a5-01
last-modified: Thu, 23 Jan 2025 13:19:49 GMT
etag: W/"0614058b667e6dfa1cdecc6e0e53131c"
content-encoding: gzip
expires: Wed, 14 May 2025 17:14:56 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1015
cache: HIT
x-cached-since: 2025-07-16T20:33:20+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/5e0462ee0df1f6b7eabbf5c452af3b53.json

185.244.209.62

200 OK

1.1 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/5e0462ee0df1f6b7eabbf5c452af3b53.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2023-05-25

Last Seen2025-07-30

Times Seen1689

Size1.1 kB (1085 bytes)

MD5338264fc869e8f0b86b0d6c9d92102b0

SHA183b4d35816df0e1486b766251e74d23f28b77824

SHA256015355a44429f40dd63b566dd1e9b1b76af3dfa28dcd25a43e82820ba0847b8d

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/5e0462ee0df1f6b7eabbf5c452af3b53.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
traceparent: 00-66cc4f58056425a093928f91e15398e6-cb685f80c74a9c81-01
last-modified: Thu, 16 May 2024 19:08:38 GMT
etag: W/"338264fc869e8f0b86b0d6c9d92102b0"
content-encoding: gzip
expires: Tue, 13 May 2025 22:39:23 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_4a1fec5b04.css

185.244.209.62

200 OK

65 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_4a1fec5b04.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text

First Seen2025-07-16

Last Seen2025-07-31

Times Seen24

Size65 B (65 bytes)

MD56c555a60598a81c3b74c1f3da5bc3403

SHA15b7243785a417f7a1755f7d188dcd8b5631c3222

SHA256026efd9a531fce4a8ca4800ebcb678ebec29ca7cf19ea3af913d34303ce224c3

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_4a1fec5b04.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/css; charset=utf-8
content-length: 65
traceparent: 00-e3c134039e521e3664a60add37d49de5-0d8f134533e60b22-01
last-modified: Tue, 15 Jul 2025 14:56:31 GMT
etag: "6c555a60598a81c3b74c1f3da5bc3403"
x-amz-meta-mtime: 1752591202.413501228
expires: Wed, 16 Jul 2025 22:11:34 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 81522
cache: HIT
x-cached-since: 2025-07-15T22:11:34+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/web-api/session

83.147.224.233

204 No Content

0 B

URL

1xlite-248336.bar/web-api/session

IP / ASN

83.147.224.233

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5619500

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /web-api/session HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
content-type: application/json
x-requested-with: XMLHttpRequest
x-app-n: v3-nuxt2
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
server: nginx
date: Wed, 16 Jul 2025 20:50:23 GMT
cache-control: no-cache, private
server-timing: dt_total;dur=0.062, p;dur=14.699, wf-uht;dur=0.025
set-cookie: ua=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
SESSION=1ae57178b6c7f863f8d6db2e88cea16b; path=/; secure; httponly; samesite=lax
x-dt: 672
x-time-ng: 0.015, 0.017
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js

83.147.224.233

200 OK

760 B

URL

1xlite-248336.bar/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js

IP / ASN

83.147.224.233

Resource Info

File typeJavaScript source, ASCII text, with very long lines (759)

First Seen2025-05-21

Last Seen2025-07-24

Times Seen1326

Size760 B (760 bytes)

MD50b911773e0df627d77f8306c86e228aa

SHA10d584bb1a3294e4fe42df4582dcc8a2c8f77f7bb

SHA25601e4926540498a77d866259516007d41fae1213ab9607db826f011d926fd6006

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332; SESSION=1ae57178b6c7f863f8d6db2e88cea16b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:23 GMT
content-type: text/javascript; charset=utf-8
content-length: 492
cache-control: public, max-age=300
content-encoding: gzip
etag: 0b911773e0df627d77f8306c86e228aa
vary: Accept-Encoding
x-dt: 672
x-request-guid: 0e2cb969dce1bd6dd75ed5ddb9a40662
x-time-ng: 0.035
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.009, wf-uht;dur=
accept-ranges: bytes
X-Firefox-Spdy: h2

GET radar.cedexis.com/1707728419/stub.js

45.54.49.5

200 OK

390 B

URL

radar.cedexis.com/1707728419/stub.js

IP / ASN

45.54.49.5

#63911 NetActuate, Inc

Resource Info

File typeJavaScript source, ASCII text

First Seen2024-02-13

Last Seen2025-08-03

Times Seen3409

Size390 B (390 bytes)

MD582dec77fd0353c7c71ce053b8601387e

SHA1fbbca95419e1d0c042e0a5fdf10f380aca66188c

SHA25639f2b7b0fa78d37d0c84d2d6618bd635d86fd683d9bcdd5729850cb2a62522f7

Certificate Info

IssuerDigiCert Inc

Subjectradar.cedexis.com

FingerprintA2:3E:30:19:D5:41:3A:11:81:58:E3:B1:6F:F4:D2:78:0B:44:6F:D0

ValidityFri, 07 Mar 2025 00:00:00 GMT - Fri, 06 Mar 2026 23:59:59 GMT

HTTP Headers

GET /1707728419/stub.js HTTP/1.1
Host: radar.cedexis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 16 Jul 2025 20:50:26 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 12 Feb 2024 09:51:01 GMT
Vary: Accept-Encoding
ETag: W/"65c9ea05-186"
Expires: Wed, 30 Jul 2025 20:50:26 GMT
Cache-Control: max-age=1209600, public
Content-Encoding: gzip

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/css/7fe5f71b.css

185.244.209.62

200 OK

3.3 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/css/7fe5f71b.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (3313), with no line terminators

First Seen2024-05-14

Last Seen2025-08-03

Times Seen2086

Size3.3 kB (3313 bytes)

MD5c610b8710368de3bf2f1c5bb581b6a3a

SHA1f67bc86785d434adb2e81a356a7926b8818ac567

SHA256fad7111846310042401990719146401178f22e2618abf2b058e641b6495e8eba

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/css/7fe5f71b.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/css; charset=utf-8
traceparent: 00-8f0bc5de6e9fbd13bbe0c64de77a7b70-bede19969d630360-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"c610b8710368de3bf2f1c5bb581b6a3a"
x-amz-meta-mtime: 1752647172.096835052
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:28 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50683
cache: HIT
x-cached-since: 2025-07-16T06:45:32+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/site-admin/css_vars/d47c7051b33fd4cf012dd1ba88ca9381.css

185.244.209.62

200 OK

44 B

URL

v3.traincdn.com/genfiles/site-admin/css_vars/d47c7051b33fd4cf012dd1ba88ca9381.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with no line terminators

First Seen2025-07-16

Last Seen2025-07-31

Times Seen22

Size44 B (44 bytes)

MD5d47c7051b33fd4cf012dd1ba88ca9381

SHA1e8f4a550dc1526e29bbf41e19812174061129e0d

SHA256d23ddf603e1bea345e3f913800e533ecea691174a25c9f0a40ea8b6eb17e4c95

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/site-admin/css_vars/d47c7051b33fd4cf012dd1ba88ca9381.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/css
content-length: 44
traceparent: 00-182b54ca022c4bd96d7b5883a1c6ea47-4647366c2f06be47-01
last-modified: Wed, 26 Mar 2025 12:15:55 GMT
etag: "d47c7051b33fd4cf012dd1ba88ca9381"
cache-control: max-age=3600
expires: Wed, 26 Mar 2025 13:56:02 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1945
cache: HIT
x-cached-since: 2025-07-16T20:17:50+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_c29ed659a5.js

185.244.209.62

200 OK

16 kB

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_c29ed659a5.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (16156)

First Seen2025-07-01

Last Seen2025-08-03

Times Seen670

Size16 kB (16157 bytes)

MD5b95f2867a4f69c6f87508d4376778ab8

SHA134b733244053bb0634826b593e14e88782e81680

SHA256f318dcd075506078ef1811c0a12962c5fed8811ee39cc3c77691a81063e05340

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_c29ed659a5.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-958404c668d2d2d01661c955eeb907c9-d93145498ca34c98-01
last-modified: Wed, 16 Jul 2025 11:22:03 GMT
etag: W/"b95f2867a4f69c6f87508d4376778ab8"
x-amz-meta-mtime: 1752664466.449263747
content-encoding: gzip
expires: Thu, 17 Jul 2025 12:33:06 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 29583
cache: HIT
x-cached-since: 2025-07-16T12:37:12+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/__shared_localforage_FJKG5M2E.js

185.244.209.62

200 OK

30 kB

URL

v3.traincdn.com/sys-static/shared-assets/__shared_localforage_FJKG5M2E.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (30255)

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1478

Size30 kB (30277 bytes)

MD502cf95f00794b77df34632e34a59c5be

SHA1b64889fb6cbe78a141688ea761a627997ef8a8af

SHA256bf78b7b3dd6ecbdea04c575edfb6022ed1b2e98c7a9cb9f02ab851ca638f1b83

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/__shared_localforage_FJKG5M2E.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-03fef6367cb2fb7b6fe6b8bfca580b63-7d5c9df141203b3f-01
last-modified: Wed, 16 Jul 2025 07:14:01 GMT
etag: W/"02cf95f00794b77df34632e34a59c5be"
x-amz-meta-mtime: 1752649866.801845347
content-encoding: gzip
expires: Thu, 17 Jul 2025 08:09:30 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44862
cache: HIT
x-cached-since: 2025-07-16T08:22:34+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2cc79f22e4.js

185.244.209.62

200 OK

12 kB

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2cc79f22e4.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (12171)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size12 kB (12172 bytes)

