| ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? |  104.21.68.147 | 403 Forbidden | 167 B |
URL User Request GET HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? IP104.21.68.147:443
CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash0104c301c5e02bd6148b8703d19b3a73 7436e0b4b1f8c222c38069890b75fa2baf9ca620 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /usafsbprogram22/Usaabf/hjsjs/ul/signin.php? HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Fri, 10 May 2024 17:37:40 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Fri, 10 May 2024 18:37:40 GMT
Location: https://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php?
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gQYfQ6H3oURRQyjBPLUsLtJ7Vak0NSGTPU5N%2B63QjItHw9MHCaiiSSqCLEjA7prpXd0%2BsNOYWVuJoQ73e4B6LKkEBzG05hgKOggxWekMcrISq%2BGFzzcXsG5FAaanZkxdiAq4tFbasbtlhD8nzR7k2%2FndNSLfTqc%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 881bb2d47d5c56c0-OSL
alt-svc: h2=":443"; ma=60
|
|
| ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/scripts/jsd/main.js |  172.67.196.46 | 302 Found | 0 B |
URL GET HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/scripts/jsd/main.js IP172.67.196.46:443
Requested byhttps://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA; RtAf40fjxMn2d3lK8ZsP7f-Fz3o=lkLPZiL_UVgRTxwDers97UXe5XU
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
date: Fri, 10 May 2024 17:37:40 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/1b3559406bc8/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GpHPgQ2l84ZJy8QVrzh6gAzkHYtxN3869gGsR7liUlFrzSL2CXUTh7WTGMh0QDxbz0sR1B%2FWDRtGDMvwamTI0c1BA0R%2FRDeG3nOr7sbsP87T1Iei2KFOh1%2F2ghekqCbdplak1m3EBlPQgDTvMojx7u6en9J8wFo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881bb2d5f9ed56ba-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? | 172.67.196.46 | 403 Forbidden | 0 B |
URL User Request GET HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? IP172.67.196.46:443
CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /usafsbprogram22/Usaabf/hjsjs/ul/signin.php? HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
SQM90zas4KBcXNenSxKpWLieEY8: 29292533
X-Requested-with: XMLHttpRequest
X-Requested-TimeStamp:
X-Requested-TimeStamp-Expire:
X-Requested-TimeStamp-Combination:
X-Requested-Type: GET
X-Requested-Type-Combination: GET
qJkvc1IV9rQ8SIJ1MjgW-6nTO1k: sQLOkLuWjMXe4EUwXpvcs0tCPMk
Content-type: application/x-www-form-urlencoded
Content-Length: 22
Origin: https://ufdciaauaaplmzwbeyaokmatredfusaa.com
DNT: 1
Connection: keep-alive
Referer: https://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php?
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA; RtAf40fjxMn2d3lK8ZsP7f-Fz3o=lkLPZiL_UVgRTxwDers97UXe5XU
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Fri, 10 May 2024 17:37:40 GMT
x-content-type-options: nosniff, nosniff
x-xss-protection: 1; mode=block, 1; mode=block
set-cookie: 5afkA8Uw5QEtf8MT-PSFtH555AE=xGvcNAUiktZj2YWAIWEVXrdZ9fc; path=/; expires=Sat, 11-May-24 17:37:40 GMT; Max-Age=86400;
Q5sHC0UYlJcCDIgeBI4hzS4w5tI=1715362660; path=/; expires=Sat, 11-May-24 17:37:40 GMT; Max-Age=86400;
VrO2YzwdX4YbOz1Sw80v3pzlkOY=1715449060; path=/; expires=Sat, 11-May-24 17:37:40 GMT; Max-Age=86400;
JQmfu9DzqCD4wdTjzvmqDd-dLKw=7qPmYOHaSNQMd42dMucBm90OAtM; path=/; expires=Sat, 11-May-24 17:37:40 GMT; Max-Age=86400;
2e4uoFZk3KXVXUmPeHGlYRYvV_0=yAHryJG02H0NdjnjVfsWQO9Xpqc; path=/; expires=Sat, 11-May-24 17:37:40 GMT; Max-Age=86400;
x-frame-options: SAMEORIGIN
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: 0
