| lysyfyj.com/http:/gatyfus.com/http:/lysyfyj.com/ | 199.115.115.118 | | 11 B |
URL lysyfyj.com/http:/gatyfus.com/http:/lysyfyj.com/ IP 199.115.115.118:0
ASN#30633 LEASEWEB-USA-WDC
File typeASCII text, with no line terminators Hash32682312d17c7cbf18e73594f5570319 60e22121bdd0bc71cdb2bae2a3aa577006b2eae9 e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /http:/gatyfus.com/http:/lysyfyj.com/ HTTP/1.1
Host: lysyfyj.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
cache-control: max-age=0, private, must-revalidate
content-length: 11
date: Mon, 15 Apr 2024 08:37:28 GMT
location: http://iphig-fib.com/zclkvisitor/64e580a7-fb03-11ee-9b1e-0affeb50fcaf/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77dd2610-928d-11ee-9bb7-0a4ababc2193
server: Cowboy
set-cookie: sid=64e315e4-fb03-11ee-a9fb-2b959f292b60; path=/; domain=.lysyfyj.com; expires=Sat, 03 May 2092 11:51:36 GMT; max-age=2147483647; secure; HttpOnly
X-Firefox-Spdy: h2
|
|
| iphig-fib.com/zclkvisitor/64e580a7-fb03-11ee-9b1e-0affeb50fcaf/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77dd2610-928d-11ee-9bb7-0a4ababc2193 | 18.233.80.6 | | 2.7 kB |
URL iphig-fib.com/zclkvisitor/64e580a7-fb03-11ee-9b1e-0affeb50fcaf/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77dd2610-928d-11ee-9bb7-0a4ababc2193 IP 18.233.80.6:0
File typeHTML document, ASCII text, with very long lines (400) Hash5e901e532dc3f7c8f75b35a5f230cdb4 7914fef75623723f7e02c5c033db362b54726dcf dee00d96f66a3ef4642baae2d300c97cee74cb5f90bef699fe1fd17da35af29e
GET /zclkvisitor/64e580a7-fb03-11ee-9b1e-0affeb50fcaf/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77dd2610-928d-11ee-9bb7-0a4ababc2193 HTTP/1.1
Host: iphig-fib.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Mon, 15 Apr 2024 08:37:29 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 2730
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
|
|
| iphig-fib.com/zclkredirect?visitid=64e580a7-fb03-11ee-9b1e-0affeb50fcaf&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=undefined&timezone=UTC%2B00%3A00&timezoneName=UTC | 18.211.236.31 | | 1.6 kB |
URL iphig-fib.com/zclkredirect?visitid=64e580a7-fb03-11ee-9b1e-0affeb50fcaf&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=undefined&timezone=UTC%2B00%3A00&timezoneName=UTC IP 18.211.236.31:0
File typeHTML document, ASCII text, with very long lines (751) Hashc2db7ec6d2c1ea3a6728f6adc545ed59 dc3c154256d42b2a3bd3e09163274b8e5fa18664 e7af346773064af1c6c99ea36c15af53fb024f57b0c30704cd11560f8de92f0f
GET /zclkredirect?visitid=64e580a7-fb03-11ee-9b1e-0affeb50fcaf&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=undefined&timezone=UTC%2B00%3A00&timezoneName=UTC HTTP/1.1
Host: iphig-fib.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://iphig-fib.com/zclkvisitor/64e580a7-fb03-11ee-9b1e-0affeb50fcaf/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=77dd2610-928d-11ee-9bb7-0a4ababc2193
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Mon, 15 Apr 2024 08:37:30 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 1588