MD582881e99bdb13905b30023566562b455

SHA1c18b7d4527b7d23b6e7d9095afcb080cfbfdce2a

SHA256de3fe791874e61ab280ca345f3ff4c5fbb71b2c9bfa1f49110debe1fa88418b4

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2cc79f22e4.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-4be07e0896215a10e725db696a885ca0-1e2dbdf8cae433b5-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: W/"82881e99bdb13905b30023566562b455"
x-amz-meta-mtime: 1752653608.299525903
content-encoding: gzip
expires: Thu, 17 Jul 2025 10:17:24 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 37972
cache: HIT
x-cached-since: 2025-07-16T10:17:24+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/11e0b2a630f39d2f2be0cd277b373e8d.json

185.244.209.62

200 OK

328 B

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/11e0b2a630f39d2f2be0cd277b373e8d.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-02-27

Last Seen2025-07-30

Times Seen1637

Size328 B (328 bytes)

MD54347fc050ebe622e30a7bf78a213b5a0

SHA1c05b3b571980b01ff9f07e6adc1c29c58be70bd1

SHA256ed1b1193a248bf273141c31b7f74dd1224416b3757e5a71f2e7d579c50d65d57

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/11e0b2a630f39d2f2be0cd277b373e8d.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
content-length: 328
traceparent: 00-e115b5f988c0dddc2e92bb0d44bac359-1e6c6c1f36e4925b-01
last-modified: Thu, 27 Feb 2025 10:54:18 GMT
etag: "4347fc050ebe622e30a7bf78a213b5a0"
expires: Tue, 13 May 2025 22:39:23 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_037e7ae64c.js

185.244.209.62

200 OK

988 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_037e7ae64c.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJava source, ASCII text, with very long lines (987)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size988 B (988 bytes)

MD5c125f0a7d824ba12473c9b3afc2aa261

SHA1906eb5b740f2bc4bf1c7d833990c74be3ef3f39c

SHA256e6d1f4330c0505336b37abd6cd00876ecfc9448d8573cd3c153c752b5e0753fa

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_037e7ae64c.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
content-length: 988
traceparent: 00-7aa60f5731d986642d773c22d302e339-a689aeced93f7129-01
last-modified: Wed, 16 Jul 2025 09:21:29 GMT
etag: "c125f0a7d824ba12473c9b3afc2aa261"
x-amz-meta-mtime: 1752657522.667328247
expires: Thu, 17 Jul 2025 11:20:16 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 33910
cache: HIT
x-cached-since: 2025-07-16T11:25:06+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2

185.244.209.62

200 OK

64 kB

URL

v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 63748, version 1.0

First Seen2023-06-14

Last Seen2025-08-03

Times Seen5357

Size64 kB (63748 bytes)

MD56887b6f24414dbc612dbf42ccdc76b70

SHA18068d3abfbc6cbf35b55919da45b1f4d2d136238

SHA256fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:25 GMT
content-type: font/woff2
content-length: 63748
traceparent: 00-ccd34319a6cf2548f8d52305960bd27b-0c5c38b02da2c23a-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "6887b6f24414dbc612dbf42ccdc76b70"
expires: Thu, 16 Jan 2025 10:32:14 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1043
cache: HIT
x-cached-since: 2025-07-16T20:33:02+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/app-b97c4b18.js

185.244.209.62

200 OK

805 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/app-b97c4b18.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (64877)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size805 kB (805156 bytes)

MD5a355d23ded8f16c0ebf2ac895e502769

SHA14843ea749665a5e526e9fd3fb3f9423ae7b2cf3f

SHA2567ac4976ada69f3f7cbb845c42dd502d6fc634f8adec820889a155ef8ac3c80ce

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/vendors/app-b97c4b18.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-99ce1ab6e5831f01b84e3262b62aba26-6f135e10ab986308-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"a355d23ded8f16c0ebf2ac895e502769"
x-amz-meta-mtime: 1752647172.112835105
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:26 GMT
cache-control: max-age=86400
x-time-ng: 0.006
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50685
cache: HIT
x-cached-since: 2025-07-16T06:45:30+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_base-app_6f8fb0c3ba.js

185.244.209.62

200 OK

1.4 MB

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_base-app_6f8fb0c3ba.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (23471)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size1.4 MB (1391731 bytes)

MD5528f735e080f8c6c18d700833b201866

SHA18e017483120f47e36057edaeee216c6137c94321

SHA2560a6f6f8ee222cba4b49ba971444f3207abd8f726c75ae551feabbd508e4eeeb0

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_base-app_6f8fb0c3ba.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-eb220c0a86262467e0521a220692199f-08fe3a9d89c39281-01
last-modified: Wed, 16 Jul 2025 10:37:35 GMT
etag: W/"528f735e080f8c6c18d700833b201866"
x-amz-meta-mtime: 1752662200.933195801
content-encoding: gzip
expires: Thu, 17 Jul 2025 11:20:14 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 33912
cache: HIT
x-cached-since: 2025-07-16T11:25:03+00:00
X-Firefox-Spdy: h2

GET radar.cedexis.com/1/23802/radar.js

45.54.49.5

302 Moved Temporarily

390 B

URL

radar.cedexis.com/1/23802/radar.js

IP / ASN

45.54.49.5

#63911 NetActuate, Inc

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5619500

Size390 B (390 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerDigiCert Inc

Subjectradar.cedexis.com

FingerprintA2:3E:30:19:D5:41:3A:11:81:58:E3:B1:6F:F4:D2:78:0B:44:6F:D0

ValidityFri, 07 Mar 2025 00:00:00 GMT - Fri, 06 Mar 2026 23:59:59 GMT

HTTP Headers

GET /1/23802/radar.js HTTP/1.1
Host: radar.cedexis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Wed, 16 Jul 2025 20:50:26 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: /1707728419/stub.js
Expires: Wed, 16 Jul 2025 21:00:26 GMT
Cache-Control: max-age=600
Vary: User-Agent,DNT

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/a98e439f12.css

185.244.209.62

200 OK

10 kB

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/a98e439f12.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (10453)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size10 kB (10454 bytes)

MD5884907bedaf8cd01a4c5fd5988db2c01

SHA14a57593d548010f764b25be846660a71626db70d

SHA256023215937502ab28a5b2f0a6f6ad0e887e467b6c39425919e483ac0ba535ec20

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/a98e439f12.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/css; charset=utf-8
traceparent: 00-5a1486bcd403a538bc5d3098fceafeed-3df514ee0524d61a-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: W/"884907bedaf8cd01a4c5fd5988db2c01"
x-amz-meta-mtime: 1752653608.30352599
content-encoding: gzip
expires: Thu, 17 Jul 2025 19:51:49 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3507
cache: HIT
x-cached-since: 2025-07-16T19:51:49+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2b6bc77c22.js

185.244.209.62

200 OK

1.5 kB

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2b6bc77c22.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (1463)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen14

Size1.5 kB (1464 bytes)

MD56111b84894a9374e4509b51adeb41c3a

SHA10c446813c598998a630078a25213d82d200317cb

SHA2565a1746cd52bc1a85ae15cc12a9e1bb32ad14cb7609332266b1a08635d2529b6c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/2b6bc77c22.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-2edc5d994667bbbca6eb8e68799aab69-f16e4811fb6f24cd-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: W/"6111b84894a9374e4509b51adeb41c3a"
x-amz-meta-mtime: 1752653608.298525882
content-encoding: gzip
expires: Thu, 17 Jul 2025 08:24:01 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44601
cache: HIT
x-cached-since: 2025-07-16T08:26:55+00:00
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json

83.147.224.233

200 OK

2 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2023-03-08

Last Seen2025-08-03

Times Seen76375

Size2 B (2 bytes)

MD5d751713988987e9331980363e24189ce

SHA197d170e1550eee4afc0af065b78cda302a97674c

SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 20
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1920; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
content-length: 2
x-dt: 672
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.007, wf-uht;dur=0.008
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_624b6327cc.css

185.244.209.62

200 OK

459 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_624b6327cc.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (458)

First Seen2025-07-16

Last Seen2025-07-31

Times Seen24

Size459 B (459 bytes)

MD505aa19e779bc600e74fb1aac91032f71

SHA1b86ce19b111dec58e6413823c06f705e9f50e584

SHA256db4ec21cdc86c51b1ef5ef2d2d7c85588fafceff1315b3ce5b02e3a492fce187

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_624b6327cc.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/css; charset=utf-8
content-length: 459
traceparent: 00-bbc309bed4f4841f7f2b81796e97938f-a4c4d01bfec68d37-01
last-modified: Wed, 16 Jul 2025 12:03:01 GMT
etag: "05aa19e779bc600e74fb1aac91032f71"
x-amz-meta-mtime: 1752667215.927018338
expires: Thu, 17 Jul 2025 13:32:03 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 26214
cache: HIT
x-cached-since: 2025-07-16T13:33:22+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/analytics-371708e9.js

185.244.209.62

200 OK

7.1 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/analytics-371708e9.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (7104), with no line terminators

First Seen2025-07-16

Last Seen2025-07-23

Times Seen16

Size7.1 kB (7104 bytes)

MD53597af95296326bbaea7a2271c9be084

SHA1a4f045b26628538535bad8b3fb0a742126f5539b

SHA256cc03433167c941d67ce43a469a7297ccb6fb03a1f4fae8b774d2a6c58a076dce

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/analytics-371708e9.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:25 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-7cac41350376c687d4be1459e91f9d94-5907f1111c8fd322-01
last-modified: Wed, 16 Jul 2025 06:26:13 GMT
etag: W/"3597af95296326bbaea7a2271c9be084"
x-amz-meta-mtime: 1752647172.092835039
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:29 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50692
cache: HIT
x-cached-since: 2025-07-16T06:45:33+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_css_617b7a.css

185.244.209.62

200 OK

6.8 kB

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_css_617b7a.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (2263)

First Seen2025-07-16

Last Seen2025-07-31

Times Seen24

Size6.8 kB (6784 bytes)

