| arbscan.xyz/cdn/brandkit.zip |  3.167.2.92 | 202 Accepted | 3.0 kB |
URL User Request GET arbscan.xyz/cdn/brandkit.zip IP3.167.2.92:443
CertificateIssuerAmazon Subjectarbscan.xyz Fingerprint4E:2D:10:C2:03:BB:81:1A:CF:2C:AE:23:06:06:65:39:EA:69:5F:A1 ValidityWed, 04 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (798) Hash81ed837f68bed49b07e9dd10cf37dc6d 3b0c02a95b674c6e0566799d188215cf41b4b8c3 a452e6ccd64ee31666ba962d831923e370c31ac1470bac1843b1522b49649a99
GET /cdn/brandkit.zip HTTP/1.1
Host: arbscan.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 202 Accepted
server: CloudFront
date: Thu, 01 May 2025 20:01:07 GMT
content-length: 3028
x-amzn-waf-action: challenge
cache-control: no-store, max-age=0
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-methods: OPTIONS,GET,POST
access-control-allow-headers: x-amzn-waf-action
x-cache: Error from cloudfront
via: 1.1 57d04bb9ff0f23ac1c33e083d49e973e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: E9gc6KH531c2ZW_mI1zWcGijeSBliEpTV21OJsFC_mllh08bbDkUJQ==
X-Firefox-Spdy: h2
|
|
| 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/challenge.js | 3.167.2.122 | 200 OK | 1.1 MB |
URL GET 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/challenge.js IP3.167.2.122:443
Requested byhttps://arbscan.xyz/cdn/brandkit.zip CertificateIssuerAmazon Subject*.28d12be8.eu-west-1.token.awswaf.com Fingerprint14:35:71:2C:FD:4A:77:AD:06:9C:48:80:0D:A4:D4:B9:B5:EF:A6:29 ValidityThu, 08 Aug 2024 00:00:00 GMT - Sun, 07 Sep 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size1.1 MB (1097765 bytes) Hashdff4ea4ca2ff5966666de425250dfe95 f9e3344164ea1d7328454b4a01f7e10976338c16 ff7b6c42df9d9daeeb351c30fa47289157487517b05161851216eef17ad7183a
| Analyzer | Verdict | Alert |
|---|
| Public Nextron YARA rules | malware | Unique code from Jetriz, Swid & Jeniva of the Tetris framework |
GET /1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/challenge.js HTTP/1.1
Host: 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://arbscan.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript
date: Thu, 01 May 2025 20:01:08 GMT
expires: 0
x-amzn-waf-challenge-id: Root=1-6813d304-0138aa9076e07dc737bcc231
cache-control: private, max-age=86400, stale-while-revalidate=604800
last-modified: Thu, 1 May 2025 20:01:08 +0000
pragma: no-cache
content-encoding: gzip
vary: accept-encoding
x-cache: Miss from cloudfront
via: 1.1 16015e09e0d70f7cc17ec5c4f52b310e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: E8I-yAJwKBX239AJ6x6QK161jVLBTydpkhAuqWOaFNBy9HlYLZdH-Q==
X-Firefox-Spdy: h2
|
|
| 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/inputs?client=browser | 3.167.2.122 | 200 OK | 477 B |
URL GET 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/inputs?client=browser IP3.167.2.122:443
Requested byhttps://arbscan.xyz/cdn/brandkit.zip CertificateIssuerAmazon Subject*.28d12be8.eu-west-1.token.awswaf.com Fingerprint14:35:71:2C:FD:4A:77:AD:06:9C:48:80:0D:A4:D4:B9:B5:EF:A6:29 ValidityThu, 08 Aug 2024 00:00:00 GMT - Sun, 07 Sep 2025 23:59:59 GMT
Hash4870827f092a5946ef77d73f06cd9723 3e9750deffaae0e9546a4914488694006f405331 2a259ebfac1d93d5768fe3a01ccbb2c311336a02c447c4da06ab3106ec1c1e92
GET /1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/inputs?client=browser HTTP/1.1
Host: 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://arbscan.xyz/
Origin: https://arbscan.xyz
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/json
content-length: 477
alt-svc: h3=":443"; ma=86400
date: Thu, 01 May 2025 20:01:08 GMT
x-amzn-waf-challenge-id: Root=1-6813d304-3b6b95281adf47231521422f
access-control-max-age: 86400
access-control-allow-origin: *
access-control-allow-methods: OPTIONS,GET,POST
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-cache: Miss from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: ME03vFhiN_-t_bVWs3QgpwcLvsRwGlnPPro37TYSo7sG_trxI8rfIg==
|
|
| arbscan.xyz/favicon.ico | 3.167.2.92 | 202 Accepted | 0 B |
IP3.167.2.92:443
Requested byhttps://arbscan.xyz/cdn/brandkit.zip CertificateIssuerAmazon Subjectarbscan.xyz Fingerprint4E:2D:10:C2:03:BB:81:1A:CF:2C:AE:23:06:06:65:39:EA:69:5F:A1 ValidityWed, 04 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: arbscan.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://arbscan.xyz/cdn/brandkit.zip
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 202 Accepted
server: CloudFront
date: Thu, 01 May 2025 20:01:08 GMT
content-length: 0
alt-svc: h3=":443"; ma=86400
x-amzn-waf-action: challenge
cache-control: no-store, max-age=0