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
redirected: JS
|
|
| iphig-fib.com/favicon.ico | 18.211.236.31 | | 653 B |
URL iphig-fib.com/favicon.ico IP 18.211.236.31:0
File typeHTML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators Hashba2732b1b2fa2626ffaa15f62f9e7d66 203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe 879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
GET /favicon.ico HTTP/1.1
Host: iphig-fib.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://iphig-fib.com/zclkredirect?visitid=64e580a7-fb03-11ee-9b1e-0affeb50fcaf&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false&gpu=undefined&timezone=UTC%2B00%3A00&timezoneName=UTC
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404
Date: Mon, 15 Apr 2024 08:37:31 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 653
Connection: keep-alive
Content-Language: en
|
|
| ocsp.r2m03.amazontrust.com/ | 143.204.53.97 | | 471 B |
URL ocsp.r2m03.amazontrust.com/ IP 143.204.53.97:0
Hash25c1c4dbabcb6ca297355ffaccd18f39 4e2a81304a6b97bb14cae0476dfd790811f4764e e7f03758fad863b943f0196e38665fea42e70709e7687680d41195195827ed7b
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Mon, 15 Apr 2024 08:37:31 GMT
Server: ECAcc (amb/6ACC)
X-Cache: Miss from cloudfront
Via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: sxTQnSbnzRrJuM5NrYX-FgLpgLybnMr0jl4wOzZcrtqJqeIvYjwmOw==
|
|
| api.shopfinder24.com/r/dG89aHR0cHMlM0ElMkYlMkZyLmxpbmtzcHJmLmNvbSUyRnYxJTJGcmVkaXJlY3QlM0Z0eXBlJTNEbGlua0lkJTI2aWQlM0QzNzFmNDQxMWU0NjM0YzkwYjM3ZDk4MjgyNGNhYTdiMyUyNmFwaV9rZXklM0RhZGY0MDdmZDEwODdhMWU1NmVhZGRlYzBmNTkxNDI2NyUyNnNpdGVfaWQlM0QyNzBjZDUzZWMyMzM0ZjExOGNlZDE0YTRlOGJjODQ5ZiUyNmRjaCUzRGZlZWQlMjZhZF90JTNEYWR2ZXJ0aXNlciUyNnlrX3RhZyUzRCU3QmNsaWNraWQlN0QmdD0wJnM9ZWJmZDMzNTdlMWI2ZjMxMjFjODU4MmZkZWFkNGVmMzU=?c=weh5vepk42nj0oj03mvencfq&var10= | 0.0.0.0 | | 0 B |
URL User Request GET api.shopfinder24.com/r/dG89aHR0cHMlM0ElMkYlMkZyLmxpbmtzcHJmLmNvbSUyRnYxJTJGcmVkaXJlY3QlM0Z0eXBlJTNEbGlua0lkJTI2aWQlM0QzNzFmNDQxMWU0NjM0YzkwYjM3ZDk4MjgyNGNhYTdiMyUyNmFwaV9rZXklM0RhZGY0MDdmZDEwODdhMWU1NmVhZGRlYzBmNTkxNDI2NyUyNnNpdGVfaWQlM0QyNzBjZDUzZWMyMzM0ZjExOGNlZDE0YTRlOGJjODQ5ZiUyNmRjaCUzRGZlZWQlMjZhZF90JTNEYWR2ZXJ0aXNlciUyNnlrX3RhZyUzRCU3QmNsaWNraWQlN0QmdD0wJnM9ZWJmZDMzNTdlMWI2ZjMxMjFjODU4MmZkZWFkNGVmMzU=?c=weh5vepk42nj0oj03mvencfq&var10= IP 0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /r/dG89aHR0cHMlM0ElMkYlMkZyLmxpbmtzcHJmLmNvbSUyRnYxJTJGcmVkaXJlY3QlM0Z0eXBlJTNEbGlua0lkJTI2aWQlM0QzNzFmNDQxMWU0NjM0YzkwYjM3ZDk4MjgyNGNhYTdiMyUyNmFwaV9rZXklM0RhZGY0MDdmZDEwODdhMWU1NmVhZGRlYzBmNTkxNDI2NyUyNnNpdGVfaWQlM0QyNzBjZDUzZWMyMzM0ZjExOGNlZDE0YTRlOGJjODQ5ZiUyNmRjaCUzRGZlZWQlMjZhZF90JTNEYWR2ZXJ0aXNlciUyNnlrX3RhZyUzRCU3QmNsaWNraWQlN0QmdD0wJnM9ZWJmZDMzNTdlMWI2ZjMxMjFjODU4MmZkZWFkNGVmMzU=?c=weh5vepk42nj0oj03mvencfq&var10= HTTP/1.1