MD51120fa19512b1999a0156b687f6044bb

SHA173b486a7f3d0eaf5f831993b23b6d8ea958fa934

SHA256617b7a044b077532b81258dd93e4e0b3d05a0eb9cac97be332968e4e2b996b49

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_css_617b7a.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/css; charset=utf-8
traceparent: 00-876b7d12f9b38bbc86601425a744cd37-b84a653854ac53a3-01
last-modified: Wed, 16 Jul 2025 06:35:48 GMT
etag: W/"1120fa19512b1999a0156b687f6044bb"
x-amz-meta-mtime: 1752647277.583015242
content-encoding: gzip
expires: Thu, 17 Jul 2025 08:31:40 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44177
cache: HIT
x-cached-since: 2025-07-16T08:33:57+00:00
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/seo-module-api/api/public/v1/analytics-counters?project[id]=672&domain[host]=1xlite-248336.bar

83.147.224.233

200 OK

72 B

URL

1xlite-248336.bar/seo-module-api/api/public/v1/analytics-counters?project[id]=672&domain[host]=1xlite-248336.bar

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-26

Times Seen4

Size72 B (72 bytes)

MD56485a91ecc0519fee4d3c8d053ae7fb6

SHA1c4a78ae7cb1d524517716c5f090e985aa384bfea

SHA256a0f357c2a33d2515ba70f5877446cf6d70722d7b60be5fa08f058752122c375d

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /seo-module-api/api/public/v1/analytics-counters?project[id]=672&domain[host]=1xlite-248336.bar HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
content-type: application/json
x-requested-with: XMLHttpRequest
x-app-n: v3-nuxt2
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1920
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
content-length: 76
cache-control: max-age=1200, must-revalidate, public, s-maxage=1800, stale-if-error=86400, stale-while-revalidate=300
x-content-digest: en861826557d7793858ab5c22f649e1432
age: 872
x-request-id: 529b3001ed41b04997869c36bc2efd06
x-request-guid: 529b3001ed41b04997869c36bc2efd06
content-encoding: br
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: p;dur=1.2350082397461, wf-uht;dur=
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/desktop/media_asset/8ab99a2d438dfb45bf30e1f1bdb48745.png

185.244.209.62

200 OK

212 kB

URL

v3.traincdn.com/genfiles/cms/desktop/media_asset/8ab99a2d438dfb45bf30e1f1bdb48745.png

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typePNG image data, 7336 x 587, 8-bit colormap, non-interlaced

First Seen2023-05-02

Last Seen2025-07-16

Times Seen26

Size212 kB (212062 bytes)

MD58270a8ed37510c1d081ca47895bed81f

SHA1a88857250443b9b93e41a1fbdc46017737db5a72

SHA25670d2d3a884d1588eb40e4066fa2c4362194b48c4b805ec75fb963bcdeabf24da

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/desktop/media_asset/8ab99a2d438dfb45bf30e1f1bdb48745.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: image/png
content-length: 212062
traceparent: 00-3b890a53858e16ecc59559a46596e968-37b231105f185255-01
last-modified: Tue, 11 Apr 2023 22:46:45 GMT
etag: "8270a8ed37510c1d081ca47895bed81f"
expires: Wed, 28 May 2025 16:19:24 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/system/pixel.png

185.244.209.62

200 OK

68 B

URL

v3.traincdn.com/genfiles/cms/1/desktop/system/pixel.png

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typePNG image data, 1 x 1, 8-bit gray+alpha, non-interlaced

First Seen2023-04-05

Last Seen2025-08-03

Times Seen17384

Size68 B (68 bytes)

MD591e42db1c66c0b276abf6234dc50b2eb

SHA1c1986af3c26609b8b7d8933f99c51c1a89e9ea6b

SHA25663ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/system/pixel.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: image/png
content-length: 68
traceparent: 00-90544f93316871ab5a717f63c6ff6272-ae0fce730ba309b8-01
last-modified: Tue, 11 Apr 2023 18:21:02 GMT
etag: "91e42db1c66c0b276abf6234dc50b2eb"
expires: Thu, 16 Jan 2025 10:49:40 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1547
cache: HIT
x-cached-since: 2025-07-16T20:24:29+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/desktop/media_asset/48040dd743f2018824dbb5fcef4c9ef4.png

185.244.209.62

200 OK

79 kB

URL

v3.traincdn.com/genfiles/cms/desktop/media_asset/48040dd743f2018824dbb5fcef4c9ef4.png

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typePNG image data, 739 x 687, 8-bit/color RGBA, non-interlaced

First Seen2023-05-02

Last Seen2025-07-16

Times Seen26

Size79 kB (78710 bytes)

MD50ecd34213f0d5c445cb14d6f8d2dd7ed

SHA1aadbec956b67f7247b08c7fbfdb3e9625bd6bc00

SHA25698c1b640475c09dbed13ae6ea5772634ce5d889d3f0ec97701f21bcd7e772541

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/desktop/media_asset/48040dd743f2018824dbb5fcef4c9ef4.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: image/png
content-length: 78710
traceparent: 00-5fcaee8ce8351e10493eff6d7c802f24-536a80120237ee64-01
last-modified: Tue, 11 Apr 2023 22:46:24 GMT
etag: "0ecd34213f0d5c445cb14d6f8d2dd7ed"
expires: Wed, 30 Apr 2025 13:59:12 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/desktop/media_asset/ca7f65f7dcbb491d2b43580376be9fbd.png

185.244.209.62

200 OK

7.1 kB

URL

v3.traincdn.com/genfiles/cms/desktop/media_asset/ca7f65f7dcbb491d2b43580376be9fbd.png

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typePNG image data, 151 x 127, 8-bit/color RGBA, non-interlaced

First Seen2023-07-06

Last Seen2025-07-16

Times Seen47

Size7.1 kB (7117 bytes)

MD5c787e7341df0df614cfe4fc2a7f0a49b

SHA170359b3425c605fe2b222db41c9a194df3430842

SHA256f67aae745fb9e241762f57137a407c8b086a222234242c47aa116e92561def72

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/desktop/media_asset/ca7f65f7dcbb491d2b43580376be9fbd.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: image/png
content-length: 7117
traceparent: 00-1449660f2ac8a7205cb18b7516f84895-5f25fa6e4bd8628d-01
last-modified: Tue, 11 Apr 2023 22:47:06 GMT
etag: "c787e7341df0df614cfe4fc2a7f0a49b"
expires: Wed, 18 Jun 2025 11:18:43 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Righteous/Righteous-Regular.woff2

185.244.209.62

200 OK

16 kB

URL

v3.traincdn.com/genfiles/cms/1/desktop/fonts/Righteous/Righteous-Regular.woff2

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 16396, version 1.0

First Seen2023-07-06

Last Seen2025-07-16

Times Seen209

Size16 kB (16396 bytes)

MD573d3ebdb115ad0d3667c95a7b020cb26

SHA1bd248ccd66ad99da5c29c927190bb426a15e302d

SHA2566665b881b3735fc4e7b515b9ea85c87604fa9ee85c53f43c757bc45bb27aa79c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/fonts/Righteous/Righteous-Regular.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: font/woff2
content-length: 16396
traceparent: 00-66b0145bee15b8aa4d086037382eb178-e325395b2c53a271-01
last-modified: Wed, 14 Jun 2023 09:49:15 GMT
etag: "73d3ebdb115ad0d3667c95a7b020cb26"
expires: Wed, 16 Jul 2025 20:11:55 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 2224
cache: HIT
x-cached-since: 2025-07-16T20:13:12+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_dc8f5562a3.js

185.244.209.62

200 OK

918 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_dc8f5562a3.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJava source, ASCII text, with very long lines (917)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size918 B (918 bytes)

MD5b006c84a572ea171849e59ee8e2a6cef

SHA11e96a6887544d808c9bd793cd950ac3898b30c7f

SHA2568353695425f0a3e552dbc8b25e0011a307c0cb95533c4f323894565317b2a5ae

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_dc8f5562a3.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
content-length: 918
traceparent: 00-f503f72d25f62d000cf0b5192c7ddc2f-8bc021e412b0495b-01
last-modified: Wed, 16 Jul 2025 09:21:29 GMT
etag: "b006c84a572ea171849e59ee8e2a6cef"
x-amz-meta-mtime: 1752657522.684329604
expires: Thu, 17 Jul 2025 11:20:16 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 33910
cache: HIT
x-cached-since: 2025-07-16T11:25:06+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-notification-38652366.js

185.244.209.62

200 OK

13 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-notification-38652366.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (12563), with no line terminators

First Seen2025-07-16

Last Seen2025-07-23

Times Seen16

Size13 kB (12563 bytes)

MD5dbac73425b7edc69c86c1f84db58c00a

SHA120600863d4a31f34435c40a1a6872b32261f713b

SHA256044eca4e831dbfed4331761134e0e2f6a3e453c7e410ba54fac446b55d49aa53

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/vendors/plugins.vue-notification-38652366.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-26e27791b3f041ffef0ee5f382087587-eb8bdaeeb075e967-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"dbac73425b7edc69c86c1f84db58c00a"
x-amz-meta-mtime: 1752647172.112835105
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:28 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50683
cache: HIT
x-cached-since: 2025-07-16T06:45:32+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/__shared_chunk_7HDOEZTP.js

185.244.209.62

200 OK

1.2 kB

URL

v3.traincdn.com/sys-static/shared-assets/__shared_chunk_7HDOEZTP.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (1193)

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1478

Size1.2 kB (1194 bytes)

