Report - yashalava.sh

Report Overview

Visited public
2025-01-12 11:17:39
Tags
Submit Tags
URL
yashalava.sh
Finishing URL
yashalava.sh/
IP / ASN
172.67.191.241
#13335 CLOUDFLARENET
Title
Rive Animation

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
yashalava.sh	unknown	2024-11-01	2024-12-31	2024-12-31	1.7 kB	392 kB	172.67.191.241
unpkg.com	11693	2016-01-06	2016-01-07	2025-01-08	1.3 kB	719 kB	104.17.247.203
ny1.xmrminingproxy.com	unknown	2017-12-22	2024-03-27	2024-12-24	1.6 kB	2.4 kB	172.67.135.46
cdn.jsdelivr.net	439	2012-05-16	2012-09-30	2025-01-08	431 B	65 kB	151.101.129.229

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-12 11:17:15	medium	Client IP	172.67.135.46	ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI)
2025-01-12 11:17:15	medium	Client IP	172.67.135.46	ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI)
2025-01-12 11:17:35	medium	Client IP	172.67.135.46	ET MALWARE Observed CoinMiner Proxy Domain (xmrminingproxy .com in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-01-12	medium	xmrminingproxy.com	Sinkholed
2025-01-12	medium	xmrminingproxy.com	Sinkholed
2025-01-12	medium	xmrminingproxy.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	unpkg.com/@rive-app/canvas@2.7.0	ScriptElement	140 kB	2023-10-29	2025-07-08
Pretty URL unpkg.com/@rive-app/canvas@2.7.0 IP 104.17.247.203 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-29 21:58 Last Seen2025-07-08 00:51 Times Seen14 Hash 1685235c976ee3f9b65cd3d4d4e4d3b1 3da375bb662f57a785ab4b68782b18e3e0f8d8e8 94d9becc37e56f3ff1c2e6707cd93b4766d4b81d0d2838d6813ad04e37f9ce68 Loading...

	cdn.jsdelivr.net/gh/NajmAjmal/monero-webminer@main/script.js	ScriptElement	196 kB	2023-04-15	2025-06-24
Pretty URL cdn.jsdelivr.net/gh/NajmAjmal/monero-webminer@main/script.js IP 151.101.129.229 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-15 06:12 Last Seen2025-06-24 18:43 Times Seen32 Hash 386c845e842c33f96075aa0d7205f85a 914eebea9ea3df7a38f76818843a6925323c0117 53b8263b398505c7655e007bea6fc926552e0a3a82924c22c4c2ad00a4f9d6b8 Loading...

	yashalava.sh/	ScriptElement	0 B	0001-01-01	2025-07-16
Pretty URL yashalava.sh/ IP 172.67.191.241 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-07-16 08:47 Times Seen5434392 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	yashalava.sh/	ScriptElement	0 B	0001-01-01	2025-07-16
Pretty URL yashalava.sh/ IP 172.67.191.241 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-07-16 08:47 Times Seen5434392 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (11)

URL IP Response Size

GET cdn.jsdelivr.net/gh/NajmAjmal/monero-webminer@main/script.js

151.101.129.229

200 OK

64 kB

URL GET HTTP/2
cdn.jsdelivr.net/gh/NajmAjmal/monero-webminer@main/script.js
IP
151.101.129.229:443
ASN
#54113 FASTLY

Requested by
https://yashalava.sh/
Certificate
IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint6C:45:F5:9E:D3:37:60:0B:9C:A8:28:29:A4:E6:41:33:BB:2E:76:5C
ValidityTue, 30 Jul 2024 15:36:05 GMT - Sun, 31 Aug 2025 15:36:04 GMT

File type
JavaScript source, ASCII text, with very long lines (46337)
Size
64 kB (63853 bytes)
Hash
386c845e842c33f96075aa0d7205f85a
914eebea9ea3df7a38f76818843a6925323c0117
53b8263b398505c7655e007bea6fc926552e0a3a82924c22c4c2ad00a4f9d6b8

HTTP Headers

GET /gh/NajmAjmal/monero-webminer@main/script.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://yashalava.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: main
x-jsd-version-type: branch
etag: W/"2ff7a-kU7r6p6j33o492gYhDppJTI8ARc"
content-encoding: br
accept-ranges: bytes
date: Sun, 12 Jan 2025 11:17:13 GMT
age: 11563
x-served-by: cache-fra-etou8220085-FRA, cache-hel1410034-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 63853
X-Firefox-Spdy: h2

GET yashalava.sh/1.riv

172.67.191.241

200 OK

7.2 kB

URL GET HTTP/3
yashalava.sh/1.riv
IP
172.67.191.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectyashalava.sh
Fingerprint43:57:37:F5:B3:A4:D8:18:8D:6C:5B:72:0E:A9:B1:4B:F8:A0:31:5D
ValidityMon, 30 Dec 2024 19:25:56 GMT - Sun, 30 Mar 2025 20:23:29 GMT