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-methods: OPTIONS,GET,POST
access-control-allow-headers: x-amzn-waf-action
x-cache: Error from cloudfront
via: 1.1 3bd19ecae9d202e55626096b4934d62e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: IeFmfeE34GzNax5flFPcCKvVc6p1wUgg17ecBPbj3cMnwwTGXfYOUg==
|
|
| 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/verify | 3.167.2.122 | 200 OK | 280 B |
URL POST 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/verify IP3.167.2.122:443
Requested byhttps://arbscan.xyz/cdn/brandkit.zip CertificateIssuerAmazon Subject*.28d12be8.eu-west-1.token.awswaf.com Fingerprint14:35:71:2C:FD:4A:77:AD:06:9C:48:80:0D:A4:D4:B9:B5:EF:A6:29 ValidityThu, 08 Aug 2024 00:00:00 GMT - Sun, 07 Sep 2025 23:59:59 GMT
Hashd0c042e57dc1bc1b55a01c6d030af4be 8640fc0830ad325eebf77be6c0ceecf8095f0e9b a5eae00f2c475e5d7c141ab08c88fed04ad15fcd762e3e7985b31a41543211fd
POST /1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/verify HTTP/1.1
Host: 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://arbscan.xyz/
Content-Type: text/plain;charset=UTF-8
Content-Length: 9206
Origin: https://arbscan.xyz
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/json
content-length: 280
alt-svc: h3=":443"; ma=86400
date: Thu, 01 May 2025 20:01:09 GMT
x-amzn-waf-challenge-id: Root=1-6813d305-21a9b42d2e956a014dd86a73
access-control-max-age: 86400
access-control-allow-origin: *
access-control-allow-methods: OPTIONS,GET,POST
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-cache: Miss from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: p202YUSgcazxlQvLbp43pNPOBBjrS33GFDSt-J8fRIt9pwSpkX6t-A==
|
|
| 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/verify | 3.167.2.122 | 200 OK | 280 B |
URL POST 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com/1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/verify IP3.167.2.122:443
Requested byhttps://arbscan.xyz/cdn/brandkit.zip CertificateIssuerAmazon Subject*.28d12be8.eu-west-1.token.awswaf.com Fingerprint14:35:71:2C:FD:4A:77:AD:06:9C:48:80:0D:A4:D4:B9:B5:EF:A6:29 ValidityThu, 08 Aug 2024 00:00:00 GMT - Sun, 07 Sep 2025 23:59:59 GMT
Hashbe30af3fc977461d3b493b453de825b6 0bb9d2f5ff3522ef37496e350d735fd6e8bf324a 0009fd7f65498aa7cfe04299f856f5d8f2404c1895a23d81f4e8751eaa9d9f8a
POST /1c6d9c13bd4e/6d0a08ad61d8/9d80e64fe790/verify HTTP/1.1
Host: 1c6d9c13bd4e.28d12be8.eu-west-1.token.awswaf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://arbscan.xyz/
Content-Type: text/plain;charset=UTF-8
Content-Length: 9233
Origin: https://arbscan.xyz
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/json
content-length: 280
alt-svc: h3=":443"; ma=86400
date: Thu, 01 May 2025 20:01:09 GMT
x-amzn-waf-challenge-id: Root=1-6813d305-6e098db30c5f58773af2559e
access-control-max-age: 86400
access-control-allow-origin: *
access-control-allow-methods: OPTIONS,GET,POST
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-cache: Miss from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: _PW_7LzFKHBp_XX13L4rlJqz_8KIZ59FfTeCk5PYEphDlZBFRjo1bA==
|
|
| arbscan.xyz/cdn/brandkit.zip | 3.167.2.127 | 200 OK | 392 kB |
URL User Request GET arbscan.xyz/cdn/brandkit.zip IP3.167.2.127:443
CertificateIssuerAmazon Subjectarbscan.xyz Fingerprint4E:2D:10:C2:03:BB:81:1A:CF:2C:AE:23:06:06:65:39:EA:69:5F:A1 ValidityWed, 04 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typeZip archive data, at least v1.0 to extract, compression method=store Size392 kB (392516 bytes) Hash3ea2596793a9e6af9d07de8360fd3c0e 64ef251a725d8256005b8cda7e823be4f674fceb d0666ee05dfda1c57b143320f6961e41c084a0e9370074088dcd31028069d1bb
GET /cdn/brandkit.zip HTTP/1.1
Host: arbscan.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: aws-waf-token=3897c2b3-5e77-4aaf-a98f-e2d6242eadf6:CgoAbLOLx429AQAA:r2NwhuvJD5yEzXVMLdVEVA1fyRBzI4lgmZRmX/LY3OZZTlmWdvV+wdrAi1IWQTsygKkUPCUpeo9gpHZ0sD31uG82eczlFFG309PHyoMZpzaHOYU0sbyrtAOXO34+evPmDGr7Q9DUfZrNg4iaASpg4L/dfMZUDVB7d9N1smfNaWsW11q1dCSicfh+etsrtz9WHlZB4A==
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/zip
content-length: 392516
date: Thu, 01 May 2025 20:01:09 GMT
server: nginx
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-methods: GET,DELETE,PATCH,POST,PUT
accept-ranges: bytes
last-modified: Mon, 29 Jul 2024 08:29:15 GMT
etag: W/"5fd44-190fd9ba778"
cache-control: public, max-age=31536000,immutable
x-cache: Miss from cloudfront
via: 1.1 8b440cccbe8a332306f650e1ec8894ac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: aVSX090LSPhGolWh3GCQaNmsgxn2CXprS2kvSSzDNdaSWBMXaZ8apw==
X-Firefox-Spdy: h2
|
|