MD57e76c08e7f16815131a5f13a10c1efba

SHA15f800877b78a0713157fe119bc1a2d9a260f72e1

SHA256c6f29a0c7c3ed884ccffd7a529fd2fc599e2da1f31af658146f0e36a3f4c00dc

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/__shared_chunk_7HDOEZTP.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-151c8cf1990c2aca90b5ea504896e1d9-3a4500352062b89c-01
last-modified: Wed, 16 Jul 2025 07:41:14 GMT
etag: W/"7e76c08e7f16815131a5f13a10c1efba"
x-amz-meta-mtime: 1752651429.275921819
content-encoding: gzip
expires: Thu, 17 Jul 2025 08:22:34 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44861
cache: HIT
x-cached-since: 2025-07-16T08:22:34+00:00
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

83.147.224.233

200 OK

23 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size23 B (23 bytes)

MD5907f8da37850ff26f96169f71dc5eebb

SHA1f6c71a97fae55bc99b4a04ff9a73341031bf367d

SHA256ccd34618f415ddb1efcf056cfda5dc4e0d2d504f8ac849acdc2aa6f4557f243d

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 89
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
content-length: 23
x-dt: 672
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.033, wf-uht;dur=0.010
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/checker/redirect/stat/run/

83.147.224.233

200 OK

14 B

URL

1xlite-248336.bar/checker/redirect/stat/run/

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2023-04-05

Last Seen2025-08-01

Times Seen2040

Size14 B (14 bytes)

MD52de0d0acfd684235f066bd0ec0c9e3df

SHA168d0cb64805a42d7e40f43e8e198986b43dd6b69

SHA2569682f312f23e078bb135f23ea5a178b178e75c02d33672f20044d18c6d258928

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /checker/redirect/stat/run/ HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
content-type: application/json
x-requested-with: XMLHttpRequest
x-app-n: v3-nuxt2
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
content-length: 14
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=0.010
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png

185.244.209.62

200 OK

5.2 kB

URL

v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typePNG image data, 514 x 514, 8-bit colormap, non-interlaced

First Seen2023-11-17

Last Seen2025-08-03

Times Seen2578

Size5.2 kB (5202 bytes)

MD5b9a636eef54b2844b571fe7de49184a7

SHA1bf653690790ced40eb3189da075a275d951d1607

SHA256001bfcdd52b658d46543a1aec889d35b73b3909b47097cc011b95e96fc9e3743

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: image/png
content-length: 5202
traceparent: 00-08e900978873d0e19165753b7f648fb6-37551cecc30bd7cd-01
last-modified: Wed, 26 Jun 2024 08:22:59 GMT
etag: "b9a636eef54b2844b571fe7de49184a7"
expires: Tue, 15 Jul 2025 16:37:32 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:58+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/65e47f9e2b.js

185.244.209.62

200 OK

147 B

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/65e47f9e2b.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJava source, ASCII text

First Seen2025-07-16

Last Seen2025-07-21

Times Seen14

Size147 B (147 bytes)

MD53460eb1763f2feb21759ecf6a24212ad

SHA146f13c27af7ac7b24418a7b1a8140f5fd546ce74

SHA25625b4a8dfeec5fa33cd12d65782388ab03697d0c55e444af2591c600bbd8764da

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/65e47f9e2b.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
content-length: 147
traceparent: 00-07e4d0d4cd1f1e1ac9d0e50d8af07f0a-d425260456b2f3c1-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: "3460eb1763f2feb21759ecf6a24212ad"
x-amz-meta-mtime: 1752653608.30352599
expires: Thu, 17 Jul 2025 19:11:09 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 5947
cache: HIT
x-cached-since: 2025-07-16T19:11:09+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

83.147.224.233

200 OK

23 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size23 B (23 bytes)

MD5e12a8273d9c402ea071a9d63038812b5

SHA10bd4e473f561ac2565b9c2b6383aba8d708cb442

SHA2569ca0f0976beb756f0b255dd56f7645709a5ffbc1a90e42eea769af05b5597bc1

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 430
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
content-length: 23
x-dt: 672
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.004, wf-uht;dur=0.012
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/hd-api/external/01981500-b28a-7bb9-80fb-a41cc8f30972.js

83.147.224.233

200 OK

305 kB

URL

1xlite-248336.bar/hd-api/external/01981500-b28a-7bb9-80fb-a41cc8f30972.js

IP / ASN

83.147.224.233

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size305 kB (305145 bytes)

MD5168f4e0e685071e8fb56fb2e53245148

SHA118f8a92d2916872a0e8a45ee34f04fd62042cc86

SHA25635128b0145513aea0698760ad46f552fbbfb30f0f8fda6b92ff56e751d60f800

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /hd-api/external/01981500-b28a-7bb9-80fb-a41cc8f30972.js HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332; SESSION=1ae57178b6c7f863f8d6db2e88cea16b
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:24 GMT
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=0, must-revalidate
content-encoding: gzip
vary: Accept-Encoding
x-dt: 672
x-hd-trace-id: ed70b941-26fa-400e-a021-717b656e6180
x-request-guid: 4d994b67633af71cafec467d0b5e2d72
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.012, wf-uht;dur=0.014
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/css/57497467.css

185.244.209.62

200 OK

13 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/css/57497467.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (12921), with no line terminators

First Seen2025-07-16

Last Seen2025-07-31

Times Seen24

Size13 kB (12921 bytes)

MD5ac738e84f03ed07de314ec5ddc3d24d0

SHA13d90a7f89d2955c75ae5b86cc75719c6940f7831

SHA25644e3d8e45e71f263f0a3706131357084bac9faf0aa20e0f55a134e20809cc57c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/css/57497467.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/css; charset=utf-8
traceparent: 00-bf3fe1315ee078b6c20b8de217e59203-ef3d72b8af969ff8-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"ac738e84f03ed07de314ec5ddc3d24d0"
x-amz-meta-mtime: 1752647172.096835052
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:20 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50686
cache: HIT
x-cached-since: 2025-07-16T06:45:28+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/runtime-ac7ca5a7.js

185.244.209.62

200 OK

19 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/runtime-ac7ca5a7.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (18840), with no line terminators

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size19 kB (18840 bytes)

MD5051e48afee482a12fa6fbeddd50df126

SHA1709f18f26f7181cc24626e77fe844fb43eae57d7

SHA256cc580836a4030758c06d690fb3f3d42bfbb46ec5b921fb6dfbe5e2c56ff7a68c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/runtime-ac7ca5a7.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-2c3a2fe6e7050a2c4fe72b8829fc6db2-d220a7a8ac2be1fa-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"051e48afee482a12fa6fbeddd50df126"
x-amz-meta-mtime: 1752647172.108835091
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:27 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50686
cache: HIT
x-cached-since: 2025-07-16T06:45:29+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_9a042c387f.js

185.244.209.62

200 OK

1.1 kB

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_9a042c387f.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJava source, ASCII text, with very long lines (1085)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size1.1 kB (1086 bytes)

MD5151e9c94f88543e420df7057f24cf740

SHA11c5ca46913db9eb7db938c634de722655a8f7a21

SHA2567cc3f3502895d9a5656b3904d6a193be27835e85f23d6c9c5a8ae7b5e1f5b613

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_9a042c387f.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-42a1770ceec222c43f0098d85990ebf6-d91128c0c78bd921-01
last-modified: Wed, 16 Jul 2025 06:35:48 GMT
etag: W/"151e9c94f88543e420df7057f24cf740"
x-amz-meta-mtime: 1752647277.567015079
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:46:29 GMT
cache-control: max-age=86400
x-time-ng: 0.006
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50443
cache: HIT
x-cached-since: 2025-07-16T06:49:33+00:00
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/vision.json

83.147.224.233

204 No Content

0 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/vision.json

IP / ASN

83.147.224.233

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5619500

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/vision.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
x-dt: 672
x-rejected: E001
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.007, wf-uht;dur=0.008
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js

185.244.209.62

200 OK

19 kB

URL

v3.traincdn.com/sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (19034)

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1478

Size19 kB (19175 bytes)

MD51580a3cfe81fd30910a49dfe64cc8e7b

SHA1314144dc49595482ba46c0b85b38d5f73ef73a7b

SHA2568989a021d20f0fc08c43966a287cbd99e43142a5a0ff42eb232756a101de6035

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/__shared_vue_deps_DYMTJONH.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-a3139e20ed77f80ad90a6a7c801d3cbb-543bc83d89984ca1-01
last-modified: Tue, 15 Jul 2025 14:56:29 GMT
etag: W/"1580a3cfe81fd30910a49dfe64cc8e7b"
x-amz-meta-mtime: 1752591202.432502742
content-encoding: gzip
expires: Thu, 17 Jul 2025 01:21:43 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 70113
cache: HIT
x-cached-since: 2025-07-16T01:21:43+00:00
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json

83.147.224.233

200 OK

2 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2023-03-08

Last Seen2025-08-03

Times Seen76375

Size2 B (2 bytes)

MD5d751713988987e9331980363e24189ce

SHA197d170e1550eee4afc0af065b78cda302a97674c

SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 20
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
content-length: 2
x-dt: 672
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.005, wf-uht;dur=0.011
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_ba51a94dd9d7f576cd5558461aad4ad6.json

185.244.209.62

200 OK

140 kB

URL

v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_ba51a94dd9d7f576cd5558461aad4ad6.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-17

Times Seen21

Size140 kB (139502 bytes)

MD53697356d6ed43be8b106bc69a6a6320c

SHA1b5c733dc9bdb21cb04621a83d84e8bbb527dc156

SHA256d228b4c0d0186628e30d3c318171796c67dca72fa6c14060715ec6b9ed285a00

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_ba51a94dd9d7f576cd5558461aad4ad6.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json; charset=utf-8
traceparent: 00-f2e51fe4f24ee743a4c05874e32c9b28-183b6a303bcb9d7e-01
last-modified: Wed, 16 Jul 2025 16:06:52 GMT
etag: W/"3697356d6ed43be8b106bc69a6a6320c"
cache-control: max-age=3600
content-encoding: gzip
expires: Wed, 16 Jul 2025 18:27:37 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 478
cache: HIT
x-cached-since: 2025-07-16T20:42:17+00:00
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