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KrTM%2FPj8orfnW%2FgzHTwV5%2FCxBZv991USeDW2R1mKrDpNGWYF%2BjRWSX68CivTrtbePaJv3SRMeEiq13eIomFMWqPyaVXVar0Zyh8CIoCvOEeQWbyrdxZSBcHTZWfShKOhoj2XiF91eJSuUnTYe9V4fwkQlFc6Ekw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881bb2d5e9d156ba-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/scripts/jsd/main.js | 172.67.196.46 | 302 Found | 0 B |
URL GET HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/scripts/jsd/main.js IP172.67.196.46:443
Requested byhttps://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA; RtAf40fjxMn2d3lK8ZsP7f-Fz3o=lkLPZiL_UVgRTxwDers97UXe5XU; 5afkA8Uw5QEtf8MT-PSFtH555AE=xGvcNAUiktZj2YWAIWEVXrdZ9fc; Q5sHC0UYlJcCDIgeBI4hzS4w5tI=1715362660; VrO2YzwdX4YbOz1Sw80v3pzlkOY=1715449060; JQmfu9DzqCD4wdTjzvmqDd-dLKw=7qPmYOHaSNQMd42dMucBm90OAtM; 2e4uoFZk3KXVXUmPeHGlYRYvV_0=yAHryJG02H0NdjnjVfsWQO9Xpqc; tuyscvZo3ZT7L3NasOEE0ebTKwc=o1UHh1sQAcWr17dzYp1_E41oJ9U; a4Qzxg2e5Kbbt4O3OuEphMz2Buo=1715362652; 2izDrPddNFe7C8vzomxuPVLw0dE=1715449052; 7aEbXH_ovQyRdR1rxxucKflHd1U=l7_6tzAf7ldJQfnyxUZ_ofB4Odg
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Fri, 10 May 2024 17:37:41 GMT
content-length: 0
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/1b3559406bc8/main.js
cache-control: max-age=300, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R4XVXa%2B6NJSVMdcjqEHElEFNiNbfnNarg9azbeTRsfS649t7xG0aCJzqZVTlxr265qcmtX9ifWsfVso1ThsV%2FkkLeDMKvZfTNZVph5nHZPCNUkaMfDQuXV1d5dsickd%2FldfVM2NXfScTRbV2auaAccpiihdZrZ0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881bb2d838090b06-OSL
alt-svc: h3=":443"; ma=86400
|
|
| ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/1b3559406bc8/main.js | 172.67.196.46 | 200 OK | 3.7 kB |
URL GET HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/1b3559406bc8/main.js IP172.67.196.46:443
Requested byhttps://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
File typeJavaScript source, ASCII text, with very long lines (7864), with no line terminators Hash0c33c1f83a5f37b52b5cc879194893cc 7b352ca41b1ec43de45d3d0e32e23ac6f72398e9 e1e9ff364af055567720ac7c038e9730d7ace239432fa3d79e8636f854c7a39d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/1b3559406bc8/main.js HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA; RtAf40fjxMn2d3lK8ZsP7f-Fz3o=lkLPZiL_UVgRTxwDers97UXe5XU; 5afkA8Uw5QEtf8MT-PSFtH555AE=xGvcNAUiktZj2YWAIWEVXrdZ9fc; Q5sHC0UYlJcCDIgeBI4hzS4w5tI=1715362660; VrO2YzwdX4YbOz1Sw80v3pzlkOY=1715449060; JQmfu9DzqCD4wdTjzvmqDd-dLKw=7qPmYOHaSNQMd42dMucBm90OAtM; 2e4uoFZk3KXVXUmPeHGlYRYvV_0=yAHryJG02H0NdjnjVfsWQO9Xpqc; tuyscvZo3ZT7L3NasOEE0ebTKwc=o1UHh1sQAcWr17dzYp1_E41oJ9U; a4Qzxg2e5Kbbt4O3OuEphMz2Buo=1715362652; 2izDrPddNFe7C8vzomxuPVLw0dE=1715449052; 7aEbXH_ovQyRdR1rxxucKflHd1U=l7_6tzAf7ldJQfnyxUZ_ofB4Odg
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 17:37:41 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RD2qhU1nBxlmmKRy03luT4i0npZXOt00%2BiGoohB1YDW3ovUHRRhKilRfsiAa4pNneORYcv2rQZ5fZ2bYuTLk6OTwoOTXECS7GyJ6ZOFtMWsKH0V4fP6zhjxHgQdilJ8u6KVLtBOu7ev%2FwFuSt%2FlRUYZlHavo31I%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881bb2d8582c0b06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/h/g/jsd/r/881bb2d74ee50b06 | 172.67.196.46 | 200 OK | 0 B |
URL POST HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/cdn-cgi/challenge-platform/h/g/jsd/r/881bb2d74ee50b06 IP172.67.196.46:443
Requested byhttps://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/g/jsd/r/881bb2d74ee50b06 HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12272
Origin: https://ufdciaauaaplmzwbeyaokmatredfusaa.com
DNT: 1
Connection: keep-alive
Referer: https://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php?
