| signforcover.com/paxar/QWxleGFuZHJlIFBpcmVzIERpc2NvZ3JhZmlhIENvbXBsZXRhIERvd25sb2FkIDExQWx/actor/qnhl/ZG93bmxvYWR8REM5TW0xamFueDhNVFkxT0RBd05qWTVPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA..sessions |  104.21.96.1 | 301 Moved Permanently | 0 B |
URL User Request GET signforcover.com/paxar/QWxleGFuZHJlIFBpcmVzIERpc2NvZ3JhZmlhIENvbXBsZXRhIERvd25sb2FkIDExQWx/actor/qnhl/ZG93bmxvYWR8REM5TW0xamFueDhNVFkxT0RBd05qWTVPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA..sessions IP104.21.96.1:443
CertificateIssuerGoogle Trust Services Subjectsignforcover.com FingerprintA8:4A:7A:BE:4E:08:05:C2:8A:67:72:EF:B7:E7:B0:05:C8:40:5D:BE ValiditySat, 19 Apr 2025 06:26:50 GMT - Fri, 18 Jul 2025 07:26:43 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /paxar/QWxleGFuZHJlIFBpcmVzIERpc2NvZ3JhZmlhIENvbXBsZXRhIERvd25sb2FkIDExQWx/actor/qnhl/ZG93bmxvYWR8REM5TW0xamFueDhNVFkxT0RBd05qWTVPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA..sessions HTTP/1.1
Host: signforcover.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sun, 20 Apr 2025 21:33:07 GMT
content-type: text/html; charset=UTF-8
location: https://coochig.com/?name=HZOn%2FUDA7EQ5D04o2CiN5WSJJ7Xw4Z1Bo6Hc8jcWBTExAL4q7AgqVp621o6npuqx%2FyN9zQjl%2BPosBO8sYdfvXjWbIQ38NIa55FOx2L8%3D
server: cloudflare
cf-cache-status: DYNAMIC
cf-ray: 9337c21a782c56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
| coochig.com/?name=HZOn%2FUDA7EQ5D04o2CiN5WSJJ7Xw4Z1Bo6Hc8jcWBTExAL4q7AgqVp621o6npuqx%2FyN9zQjl%2BPosBO8sYdfvXjWbIQ38NIa55FOx2L8%3D | 172.67.176.78 | 301 Moved Permanently | 0 B |
URL User Request GET coochig.com/?name=HZOn%2FUDA7EQ5D04o2CiN5WSJJ7Xw4Z1Bo6Hc8jcWBTExAL4q7AgqVp621o6npuqx%2FyN9zQjl%2BPosBO8sYdfvXjWbIQ38NIa55FOx2L8%3D IP172.67.176.78:443
CertificateIssuerGoogle Trust Services Subjectcoochig.com FingerprintA9:78:EA:F7:7F:31:17:32:67:D9:95:90:02:44:F4:41:89:CD:97:79 ValidityThu, 03 Apr 2025 17:02:58 GMT - Wed, 02 Jul 2025 18:01:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?name=HZOn%2FUDA7EQ5D04o2CiN5WSJJ7Xw4Z1Bo6Hc8jcWBTExAL4q7AgqVp621o6npuqx%2FyN9zQjl%2BPosBO8sYdfvXjWbIQ38NIa55FOx2L8%3D HTTP/1.1
Host: coochig.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sun, 20 Apr 2025 21:33:08 GMT
content-type: text/html; charset=UTF-8
location: https://media.goga21.sbs/Alexandre+Pires+Discografia+Completa+Download+11.zip
server: cloudflare
cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 9337c21f8869b503-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
| media.goga21.sbs/Alexandre+Pires+Discografia+Completa+Download+11.zip | 104.21.43.2 | 302 Found | 0 B |
URL User Request GET media.goga21.sbs/Alexandre+Pires+Discografia+Completa+Download+11.zip IP104.21.43.2:443
CertificateIssuerGoogle Trust Services Subjectgoga21.sbs FingerprintDB:22:BA:FC:1D:4F:02:84:BF:1B:E2:49:C7:94:A8:83:9E:CD:CD:E9 ValiditySun, 20 Apr 2025 02:55:09 GMT - Sat, 19 Jul 2025 03:54:42 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /Alexandre+Pires+Discografia+Completa+Download+11.zip HTTP/1.1
Host: media.goga21.sbs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Sun, 20 Apr 2025 21:33:09 GMT
content-type: text/html;charset=UTF-8
location: https://nbdownload.space/setup.exe
server: cloudflare
x-powered-by: PHP/8.2.12
cache-control: no-store
cf-cache-status: BYPASS
cf-ray: 9337c222b9a50b61-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
| nbdownload.space/setup.exe | 0.0.0.0 | | 0 B |
URL User Request GET nbdownload.space/setup.exe IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /setup.exe HTTP/1.1
Host: nbdownload.space
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
0.0.0.0