83.147.224.233

200 OK

23 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size23 B (23 bytes)

MD5eb60e510feb57dac84a4ba7bbc6b32a8

SHA1a01f1c786580a04e0fd55854c71d78d5de7ba30c

SHA25670b04a132fa981d250b9a15939121523bdd5c155f32ec7ff8505ceb6da29e229

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 99
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1920
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
content-length: 23
x-dt: 672
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.111, wf-uht;dur=0.011
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/desktop/media_asset/ca7f65f7dcbb491d2b43580376be9fbd.webp

185.244.209.62

200 OK

2.1 kB

URL

v3.traincdn.com/genfiles/cms/desktop/media_asset/ca7f65f7dcbb491d2b43580376be9fbd.webp

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeRIFF (little-endian) data, Web/P image

First Seen2025-07-14

Last Seen2025-07-16

Times Seen4

Size2.1 kB (2130 bytes)

MD55ca031e8129373730e9b053bd0b8199a

SHA1877ef981f58f35ab5d71dfac61547cd210a17441

SHA25686c4518bb9a0ea04794c6ea4d723f9590f522847e3cbc039d3598dfe29752227

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/desktop/media_asset/ca7f65f7dcbb491d2b43580376be9fbd.webp HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: image/webp
content-length: 2130
traceparent: 00-d4b2ee006fc7e80a89825ae89566edd0-bc3a8a7bab0891a4-01
last-modified: Wed, 08 May 2024 12:13:59 GMT
etag: "5ca031e8129373730e9b053bd0b8199a"
expires: Thu, 16 Jan 2025 11:04:20 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/bff-api/config/menu.json?modules=errorMenu

83.147.224.233

200 OK

1.6 kB

URL

1xlite-248336.bar/bff-api/config/menu.json?modules=errorMenu

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size1.6 kB (1573 bytes)

MD5804e32c37d5ddbc1bf80efab43859eeb

SHA1d6f52f883aa1e8aaeec80fe6f82d3a47f4d95822

SHA256c4e1a1115192fdb51c497b431a9ba487043c229e562ee2db340c37dbcded8aed

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bff-api/config/menu.json?modules=errorMenu HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
content-type: application/json
x-requested-with: XMLHttpRequest
is-srv: false
x-svc-source: __TECHNICAL_PAGES_APP__
x-app-n: __TECHNICAL_PAGES_APP__
x-geoip2-country-code: ru
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
cache-control: no-cache, private
content-encoding: br
server-timing: dt_total;dur=0.010, bff;dur=1.02, wf-uht;dur=0.014
vary: Accept-Encoding
x-cache-expire: 883
x-cache-hit: 1
x-dt: 672
x-pod: R-zblgl
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2

185.244.209.62

200 OK

64 kB

URL

v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 63920, version 1.0

First Seen2023-05-07

Last Seen2025-08-03

Times Seen5267

Size64 kB (63920 bytes)

MD5a65527fcb58f66a7cfbc0e6b160538b4

SHA145d260e7fa343401b5bb0df982a014f53e2d253b

SHA256fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: font/woff2
content-length: 63920
traceparent: 00-05096e6573a5de5d4961aae7ff742f5e-b80826f416bf7863-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "a65527fcb58f66a7cfbc0e6b160538b4"
expires: Wed, 16 Jul 2025 19:36:40 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 2310
cache: HIT
x-cached-since: 2025-07-16T20:11:46+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-ui/3.3.300/Mobile/Default/merged.css

185.244.209.62

200 OK

605 kB

URL

v3.traincdn.com/sys-ui/3.3.300/Mobile/Default/merged.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size605 kB (604922 bytes)

MD57d8158fb479fc92836aebc912360b8bc

SHA1dc6437062694a864c9c8ac830fbcff9294b00b31

SHA2566fbb84b2001c8e20c88dec653cc45dbaf5917a5de974e9996419f6614136da28

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-ui/3.3.300/Mobile/Default/merged.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/css; charset=utf-8
traceparent: 00-af08205c546450e4580e99241965eab8-2924a7677e3b3a6a-01
last-modified: Tue, 15 Jul 2025 13:10:05 GMT
etag: W/"7d8158fb479fc92836aebc912360b8bc"
x-amz-meta-mtime: 1752584991.4548277
content-encoding: gzip
expires: Wed, 16 Jul 2025 13:16:08 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 27113
cache: HIT
x-cached-since: 2025-07-16T13:18:21+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/commons/app-7355368e.js

185.244.209.62

200 OK

138 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/commons/app-7355368e.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65476)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size138 kB (137774 bytes)

MD5ad01c020d5875aa2ef7b446a018775a8

SHA1f82e42d6d1b107aaf65e6f6a6918818370912450

SHA256601411e27033123ba941805129209c8a9cf61951c61705a8cc314b0db1802b85

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/commons/app-7355368e.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-33ea76034e179042a4b0f14105856494-2255c45d42957c6a-01
last-modified: Wed, 16 Jul 2025 06:26:14 GMT
etag: W/"ad01c020d5875aa2ef7b446a018775a8"
x-amz-meta-mtime: 1752647172.092835039
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:26 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50686
cache: HIT
x-cached-since: 2025-07-16T06:45:29+00:00
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/hd-api/external/verify

83.147.224.233

200 OK

742 B

URL

1xlite-248336.bar/hd-api/external/verify

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size742 B (742 bytes)

MD5d39b5ce0b545c8868f8628c974edeca9

SHA1e80af5100df378cb34a2feba97b0ba8a470e1163

SHA256d1752de269c44192f04e56b92d40568ef9ab08ba3b8b1cbd44455748708fe172

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /hd-api/external/verify HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: text/plain;charset=UTF-8
Content-Length: 108905
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332; SESSION=1ae57178b6c7f863f8d6db2e88cea16b
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:26 GMT
content-type: application/json
content-length: 608
content-encoding: gzip
vary: Accept-Encoding
x-dt: 672
x-request-guid: d449a1b0a27e567a6c5405f8c336eb84
x-time-ng: 0.016
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.010, wf-uht;dur=0.052
X-Firefox-Spdy: h2

GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-0NQW4X2MPH&cid=1052265822.1752699027&gtm=45je57f0h1v894824481za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&z=391506944

142.250.74.131

200 OK

42 B

URL

www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-0NQW4X2MPH&cid=1052265822.1752699027&gtm=45je57f0h1v894824481za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&z=391506944

IP / ASN

142.250.74.131

#15169 GOOGLE

Resource Info

File typeGIF image data, version 89a, 1 x 1

First Seen2023-04-05

Last Seen2025-08-03

Times Seen320930

Size42 B (42 bytes)

MD5d89746888da2d9510b64a9f031eaecd5

SHA1d5fceb6532643d0d84ffe09c40c481ecdf59e15a

SHA256ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Certificate Info

IssuerGoogle Trust Services

Subject*.google.no

FingerprintA8:B1:20:9F:85:E5:F5:7D:94:F3:52:D0:EF:BC:D2:DB:A6:FA:8F:4F

ValidityMon, 23 Jun 2025 08:43:14 GMT - Mon, 15 Sep 2025 08:43:13 GMT

HTTP Headers

GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-0NQW4X2MPH&cid=1052265822.1752699027&gtm=45je57f0h1v894824481za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3lPl2l1l1&npa=1&frm=0&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&tag_exp=101509157~102015666~103116026~103200004~103233427~103351869~103351871~104684208~104684211~104732253~104732255~104908321~104908323&z=391506944 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 16 Jul 2025 20:50:26 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/captcha-api/assets/hunt-captcha.js

83.147.224.233

200 OK

87 kB

URL

1xlite-248336.bar/captcha-api/assets/hunt-captcha.js

IP / ASN

83.147.224.233

Resource Info

File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators

First Seen2025-07-16

Last Seen2025-07-21

Times Seen151

Size87 kB (86579 bytes)

MD5463ec5b64c24135eb67e671110b5d44b

SHA1a7bd6aa5fc80405ffcb6d9e5ad1c51590e00ef7c

SHA256117405693cdc1b81d14087d8fd50ecb1709a19fb6d7adb936ef31d7e8f6ab3c7

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /captcha-api/assets/hunt-captcha.js HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332; SESSION=1ae57178b6c7f863f8d6db2e88cea16b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:23 GMT
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=300
content-encoding: br
vary: Accept-Encoding
x-dt: 672
x-request-id: 6a6df4135af37e9fb52d3cd2effcb00e
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.006, wf-uht;dur=
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

83.147.224.233

200 OK

23 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size23 B (23 bytes)

MD513aa4a68846f2bc0432ad78ca68904c7

SHA133d614955b867ca037f936aa881d252e87b3eebe

SHA2568002c79ff6e42497c5a00543d1b1f4fb19e7151971f5511abf32873f50a71c02

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 110
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1280; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332; SESSION=1ae57178b6c7f863f8d6db2e88cea16b; _ga_0NQW4X2MPH=GS2.1.s1752699026$o1$g0$t1752699026$j60$l0$h644765140; _ga=GA1.1.1052265822.1752699027
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:27 GMT
content-type: application/json
content-length: 23
x-dt: 672
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.006, wf-uht;dur=0.013
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com

83.147.224.233

404 Not Found

255 kB

URL

IP / ASN

83.147.224.233

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (48037)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size255 kB (254789 bytes)