File type
data
Size
7.2 kB (7197 bytes)
Hash
08b1cb787a861a18bf4aa8052824325c
20cc3b147dbc99736f98e7dd56fbd2c3d4be5c0f
19f56e47052e1b4b038b95a47928abb20877e19b986a1959f1482443e0ca7015

HTTP Headers

GET /1.riv HTTP/1.1
Host: yashalava.sh
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://yashalava.sh/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 12 Jan 2025 11:17:13 GMT
content-length: 7197
last-modified: Sat, 02 Nov 2024 13:06:01 GMT
etag: "1c1d-625edb6a02f31"
accept-ranges: bytes
cf-cache-status: DYNAMIC
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NUNnN83M1Y0aItDVqvsl3u2wcPicBKk0hdOXOMQaIVBExp2JOyBfVbkN9DgPotHt2859oBTPlBAH8hQjkCUsdi%2F17ej4TxgFnFu1A5qYpPME2%2BlWNpHBD52%2BaIl74xw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 900cbd290be25690-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3824&min_rtt=2771&rtt_var=1791&sent=14&recv=9&lost=0&retrans=0&sent_bytes=4180&recv_bytes=1433&delivery_rate=214301&cwnd=12000&unsent_bytes=0&cid=9619db3cab6d7ccc&ts=668&x=1", cfExtPri, cfHdrFlush;dur=0

GET yashalava.sh/smol.jpeg

172.67.191.241

200 OK

65 kB

URL GET HTTP/3
yashalava.sh/smol.jpeg
IP
172.67.191.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectyashalava.sh
Fingerprint43:57:37:F5:B3:A4:D8:18:8D:6C:5B:72:0E:A9:B1:4B:F8:A0:31:5D
ValidityMon, 30 Dec 2024 19:25:56 GMT - Sun, 30 Mar 2025 20:23:29 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 640x639, components 3
Size
65 kB (64999 bytes)
Hash
63c9188755e68f8a20910c637258a1ae
e8e3f25496ed143f816951b2a0f82229fce6bbc9
29586927554aaa7a3ed524abca900437f4f150014b49d6acff70ef2ccf688a2d

HTTP Headers

GET /smol.jpeg HTTP/1.1
Host: yashalava.sh
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://yashalava.sh/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 12 Jan 2025 11:17:13 GMT
content-type: image/jpeg
content-length: 64999
last-modified: Sat, 02 Nov 2024 13:06:02 GMT
etag: "672623ba-fde7"
expires: Wed, 26 Feb 2025 11:17:13 GMT
cache-control: max-age=3888000
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wxKjk413TzzRgMI577dU%2Fqv4i4DPFTqLasU6wNFxw2SrlU0k2fB0qepj5qC2KP1AbtNRwefaDk5fXyF%2BgE8b8gV9uWvJEmd0WkEQVnGrB4qEEeFHRf4RacGyCJHYA7o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 900cbd289b4e5690-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3654&min_rtt=2462&rtt_var=1684&sent=21&recv=10&lost=0&retrans=0&sent_bytes=12243&recv_bytes=1477&delivery_rate=12357&cwnd=12000&unsent_bytes=0&cid=9619db3cab6d7ccc&ts=694&x=1", cfExtPri, cfHdrFlush;dur=0

GET unpkg.com/@rive-app/canvas@2.7.0/rive.wasm

104.17.247.203

200 OK

436 kB

URL GET HTTP/2
unpkg.com/@rive-app/canvas@2.7.0/rive.wasm
IP
104.17.247.203:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectunpkg.com
Fingerprint1F:04:D7:F7:5E:E0:63:B8:0D:F5:CB:BF:E1:AB:D5:B6:AD:F6:D4:A9
ValidityThu, 02 Jan 2025 21:29:46 GMT - Wed, 02 Apr 2025 22:29:43 GMT

File type
WebAssembly (wasm) binary module version 0x1 (MVP)
Size
436 kB (436411 bytes)
Hash
c1b25f611f757fe93116d5e913d9c0e1
58b692dfe57bc1c3ef7de4c91d55c7a2fd29fc15
ed455a666b6e0ba3d7ba4aed37d80d2e547f198d78fa44e41ad567793d09abbf