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA; RtAf40fjxMn2d3lK8ZsP7f-Fz3o=lkLPZiL_UVgRTxwDers97UXe5XU; 5afkA8Uw5QEtf8MT-PSFtH555AE=xGvcNAUiktZj2YWAIWEVXrdZ9fc; Q5sHC0UYlJcCDIgeBI4hzS4w5tI=1715362660; VrO2YzwdX4YbOz1Sw80v3pzlkOY=1715449060; JQmfu9DzqCD4wdTjzvmqDd-dLKw=7qPmYOHaSNQMd42dMucBm90OAtM; 2e4uoFZk3KXVXUmPeHGlYRYvV_0=yAHryJG02H0NdjnjVfsWQO9Xpqc; tuyscvZo3ZT7L3NasOEE0ebTKwc=o1UHh1sQAcWr17dzYp1_E41oJ9U; a4Qzxg2e5Kbbt4O3OuEphMz2Buo=1715362652; 2izDrPddNFe7C8vzomxuPVLw0dE=1715449052; 7aEbXH_ovQyRdR1rxxucKflHd1U=l7_6tzAf7ldJQfnyxUZ_ofB4Odg
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 17:37:41 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=ki4ex_EtC_fOSwzdI8UaLmwFSPFFDY.n1yDvK.lzm3c-1715362661-1.0.1.1-7iYBMx8hdMivVAV9l.TpeJKkUCOPN7qELcqPcN5XumDn50U.qGDFspOAcVLO3Oaz5RA1B0qVveTCSuUQQBzGBQ; Path=/; Expires=Sat, 10-May-25 17:37:41 GMT; Domain=.ufdciaauaaplmzwbeyaokmatredfusaa.com; HttpOnly; Secure; SameSite=None; Partitioned
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z%2BaL43O8LLJW2oGBXY6zuiHP5FHaF%2Bvqh7pSQAiU84jFNZAt6D2Yd%2BK0vhfgVGPSdP9GsC2FOj6gycNDjXCXaU%2BJ1B%2FaU1arfh8c9h6I9mByOP56XgLH7RkN2FCmu6ecqciOTklOaX0s4GbZBuvC4D4PgHjI1Jo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881bb2d9594f0b06-OSL
alt-svc: h3=":443"; ma=86400
|
|
| ufdciaauaaplmzwbeyaokmatredfusaa.com/favicon.ico | 172.67.196.46 | 403 Forbidden | 146 B |
URL GET HTTP/3ufdciaauaaplmzwbeyaokmatredfusaa.com/favicon.ico IP172.67.196.46:443
Requested byhttps://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php? CertificateIssuerLet's Encrypt Subjectufdciaauaaplmzwbeyaokmatredfusaa.com Fingerprint0B:C7:84:65:13:08:4B:CD:93:C6:8A:37:F4:60:7E:1B:B0:D6:E7:D6 ValidityFri, 26 Apr 2024 20:58:09 GMT - Thu, 25 Jul 2024 20:58:08 GMT
File typeHTML document, ASCII text, with no line terminators Hashbcfacc6f2d2ee7cd5e014be08612f93e 7bb6f49a83b5186d5f8598e852bfbeee102d8a4d ef1a3d1af87d9d441ef37f001f2ffb6900ef0a7a4884a5ef165bc2b09e224b38
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: ufdciaauaaplmzwbeyaokmatredfusaa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ufdciaauaaplmzwbeyaokmatredfusaa.com/usafsbprogram22/Usaabf/hjsjs/ul/signin.php?
Cookie: pQbJ-Ezi4yw7IjnjypCGddvVvGQ=GNSkrz3rSTjyh1nhsNkT_IhbDjc; sKudDDdKQpsrJwn0P9ZotuTtgSs=1715362593; YxzLIktIEn_c45KGfU55sjsdcuU=1715448993; 8IP89DCcIawY6LXV7zPV0loOz5E=hwOHv6-B86OXLtdft4vhCrSWKEo; 54NJEg7PidlXA0t7E7luW-uWeDU=INAdC-y8ueIJZbpdq95L8XfuLWA; RtAf40fjxMn2d3lK8ZsP7f-Fz3o=lkLPZiL_UVgRTxwDers97UXe5XU; 5afkA8Uw5QEtf8MT-PSFtH555AE=xGvcNAUiktZj2YWAIWEVXrdZ9fc; Q5sHC0UYlJcCDIgeBI4hzS4w5tI=1715362660; VrO2YzwdX4YbOz1Sw80v3pzlkOY=1715449060; JQmfu9DzqCD4wdTjzvmqDd-dLKw=7qPmYOHaSNQMd42dMucBm90OAtM; 2e4uoFZk3KXVXUmPeHGlYRYvV_0=yAHryJG02H0NdjnjVfsWQO9Xpqc; tuyscvZo3ZT7L3NasOEE0ebTKwc=o1UHh1sQAcWr17dzYp1_E41oJ9U; a4Qzxg2e5Kbbt4O3OuEphMz2Buo=1715362652; 2izDrPddNFe7C8vzomxuPVLw0dE=1715449052; 7aEbXH_ovQyRdR1rxxucKflHd1U=l7_6tzAf7ldJQfnyxUZ_ofB4Odg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Fri, 10 May 2024 17:37:41 GMT
content-type: text/html
x-content-type-options: nosniff, nosniff
x-xss-protection: 1; mode=block, 1; mode=block
cache-control: public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutable
pragma: public
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QzfjBo1LIkqJ1n8DAVQ6cJ4up3FOMW%2Fn2AhCTYn8i7N%2F0DEmkKBCagZ3acVjvIoN2e9I4wuNxPZJggOZTwGUKZltS%2BAvotYaw855gnGxg0pYotA8o0DLunqHTf5QQYIqA6G3bVoiyIqLAeUok4mNGUNOarmzIf4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881bb2d82fee0b06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|