MD5124e30e9b1ccd6db31f3a895585040e9

SHA1d0571708a6c05c362e042fffb97edec59379bf4f

SHA25626a0b26e33eba1faa8549d01079eaa34e074e804e577251cca4fab5bfc9e363c

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server-timing: dt_total;dur=0.003, total;dur=51;desc="Nuxt Server Time"
set-cookie: gw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned
lng=en; Path=/
cookies_agree_type=3; Path=/
tzo=2; Path=/
is12h=0; Path=/
x-dt: 672
x-frame-options: SAMEORIGIN
content-encoding: br
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2

185.244.209.62

200 OK

64 kB

URL

v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 63920, version 1.0

First Seen2023-05-07

Last Seen2025-08-03

Times Seen5267

Size64 kB (63920 bytes)

MD5a65527fcb58f66a7cfbc0e6b160538b4

SHA145d260e7fa343401b5bb0df982a014f53e2d253b

SHA256fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:25 GMT
content-type: font/woff2
content-length: 63920
traceparent: 00-fb8854a4eac151b7d1526c7f653799fa-5c8a65bedcd02ec1-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "a65527fcb58f66a7cfbc0e6b160538b4"
expires: Wed, 16 Jul 2025 19:36:40 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 2319
cache: HIT
x-cached-since: 2025-07-16T20:11:46+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/1de41bc773fd3832f739bfed8a968992.json

185.244.209.62

200 OK

15 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/1de41bc773fd3832f739bfed8a968992.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size15 kB (14946 bytes)

MD52f11b21bd86229c0a033764399241676

SHA1eaebf77db139d6e31aa446ac0cfdc276f6eac733

SHA2563e4ebd17272a1f85764a6cbc533d7940ecd08b2f36e1dc0085d00e5f979643c8

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/1de41bc773fd3832f739bfed8a968992.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
traceparent: 00-fef955f968c3bbba92f040566a234b21-9c5c46795a000d4a-01
last-modified: Mon, 16 Jun 2025 11:29:17 GMT
etag: W/"2f11b21bd86229c0a033764399241676"
content-encoding: gzip
expires: Mon, 16 Jun 2025 12:57:00 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1015
cache: HIT
x-cached-since: 2025-07-16T20:33:20+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/2a5172c375f22622c5363af4d797813e.json

185.244.209.62

200 OK

2.9 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/2a5172c375f22622c5363af4d797813e.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size2.9 kB (2862 bytes)

MD517c389c12c0f1f24aef49f79039968e3

SHA157b1bd6b870b095946ecb5935a3f3e7d0efe333a

SHA2563b350efcc22ca8582279b0029d19587be895e5b0e7731d84e785c9c1e9db493f

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/2a5172c375f22622c5363af4d797813e.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
traceparent: 00-3e95c41381186c233b47c92b6df6c077-fb4fb4daceb4089a-01
last-modified: Thu, 05 Jun 2025 12:29:39 GMT
etag: W/"17c389c12c0f1f24aef49f79039968e3"
content-encoding: gzip
expires: Sun, 13 Jul 2025 21:02:09 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1015
cache: HIT
x-cached-since: 2025-07-16T20:33:20+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_0e05b6f8a4.js

185.244.209.62

200 OK

355 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_0e05b6f8a4.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJava source, ASCII text, with very long lines (354)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size355 B (355 bytes)

MD5cb123e3d49fca716429cc9792d0c2ead

SHA134023307d812b041e1068a39ba6ec1ba21512bb6

SHA2565f1f70d1e543cc47431f32230317fa9247a4c3597d7216023ca16bf75e9a9b9e

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_0e05b6f8a4.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
content-length: 355
traceparent: 00-2c8db5d454ca8a53478f011eae874cfa-6cb5fe76356e2299-01
last-modified: Wed, 16 Jul 2025 06:35:48 GMT
etag: "cb123e3d49fca716429cc9792d0c2ead"
x-amz-meta-mtime: 1752647277.555014957
expires: Thu, 17 Jul 2025 06:46:29 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50443
cache: HIT
x-cached-since: 2025-07-16T06:49:33+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/bff-api/config/group/get?groups=d.technical&lang=en

83.147.224.233

200 OK

730 B

URL

1xlite-248336.bar/bff-api/config/group/get?groups=d.technical&lang=en

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-05-10

Last Seen2025-07-17

Times Seen455

Size730 B (730 bytes)

MD587ec2701f4efb3b20790e1a967af79be

SHA18c7a33e8de1fadc580287953380b136d261c27f5

SHA256add58098a30e646183c0c004afd7cdb345b576ed641263c6b19ab40c18d75395

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bff-api/config/group/get?groups=d.technical&lang=en HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
content-type: application/json
x-requested-with: XMLHttpRequest
is-srv: false
x-svc-source: __TECHNICAL_PAGES_APP__
x-app-n: __TECHNICAL_PAGES_APP__
x-geoip2-country-code: ru
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1920; che_g=f18f6f4d-0fe7-ce41-0979-1ea09b990332
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
content-length: 730
cache-control: no-cache, private
server-timing: dt_total;dur=0.006, bff;dur=1.10, wf-uht;dur=0.015
x-cache-expire: 883
x-cache-hit: 1
x-dt: 672
x-pod: R-v5gk8
x-time-ng: 0.002
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com

83.147.224.233

301 Moved Permanently

255 kB

URL

IP / ASN

83.147.224.233

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5619500

Size255 kB (254789 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
server: nginx
date: Wed, 16 Jul 2025 20:50:13 GMT
location: /en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
reason-v3: empty_lang
server-timing: dt_total;dur=0.010, total;dur=8;desc="Nuxt Server Time", wf-uht;dur=0.021
set-cookie: platform_type=mobile; Path=/; Expires=Sat, 19 Jul 2025 20:50:13 GMT; Secure; SameSite=None; Partitioned
gw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned
auid=U5Pg6Wh4EIWvvyROA0HcAg==; path=/; secure; httponly; samesite=lax
x-dt: 672
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/app-2fafc41b.js

185.244.209.62

200 OK

520 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/app-2fafc41b.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators

First Seen2025-07-16

Last Seen2025-07-16

Times Seen2

Size520 kB (520179 bytes)

MD5dda434077c5a6f1b13177737601ddf09

SHA1e4f1bd4e08763f09e68fec48c6a1ff2875b7958c

SHA2565bb93595418180570b3cb62c165566eadffed3f8be78dacc6ff100793f153226

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/app-2fafc41b.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-6abe03afdd716100c5951719a1a3f90a-d83ef8e307dae7dc-01
last-modified: Wed, 16 Jul 2025 06:26:13 GMT
etag: W/"dda434077c5a6f1b13177737601ddf09"
x-amz-meta-mtime: 1752647172.092835039
content-encoding: gzip
expires: Thu, 17 Jul 2025 19:31:18 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 4737
cache: HIT
x-cached-since: 2025-07-16T19:31:18+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/d8f7ea88c0c0dbf01463f2ee31a5eb30.json

185.244.209.62

200 OK

1.3 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/d8f7ea88c0c0dbf01463f2ee31a5eb30.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-04-07

Last Seen2025-07-30

Times Seen1629

Size1.3 kB (1342 bytes)

MD5499d57f89b2bf5fed52d984d865fd72c

SHA1f3dd138886f2c1e257d3ac2214b7e3cba57e56b2

SHA2569467cf5576ce2a97d9e44e53915a9c4ae529c134cc1ea5a3c62ea304eebda0c8

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/d8f7ea88c0c0dbf01463f2ee31a5eb30.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
traceparent: 00-9a2ce231851faea8c1db7f4406b78ede-25660fb499f74d9e-01
last-modified: Thu, 27 Feb 2025 08:17:33 GMT
etag: W/"499d57f89b2bf5fed52d984d865fd72c"
content-encoding: gzip
expires: Tue, 13 May 2025 22:39:23 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_4e6bc58081.js

185.244.209.62

200 OK

943 B

URL

v3.traincdn.com/sys-static/shared-assets/Mobile/__shared_4e6bc58081.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJava source, ASCII text, with very long lines (942)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen15

Size943 B (943 bytes)

MD509671f9d760794dc31a5d1572e178de6

SHA1f938a9119a39ed2a37818dd7250009f49d64bbf5

SHA25690930ed29777d5825e8bb77e8a95b3eb7a96e8185af45ea83c613e0130659e78

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/Mobile/__shared_4e6bc58081.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
content-length: 943
traceparent: 00-4e7b5843957994345d7cd9ab68cbf6ae-c947b54fac2a534b-01
last-modified: Wed, 16 Jul 2025 11:22:03 GMT
etag: "09671f9d760794dc31a5d1572e178de6"
x-amz-meta-mtime: 1752664466.430262147
expires: Thu, 17 Jul 2025 11:54:46 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 32130
cache: HIT
x-cached-since: 2025-07-16T11:54:46+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/ab3a9ece24.js

185.244.209.62

200 OK

3.6 kB

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/ab3a9ece24.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (3547)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen14

Size3.6 kB (3550 bytes)

MD5c32095a14de24cee6ab79c4ca2f132df

SHA19fd424b3ea8aef027b1a2f37ba385a961f43fda3

SHA256149b1dddb8a13ef86e3f7f379019e71d2a416343674e98dd655d27d13ac80033

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/ab3a9ece24.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-19819b694008380e81e257d308bf7cca-4d2739f3a0027e56-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: W/"c32095a14de24cee6ab79c4ca2f132df"
x-amz-meta-mtime: 1752653608.30352599
content-encoding: gzip
expires: Thu, 17 Jul 2025 19:50:42 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3574
cache: HIT
x-cached-since: 2025-07-16T19:50:42+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/bba4b8fc20913fb76f9af7b12df34087.json

185.244.209.62

200 OK

13 kB

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/bba4b8fc20913fb76f9af7b12df34087.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2025-03-13

Last Seen2025-07-30

Times Seen1803

Size13 kB (13278 bytes)