HTTP Headers

GET /@rive-app/canvas@2.7.0/rive.wasm HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://yashalava.sh/
Origin: https://yashalava.sh
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sun, 12 Jan 2025 11:17:13 GMT
content-type: application/wasm
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "ba357-WLaS3+V7wcPvfeTJHVXHov0p/BU"
via: 1.1 fly.io
fly-request-id: 01J08NP9EP6F2PTCK4XAJD7CVX-arn
cf-cache-status: HIT
age: 18402524
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 900cbd28afa656bd-OSL
X-Firefox-Spdy: h2

ny1.xmrminingproxy.com/

172.67.135.46

101 Switching Protocols

0 B

URL
ny1.xmrminingproxy.com/
IP
172.67.135.46:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: ny1.xmrminingproxy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://yashalava.sh
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 4+xd3Fu/bu2wIxahXvA7fg==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Sun, 12 Jan 2025 11:17:16 GMT
Connection: upgrade
Sec-Websocket-Accept: i2MtyWgCpQSsnN3nZqielPrjQGA=
Upgrade: websocket
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N86SSP%2FK3C9w6pLKJpXQKI3WhG85WnkkxJ2iThq2ckwi9FkM8mgL2C4v9laFoUzHygS0iDkG3NEchnIX6Y1WrC%2Foyu8qkvhpyeWyBE8lQCQqlJk2M107hp966KAWAA4aprM%2BGLUKP7DV"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 900cbd358eef712f-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=466&min_rtt=437&rtt_var=139&sent=5&recv=8&lost=0&retrans=0&sent_bytes=3132&recv_bytes=1149&delivery_rate=8014760&cwnd=252&unsent_bytes=0&cid=5eca9aa41b8d27ee&ts=406&x=0"

ny1.xmrminingproxy.com/

172.67.135.46

101 Switching Protocols

0 B

URL
ny1.xmrminingproxy.com/
IP
172.67.135.46:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: ny1.xmrminingproxy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://yashalava.sh
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Wnwkl2wP6LBHKaMEi/nrhw==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Sun, 12 Jan 2025 11:17:36 GMT
Connection: upgrade
Sec-Websocket-Accept: ZLVKjCUK893Za9KucVP3Q83AHzE=
Upgrade: websocket
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BZn0SwOy1e7zcqT3eH6rx2DZJdDVP4zJ0AeZTFD4RjqZa3VDpx2dzxRXIWb4dN%2FjemKgRsTZmc78hjrCfyLvrDAhKV%2BnPGzMyJ20bOANk20POswIXRF%2BFtctG5WYcwjDv3%2FstSxIRscI"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 900cbdb25ab1b524-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=539&min_rtt=471&rtt_var=206&sent=5&recv=8&lost=0&retrans=0&sent_bytes=3207&recv_bytes=1281&delivery_rate=6188034&cwnd=252&unsent_bytes=0&cid=abd5bcf64a8678a1&ts=354&x=0"

GET unpkg.com/@rive-app/canvas@2.7.0/rive.js

104.17.247.203

200 OK

140 kB

URL GET HTTP/2
unpkg.com/@rive-app/canvas@2.7.0/rive.js
IP
104.17.247.203:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectunpkg.com
Fingerprint1F:04:D7:F7:5E:E0:63:B8:0D:F5:CB:BF:E1:AB:D5:B6:AD:F6:D4:A9
ValidityThu, 02 Jan 2025 21:29:46 GMT - Wed, 02 Apr 2025 22:29:43 GMT

File type
JavaScript source, ASCII text, with very long lines (791)
Size
140 kB (140543 bytes)
Hash
1685235c976ee3f9b65cd3d4d4e4d3b1
3da375bb662f57a785ab4b68782b18e3e0f8d8e8
94d9becc37e56f3ff1c2e6707cd93b4766d4b81d0d2838d6813ad04e37f9ce68

HTTP Headers

GET /@rive-app/canvas@2.7.0/rive.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://yashalava.sh/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 12 Jan 2025 11:17:13 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "224ff-PaN1u2YvV6eFq0toeCsY4+D42Og"
via: 1.1 fly.io
fly-request-id: 01JH42CS5ENJAD16HEQGGW6WXY-arn
cf-cache-status: HIT
age: 303369
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 900cbd27bea756bd-OSL
X-Firefox-Spdy: h2

GET ny1.xmrminingproxy.com/

172.67.135.46

101 Switching Protocols

0 B

URL GET HTTP/1.1
ny1.xmrminingproxy.com/
IP
172.67.135.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectxmrminingproxy.com
Fingerprint7A:B0:A2:D9:18:5F:9A:C0:60:23:7D:8C:49:0C:0F:9B:B8:CB:D2:D2
ValiditySun, 05 Jan 2025 16:30:04 GMT - Sat, 05 Apr 2025 17:28:29 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: ny1.xmrminingproxy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://yashalava.sh
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 4+xd3Fu/bu2wIxahXvA7fg==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Sun, 12 Jan 2025 11:17:16 GMT
Connection: upgrade
Sec-Websocket-Accept: i2MtyWgCpQSsnN3nZqielPrjQGA=
Upgrade: websocket
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N86SSP%2FK3C9w6pLKJpXQKI3WhG85WnkkxJ2iThq2ckwi9FkM8mgL2C4v9laFoUzHygS0iDkG3NEchnIX6Y1WrC%2Foyu8qkvhpyeWyBE8lQCQqlJk2M107hp966KAWAA4aprM%2BGLUKP7DV"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 900cbd358eef712f-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=466&min_rtt=437&rtt_var=139&sent=5&recv=8&lost=0&retrans=0&sent_bytes=3132&recv_bytes=1149&delivery_rate=8014760&cwnd=252&unsent_bytes=0&cid=5eca9aa41b8d27ee&ts=406&x=0"