Host: api.shopfinder24.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| priverautional.com/redirect?target=BASE64aHR0cHM6Ly9hcGkuc2hvcGZpbmRlcjI0LmNvbS9yL2RHODlhSFIwY0hNbE0wRWxNa1lsTWtaeUxteHBibXR6Y0hKbUxtTnZiU1V5Um5ZeEpUSkdjbVZrYVhKbFkzUWxNMFowZVhCbEpUTkViR2x1YTBsa0pUSTJhV1FsTTBRek56Rm1ORFF4TVdVME5qTTBZemt3WWpNM1pEazRNamd5TkdOaFlUZGlNeVV5Tm1Gd2FWOXJaWGtsTTBSaFpHWTBNRGRtWkRFd09EZGhNV1UxTm1WaFpHUmxZekJtTlRreE5ESTJOeVV5Tm5OcGRHVmZhV1FsTTBReU56QmpaRFV6WldNeU16TTBaakV4T0dObFpERTBZVFJsT0dKak9EUTVaaVV5Tm1SamFDVXpSR1psWldRbE1qWmhaRjkwSlRORVlXUjJaWEowYVhObGNpVXlObmxyWDNSaFp5VXpSQ1UzUW1Oc2FXTnJhV1FsTjBRbWREMHdKbk05WldKbVpETXpOVGRsTVdJMlpqTXhNakZqT0RVNE1tWmtaV0ZrTkdWbU16VT0_Yz13ZWg1dmVwazQybmowb2owM212ZW5jZnEmdmFyMTA9&ts=1713170251162&hash=apKhrtSYvsLnkHepIPPh1da0xTQPx3iKj5xoMj496bU&rm=D | 54.230.111.84 | 200 OK | 711 B |
URL User Request GET HTTP/2priverautional.com/redirect?target=BASE64aHR0cHM6Ly9hcGkuc2hvcGZpbmRlcjI0LmNvbS9yL2RHODlhSFIwY0hNbE0wRWxNa1lsTWtaeUxteHBibXR6Y0hKbUxtTnZiU1V5Um5ZeEpUSkdjbVZrYVhKbFkzUWxNMFowZVhCbEpUTkViR2x1YTBsa0pUSTJhV1FsTTBRek56Rm1ORFF4TVdVME5qTTBZemt3WWpNM1pEazRNamd5TkdOaFlUZGlNeVV5Tm1Gd2FWOXJaWGtsTTBSaFpHWTBNRGRtWkRFd09EZGhNV1UxTm1WaFpHUmxZekJtTlRreE5ESTJOeVV5Tm5OcGRHVmZhV1FsTTBReU56QmpaRFV6WldNeU16TTBaakV4T0dObFpERTBZVFJsT0dKak9EUTVaaVV5Tm1SamFDVXpSR1psWldRbE1qWmhaRjkwSlRORVlXUjJaWEowYVhObGNpVXlObmxyWDNSaFp5VXpSQ1UzUW1Oc2FXTnJhV1FsTjBRbWREMHdKbk05WldKbVpETXpOVGRsTVdJMlpqTXhNakZqT0RVNE1tWmtaV0ZrTkdWbU16VT0_Yz13ZWg1dmVwazQybmowb2owM212ZW5jZnEmdmFyMTA9&ts=1713170251162&hash=apKhrtSYvsLnkHepIPPh1da0xTQPx3iKj5xoMj496bU&rm=D IP 54.230.111.84:443
CertificateIssuerAmazon Subjectpriverautional.com Fingerprint38:E4:39:66:18:DC:93:E7:70:D9:FB:34:64:A4:34:2A:30:04:02:7A ValidityMon, 12 Feb 2024 00:00:00 GMT - Wed, 12 Mar 2025 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (725), with no line terminators Hash25b9d8f39967d83997fdaba5b316861e ee5aac9083044179a14bbaeeb5fbd597102e0276 5ec4943e0ac6cc36ee6e42f4d6d6ddc9b9443fb08efb0bb6a4ff17c10b5fd349
GET /redirect?target=BASE64aHR0cHM6Ly9hcGkuc2hvcGZpbmRlcjI0LmNvbS9yL2RHODlhSFIwY0hNbE0wRWxNa1lsTWtaeUxteHBibXR6Y0hKbUxtTnZiU1V5Um5ZeEpUSkdjbVZrYVhKbFkzUWxNMFowZVhCbEpUTkViR2x1YTBsa0pUSTJhV1FsTTBRek56Rm1ORFF4TVdVME5qTTBZemt3WWpNM1pEazRNamd5TkdOaFlUZGlNeVV5Tm1Gd2FWOXJaWGtsTTBSaFpHWTBNRGRtWkRFd09EZGhNV1UxTm1WaFpHUmxZekJtTlRreE5ESTJOeVV5Tm5OcGRHVmZhV1FsTTBReU56QmpaRFV6WldNeU16TTBaakV4T0dObFpERTBZVFJsT0dKak9EUTVaaVV5Tm1SamFDVXpSR1psWldRbE1qWmhaRjkwSlRORVlXUjJaWEowYVhObGNpVXlObmxyWDNSaFp5VXpSQ1UzUW1Oc2FXTnJhV1FsTjBRbWREMHdKbk05WldKbVpETXpOVGRsTVdJMlpqTXhNakZqT0RVNE1tWmtaV0ZrTkdWbU16VT0_Yz13ZWg1dmVwazQybmowb2owM212ZW5jZnEmdmFyMTA9&ts=1713170251162&hash=apKhrtSYvsLnkHepIPPh1da0xTQPx3iKj5xoMj496bU&rm=D HTTP/1.1
Host: priverautional.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: voluum-cid-v4=%7B%22cid%22%3A%22weh5vepk42nj0oj03mvencfq%22%2C%22caid%22%3A%2273dfb89c-fb2f-46bf-a7f7-c21ef6fbe4bf%22%7D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html;charset=UTF-8
date: Mon, 15 Apr 2024 08:37:31 GMT
cache-control: no-store, no-cache, pre-check=0, post-check=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
server: nginx
x-cache: Miss from cloudfront
via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: mCmDW-imcnnjNYoUVx4sGHlE53AcGcfhHSK-jiHyIqKkF-uMELLj2Q==
X-Firefox-Spdy: h2
|
|