MD52b474bcc2f009b70e64e2b5a95dd50a4

SHA11fd5ee2d54da7dfbf61e67efd938a89c548fc866

SHA256f86d880575f3f65ddaaf9e8a0e3746bbbefcefe7e6c0c4441e9e20ceffdca237

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/bba4b8fc20913fb76f9af7b12df34087.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
traceparent: 00-75b40d958b941e71a363deaacba75e32-eb46c32a5761e560-01
last-modified: Wed, 12 Mar 2025 09:35:38 GMT
etag: W/"2b474bcc2f009b70e64e2b5a95dd50a4"
content-encoding: gzip
expires: Tue, 13 May 2025 22:39:23 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
X-Firefox-Spdy: h2

POST 1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

83.147.224.233

200 OK

23 B

URL

1xlite-248336.bar/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json

IP / ASN

83.147.224.233

Resource Info

File typeJSON text data

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size23 B (23 bytes)

MD57b07b13c5aa404231695a8dae17ab91e

SHA158515d629349e993f33bbfeb98993d85205d90ce

SHA2569c04870f6965856e4c45f8eb994e3ed5ed6312345e654b7b33981cdb0885b857

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Content-Type: application/json
X-Lang: en
X-Uuid: 35969cac-2d25-40a0-935e-f4719ae5a5cf
Content-Length: 49
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0; window_width=1920
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: application/json
content-length: 23
x-dt: 672
x-time-ng: 0.001
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: dt_total;dur=0.007, wf-uht;dur=0.011
X-Firefox-Spdy: h2

GET v3.traincdn.com/main-static/8bd3f8a1/mobile/default/DC-3d31e221.js

185.244.209.62

200 OK

2.7 kB

URL

v3.traincdn.com/main-static/8bd3f8a1/mobile/default/DC-3d31e221.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (2657), with no line terminators

First Seen2025-07-16

Last Seen2025-07-23

Times Seen16

Size2.7 kB (2657 bytes)

MD5e4ebd52e9a81ceed08fb6e2f61297bce

SHA1fc8e74cc313b40e9c35f970fee65e111e9c9a8fe

SHA256b402aa79cb7b5642755c039b71acffeec8511430557820d034d75681ae082e39

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /main-static/8bd3f8a1/mobile/default/DC-3d31e221.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-172eddd812287c1f6121687fd95969d4-531854e14d66ed39-01
last-modified: Wed, 16 Jul 2025 06:26:13 GMT
etag: W/"e4ebd52e9a81ceed08fb6e2f61297bce"
x-amz-meta-mtime: 1752647172.088835026
content-encoding: gzip
expires: Thu, 17 Jul 2025 06:45:29 GMT
cache-control: max-age=86400
x-time-ng: 0.001
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 50682
cache: HIT
x-cached-since: 2025-07-16T06:45:33+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js

185.244.209.62

200 OK

159 kB

URL

v3.traincdn.com/sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (65509)

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1478

Size159 kB (158815 bytes)

MD51da464d70e78b04b9b808e82e4ad9487

SHA10c79e65516d1525ecb43d13cfb4ccb0631095a28

SHA256b4c72b8036ca6767ab61490178f901538646f2aa1001cb042caa134174a41595

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/__shared_libphonenumber_js_Q6RMKWT6.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-7adadf7d72884bcaebecc783bca8a391-2c06edc48f04fc55-01
last-modified: Wed, 16 Jul 2025 07:35:41 GMT
etag: W/"1da464d70e78b04b9b808e82e4ad9487"
x-amz-meta-mtime: 1752651137.49971428
content-encoding: gzip
expires: Thu, 17 Jul 2025 08:21:40 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44853
cache: HIT
x-cached-since: 2025-07-16T08:22:42+00:00
X-Firefox-Spdy: h2

GET www.googletagmanager.com/gtag/js?id=G-0NQW4X2MPH

142.250.178.72

200 OK

465 kB

URL

www.googletagmanager.com/gtag/js?id=G-0NQW4X2MPH

IP / ASN

142.250.178.72

#15169 GOOGLE

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (8282)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size465 kB (464885 bytes)

MD513a26926e96e418a17297862fb9960b2

SHA1df13a5fbcc5d474e55d7cc13c752075e8de49e74

SHA256ff1c9f63f9de64d6d8ed66cdd3dd02688d043695edd0e455d7254a3ab2841b39

Certificate Info

IssuerGoogle Trust Services

Subject*.google-analytics.com

Fingerprint3A:12:37:38:16:E5:9F:51:4E:B7:1D:5F:1F:C0:84:BB:92:EA:9E:20

ValidityMon, 23 Jun 2025 08:40:16 GMT - Mon, 15 Sep 2025 08:40:15 GMT

HTTP Headers

GET /gtag/js?id=G-0NQW4X2MPH HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Wed, 16 Jul 2025 20:50:26 GMT
expires: Wed, 16 Jul 2025 20:50:26 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
server: Google Tag Manager
content-length: 150370
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

83.147.224.233

404 Not Found

255 kB

URL

IP / ASN

83.147.224.233

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (48037)

First Seen2025-07-16

Last Seen2025-07-16

Times Seen1

Size255 kB (254789 bytes)

MD5aeec7ad63896472b18da4f761bb3d0d3

SHA145a78eb962c7bdee4ad3c35292f8d4cc8e8b0d34

SHA256c81d41a0cfb0d036077586dd2f62619d5b6cc3d9366c1cc77f507b219d92512b

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server-timing: dt_total;dur=0.003, total;dur=55;desc="Nuxt Server Time"
set-cookie: gw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned
lng=en; Path=/
cookies_agree_type=3; Path=/
tzo=2; Path=/
is12h=0; Path=/
x-dt: 672
x-frame-options: SAMEORIGIN
content-encoding: br
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/entry-1defa6e1c0.js

185.244.209.62

200 OK

30 kB

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/entry-1defa6e1c0.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (29559)

First Seen2025-07-16

Last Seen2025-07-21

Times Seen14

Size30 kB (30039 bytes)

MD5295a457abccc11f066dc1344a75cb138

SHA19f7b6f46eb9641aafd008fcfc56e6cf1d640324b

SHA25649721749cee6bedf3f5939fd84d8b0bc327cae759cf74ece33d2ddcb891c0fff

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/entry-1defa6e1c0.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
traceparent: 00-c9941ab0f9b531d1f3dffbcbfa8c0a17-b2e155dc5dd48cd4-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: W/"295a457abccc11f066dc1344a75cb138"
x-amz-meta-mtime: 1752653608.304526011
content-encoding: gzip
expires: Thu, 17 Jul 2025 08:24:00 GMT
cache-control: max-age=86400
x-time-ng: 0.002
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44601
cache: HIT
x-cached-since: 2025-07-16T08:26:54+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/263098ddb3439ce7bc501b44636c61ff.json

185.244.209.62

200 OK

473 B

URL

v3.traincdn.com/genfiles/cms/90-672/desktop/media_asset/263098ddb3439ce7bc501b44636c61ff.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJSON text data

First Seen2023-06-08

Last Seen2025-07-30

Times Seen1942

Size473 B (473 bytes)

MD5e67aa19ef00fd2285c7b4ecbb6018306

SHA15b01d4786d6fbfbd5de7901eb4359a55466f434a

SHA256135c1042c31e3674d8a1b3b9e7179f4f36868048ca6058ea458ff291b8880b5e

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/90-672/desktop/media_asset/263098ddb3439ce7bc501b44636c61ff.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://1xlite-248336.bar/
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: application/json
content-length: 473
traceparent: 00-15f96136bf09b0b1ef0ca0a1f5fd7e1b-4892c3fcbe3c401e-01
last-modified: Thu, 16 May 2024 20:45:02 GMT
etag: "e67aa19ef00fd2285c7b4ecbb6018306"
expires: Tue, 15 Jul 2025 10:44:19 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 17
cache: HIT
x-cached-since: 2025-07-16T20:49:59+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png

185.244.209.62

200 OK

653 B

URL

v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typePNG image data, 32 x 32, 8-bit colormap, non-interlaced

First Seen2023-04-05

Last Seen2025-08-03

Times Seen3184

Size653 B (653 bytes)

MD5e6f0766cbd95db33da44e7a9140648f2

SHA15f196b1bfe8c3f92bd2ebcd67124e72e81ae6aaf

SHA256c0399d478788d5d483f104a2e8cb7c32f41cb40e9df0c22e831b2bfa2db63ec0

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: image/png
content-length: 653
traceparent: 00-39c5f04ad34743f737e972b75ead1218-24e9adc01015dc41-01
last-modified: Wed, 26 Jun 2024 08:18:02 GMT
etag: "e6f0766cbd95db33da44e7a9140648f2"
expires: Thu, 16 Jan 2025 10:46:36 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1719
cache: HIT
x-cached-since: 2025-07-16T20:21:36+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js

185.244.209.62

200 OK

865 B

URL

v3.traincdn.com/sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeJavaScript source, ASCII text, with very long lines (840)

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1478

Size865 B (865 bytes)

MD50af3fe0c072a5bb3b6c731767187982f

SHA155db5afb57265dc92fd121fe9ae565ffb2f53b2c

SHA256655bbe85da91e863401c6f96e24b41f5c2fe51a4245cecc2deb2b8c9600fef30

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/shared-assets/__shared_fast_deep_equal_XYWIEKOD.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:16 GMT
content-type: text/javascript; charset=utf-8
content-length: 865
traceparent: 00-0aa26b4e5bc4e1ae334c6283904ba74c-43212b866d2babab-01
last-modified: Tue, 15 Jul 2025 14:56:29 GMT
etag: "0af3fe0c072a5bb3b6c731767187982f"
x-amz-meta-mtime: 1752591202.431502663
expires: Thu, 17 Jul 2025 08:09:30 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 44862
cache: HIT
x-cached-since: 2025-07-16T08:22:34+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/version.json

185.244.209.62

200 OK

11 B

URL

v3.traincdn.com/version.json

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text

First Seen2025-07-16

Last Seen2025-07-17

Times Seen20

Size11 B (11 bytes)

MD5e7fe839ebe1a2609bb2d849ea3bd5ab5

SHA12c8a19f8c1b8a4499d8bfb112aa757424af32ec2

SHA2563d00acaa3403f3617868d51ee955ad2a5da95cdb4eb074cb811711e9539d55ae

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /version.json HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: application/json
content-length: 11
traceparent: 00-05a101de45f3aeddd01f0c0877925e3b-31da8da021183917-01
last-modified: Wed, 16 Jul 2025 11:01:50 GMT
etag: "e7fe839ebe1a2609bb2d849ea3bd5ab5"
x-amz-meta-mtime: 1752663710.163953021
expires: Wed, 16 Jul 2025 11:04:22 GMT
cache-control: max-age=60
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 14
cache: HIT
x-cached-since: 2025-07-16T20:50:00+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2

185.244.209.62

200 OK

64 kB

URL

v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 63748, version 1.0

First Seen2023-06-14

Last Seen2025-08-03

Times Seen5357

Size64 kB (63748 bytes)

MD56887b6f24414dbc612dbf42ccdc76b70

SHA18068d3abfbc6cbf35b55919da45b1f4d2d136238

SHA256fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: font/woff2
content-length: 63748
traceparent: 00-12bdec1e40a0a97ec981c8897beca037-da31d99c9b758754-01
last-modified: Wed, 14 Jun 2023 09:49:53 GMT
etag: "6887b6f24414dbc612dbf42ccdc76b70"
expires: Thu, 16 Jan 2025 10:32:14 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 1032
cache: HIT
x-cached-since: 2025-07-16T20:33:02+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/site-admin/colors/1d460dd6668d3a7fae9466949edb033f.css

185.244.209.62

200 OK

40 kB

URL

v3.traincdn.com/genfiles/site-admin/colors/1d460dd6668d3a7fae9466949edb033f.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (40085), with no line terminators

First Seen2025-07-16

Last Seen2025-07-23

Times Seen136

Size40 kB (40085 bytes)

MD51d460dd6668d3a7fae9466949edb033f

SHA1b7c34ce1f8e6b8f9b8e8b523a66a20cee075a49b

SHA2563bdb068a33276a91b91ae2e4a92ab384919205dc0951d07763608d2053cd8380

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/site-admin/colors/1d460dd6668d3a7fae9466949edb033f.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/css
traceparent: 00-4cd241c3be5a804232855d163374300b-4a14abcf556de9b6-01
last-modified: Wed, 16 Jul 2025 14:05:21 GMT
etag: W/"1d460dd6668d3a7fae9466949edb033f"
cache-control: max-age=3600
content-encoding: gzip
expires: Wed, 16 Jul 2025 15:14:07 GMT
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 2064
cache: HIT
x-cached-since: 2025-07-16T20:15:51+00:00
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/$_$.js

185.244.209.62

200 OK

69 B

URL

v3.traincdn.com/sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/$_$.js

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with no line terminators

First Seen2025-05-14

Last Seen2025-08-03

Times Seen1380

Size69 B (69 bytes)

MD52cdaa92927f02e0b628f1ef4d7dd8caf

SHA19104a2e16ed080b80a42588b8aeb52ebec47ab7a

SHA256ef8101ffea52addcdcfcc3a83f96ff2d4613fb3ae6d1c16bbe4852387b73a9db

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-static/sys-technical-pages-app-static/Mobile/Default/44136fa355b3/$_$.js HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:15 GMT
content-type: text/javascript; charset=utf-8
content-length: 69
traceparent: 00-8ac6c52d5b24beb63d5c45129f2115e9-5df3317113295523-01
last-modified: Wed, 16 Jul 2025 08:21:14 GMT
etag: "2cdaa92927f02e0b628f1ef4d7dd8caf"
x-amz-meta-mtime: 1752653608.298525882
expires: Thu, 17 Jul 2025 19:51:47 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 3508
cache: HIT
x-cached-since: 2025-07-16T19:51:47+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/genfiles/cms/1/desktop/fonts/Righteous/Righteous-Regular.woff2

185.244.209.62

200 OK

16 kB

URL

v3.traincdn.com/genfiles/cms/1/desktop/fonts/Righteous/Righteous-Regular.woff2

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeWeb Open Font Format (Version 2), TrueType, length 16396, version 1.0

First Seen2023-07-06

Last Seen2025-07-16

Times Seen209

Size16 kB (16396 bytes)

MD573d3ebdb115ad0d3667c95a7b020cb26

SHA1bd248ccd66ad99da5c29c927190bb426a15e302d

SHA2566665b881b3735fc4e7b515b9ea85c87604fa9ee85c53f43c757bc45bb27aa79c

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /genfiles/cms/1/desktop/fonts/Righteous/Righteous-Regular.woff2 HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://1xlite-248336.bar
DNT: 1
Connection: keep-alive
Referer: https://v3.traincdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:25 GMT
content-type: font/woff2
content-length: 16396
traceparent: 00-853403e3aad1e1a016d0a06344e664c2-70728531821cf082-01
last-modified: Wed, 14 Jun 2023 09:49:15 GMT
etag: "73d3ebdb115ad0d3667c95a7b020cb26"
expires: Wed, 16 Jul 2025 20:11:55 GMT
cache-control: max-age=3600
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 2233
cache: HIT
x-cached-since: 2025-07-16T20:13:12+00:00
accept-ranges: bytes
X-Firefox-Spdy: h2

GET 1xlite-248336.bar/main-static/8bd3f8a1/check-ob.js

83.147.224.233

200 OK

219 B

URL

1xlite-248336.bar/main-static/8bd3f8a1/check-ob.js

IP / ASN

83.147.224.233

Resource Info

File typeJavaScript source, ASCII text

First Seen2024-07-17

Last Seen2025-08-03

Times Seen2598

Size219 B (219 bytes)

MD5c065700c9c8c493403359e1f2baa10d9

SHA14630fe729e70bdf63fa7ba6c84ec277fd1f51030

SHA2561e61f0c82ae82ffcf503fcd4b4c8ae27b32c11e19b882d5d13f3c44364c893f4

Certificate Info

IssuerLet's Encrypt

Subject1xlite-248336.bar

FingerprintFC:9E:8B:ED:12:81:3D:12:30:82:18:F8:A2:AD:E6:4A:35:57:92:FD

ValidityMon, 14 Jul 2025 09:19:45 GMT - Sun, 12 Oct 2025 09:19:44 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /main-static/8bd3f8a1/check-ob.js HTTP/1.1
Host: 1xlite-248336.bar
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/en/,%20https:/cdn.brevo.com/,%20https:/cdn.getyourguide.com/,%20https:/hotstar.com/,%20https:/in.pinterest.com/,%20https:/livetileedge.dsx.mp.microsoft.com/,%20https:/mc.webvisor.org/,%20https:/mf7zwgemwwrby7pn337iohae7k2purht-c2r.metric.gstatic.com/,%20https:/s.lngtdv.com/,%20https:/v3.traincdn.com/,%20https:/widget.suphelper.top/,%20https:/www.ssssa.yalla--live.com
Cookie: platform_type=mobile; auid=U5Pg6Wh4EIWvvyROA0HcAg==; lng=en; cookies_agree_type=3; tzo=2; is12h=0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/javascript; charset=utf-8
content-length: 219
last-modified: Wed, 16 Jul 2025 06:26:19 GMT
etag: "c065700c9c8c493403359e1f2baa10d9"
x-amz-meta-mtime: 1752647179.028857777
expires: Thu, 17 Jul 2025 20:50:04 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=63072000; includeSubDomains; preload
server-timing: wf-uht;dur=
accept-ranges: bytes
X-Firefox-Spdy: h2

GET v3.traincdn.com/sys-ui/2.3.273/Mobile/Default/client.css

185.244.209.62

200 OK

492 kB

URL

v3.traincdn.com/sys-ui/2.3.273/Mobile/Default/client.css

IP / ASN

185.244.209.62

#199524 G-Core Labs S.A.

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2025-07-16

Last Seen2025-07-31

Times Seen24

Size492 kB (492000 bytes)

MD526342c40b1aa1af7a8f12ec0cdedec9c

SHA1ef7f1879c32b22962f2384a7362097455d353856

SHA2560c114c212e3cec0b3bc58e05cf2d2185027ec89fd1701dbb3531df04c52c408e

Certificate Info

IssuerSectigo Limited

Subject*.traincdn.com

Fingerprint71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA

ValidityTue, 26 Nov 2024 00:00:00 GMT - Fri, 26 Dec 2025 23:59:59 GMT

HTTP Headers

GET /sys-ui/2.3.273/Mobile/Default/client.css HTTP/1.1
Host: v3.traincdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://1xlite-248336.bar/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 16 Jul 2025 20:50:14 GMT
content-type: text/css; charset=utf-8
traceparent: 00-44b892e19d86306512fc4491febae0f2-1469a709882d23a6-01
last-modified: Fri, 27 Jun 2025 13:38:05 GMT
etag: W/"26342c40b1aa1af7a8f12ec0cdedec9c"
x-amz-meta-mtime: 1751031482.572809748
content-encoding: gzip
expires: Thu, 03 Jul 2025 12:52:11 GMT
cache-control: max-age=86400
x-time-ng: 0.000
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
x-id: osix-hw-edge-gc4
age: 29628
cache: HIT
x-cached-since: 2025-07-16T12:36:26+00:00
X-Firefox-Spdy: h2