GET yashalava.sh/

172.67.191.241

200 OK

2.2 kB

URL User Request GET HTTP/2
yashalava.sh/
IP
172.67.191.241:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectyashalava.sh
Fingerprint43:57:37:F5:B3:A4:D8:18:8D:6C:5B:72:0E:A9:B1:4B:F8:A0:31:5D
ValidityMon, 30 Dec 2024 19:25:56 GMT - Sun, 30 Mar 2025 20:23:29 GMT

File type
HTML document, ASCII text, with very long lines (2258), with no line terminators
Size
2.2 kB (2163 bytes)
Hash
1579127c0c95c3d66087a8aa8638a6ed
83e5336552280b6413881cf051ae622822ff4d66
df9f7ab9600025ad6832636f6fdfaf913eb55048ddc1f54822557ee8c5815231

HTTP Headers

GET / HTTP/1.1
Host: yashalava.sh
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 12 Jan 2025 11:17:13 GMT
content-type: text/html
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L3LfEt0LN6RfM7nCQN9RCtAxU%2BlQwTkYinYI%2BMLQLMF6qSvgUKQb%2FBerQGEZlFoBDR4Q6qcXRRXs6Fli7fujVCy72htQmKSUUtlqKacgsm3S2fUhU9i5F5T79%2BdqAhE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 900cbd244fbdb500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6272&min_rtt=485&rtt_var=11254&sent=9&recv=12&lost=0&retrans=1&sent_bytes=3291&recv_bytes=1165&delivery_rate=7192052&cwnd=256&unsent_bytes=0&cid=6899b777d4f210aa&ts=134&x=0"
X-Firefox-Spdy: h2

GET unpkg.com/@rive-app/canvas@2.7.0

104.17.247.203

302 Found

140 kB

URL GET HTTP/2
unpkg.com/@rive-app/canvas@2.7.0
IP
104.17.247.203:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectunpkg.com
Fingerprint1F:04:D7:F7:5E:E0:63:B8:0D:F5:CB:BF:E1:AB:D5:B6:AD:F6:D4:A9
ValidityThu, 02 Jan 2025 21:29:46 GMT - Wed, 02 Apr 2025 22:29:43 GMT

File type

Size
140 kB (140543 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /@rive-app/canvas@2.7.0 HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://yashalava.sh/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sun, 12 Jan 2025 11:17:13 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
location: /@rive-app/canvas@2.7.0/rive.js
vary: Accept, Accept-Encoding
content-encoding: br
via: 1.1 fly.io
fly-request-id: 01JH42CRW0MQHZGJSB791QDTEB-arn
cf-cache-status: HIT
age: 303370
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 900cbd277e6856bd-OSL
X-Firefox-Spdy: h2

GET yashalava.sh/favicon.ico

172.67.191.241

404 Not Found

314 kB

URL GET HTTP/3
yashalava.sh/favicon.ico
IP
172.67.191.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://yashalava.sh/
Certificate
IssuerGoogle Trust Services
Subjectyashalava.sh
Fingerprint43:57:37:F5:B3:A4:D8:18:8D:6C:5B:72:0E:A9:B1:4B:F8:A0:31:5D
ValidityMon, 30 Dec 2024 19:25:56 GMT - Sun, 30 Mar 2025 20:23:29 GMT

File type

Size
314 kB (313903 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: yashalava.sh
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://yashalava.sh/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Sun, 12 Jan 2025 11:17:14 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ceVFwSMxc1K13cXoIRYnjyu%2Fkq%2F65rvg84zI9yCNb2WLZasa1ZMu2Hw7WKcumSh75%2FrX%2BVWP%2Bzw43qI4HnOAW8KpF223G2SIkotuNqVXpggE4jTYOA%2BQS2mwwbaZQqY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 900cbd29aca45690-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3136&min_rtt=1476&rtt_var=1414&sent=79&recv=14&lost=0&retrans=0&sent_bytes=79606&recv_bytes=1876&delivery_rate=10846851&cwnd=48000&unsent_bytes=0&cid=9619db3cab6d7ccc&ts=865&x=1", cfExtPri, cfHdrFlush;dur=0

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN