| twint-ch.me/ch/panel/view.php?vid=712 | 172.67.183.45 | 301 Moved Permanently | 167 B |
URL User Request GET HTTP/3twint-ch.me/ch/panel/view.php?vid=712 IP 172.67.183.45:443
CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash0104c301c5e02bd6148b8703d19b3a73 7436e0b4b1f8c222c38069890b75fa2baf9ca620 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /ch/panel/view.php?vid=712 HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Thu, 05 Dec 2024 10:20:15 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 05 Dec 2024 11:20:15 GMT
Location: https://twint-ch.me/ch/panel/view.php?vid=712
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oh44GiA7ptm5GdWaR51OU2IHHSgBqMfIqjmaYKH%2BEi693Qfu6M82bPN%2FkYh2kabpCGWfP%2B%2FAkV6MnqdXKY63C53Hs9X3vguiD1SP9Y4G7u3n%2F1weJbTdzBUZgXHNSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8ed34d7369b2b4f1-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=611&min_rtt=611&rtt_var=305&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=611&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| twint-ch.me/cdn-cgi/challenge-platform/scripts/jsd/main.js | 172.67.183.45 | 302 Found | 0 B |
URL GET HTTP/3twint-ch.me/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 172.67.183.45:443
Requested byhttps://twint-ch.me/ch/panel/view.php?vid=712 CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
date: Thu, 05 Dec 2024 10:20:15 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DfpT%2FVNgkbqK78xJDiZcB2%2Fs13EIUPckWcGFPP2t60BLcC1ZgaN%2F1gNRXgIghfyI%2FkobZD4zMQK9H58osbZOSQjreAyScRC0IKNspGlr5y1LL9tikHthjrxxx5TWAw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ed34d756ef656b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=881&min_rtt=446&rtt_var=613&sent=27&recv=24&lost=0&retrans=1&sent_bytes=20918&recv_bytes=2407&delivery_rate=13865937&cwnd=254&unsent_bytes=0&cid=f3c588c0a8d55a77&ts=706&x=0"
X-Firefox-Spdy: h2
|
|
| twint-ch.me/ch/panel/view.php?vid=712 | 172.67.183.45 | 204 No Content | 0 B |
URL User Request GET HTTP/3twint-ch.me/ch/panel/view.php?vid=712 IP 172.67.183.45:443
CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
POST /ch/panel/view.php?vid=712 HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
6gro5-m54tufZ53dyHwarhH4Tww: 24363228
X-Requested-with: XMLHttpRequest
X-Requested-TimeStamp:
X-Requested-TimeStamp-Expire:
X-Requested-TimeStamp-Combination:
X-Requested-Type: GET
X-Requested-Type-Combination: GET
amvXYRWdBxatQ-L3Rjh6ybCAmE: SxbyuHztqIjcbSl5Pqb2uJoRNMk
Content-type: application/x-www-form-urlencoded
Content-Length: 22
Origin: https://twint-ch.me
DNT: 1
Connection: keep-alive
Referer: https://twint-ch.me/ch/panel/view.php?vid=712
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Thu, 05 Dec 2024 10:20:15 GMT
x-content-type-options: nosniff, nosniff
x-xss-protection: 1; mode=block, 1; mode=block
set-cookie: 54RgWQKAIdS29A0nLtwMlpZNQ-0=xGvcNAUiktZj2YWAIWEVXrdZ9fc; path=/; expires=Fri, 06-Dec-24 10:20:15 GMT; Max-Age=86400;
dDgqnrDDRIkRu5RPbwNzzooEgUk=1733394015; path=/; expires=Fri, 06-Dec-24 10:20:15 GMT; Max-Age=86400;
7roncJcHeEnIrFkPnWgFkGXj2l8=1733480415; path=/; expires=Fri, 06-Dec-24 10:20:15 GMT; Max-Age=86400;
EsWSOX_kRuIk6R8ckIvqlY4DRXo=ET_yF1tae3Oimjf6mvULbHzk_5g; path=/; expires=Fri, 06-Dec-24 10:20:15 GMT; Max-Age=86400;
YNz06jSY3GYlvPrpr69gIH-KwFI=IQ8_KkkcBfBkKywz6RW1AyseK7U; path=/; expires=Fri, 06-Dec-24 10:20:15 GMT; Max-Age=86400;
x-frame-options: SAMEORIGIN
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: 0
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zReEE0RStYnaBM2xEiL6yFrfsG85G6L%2B26SC9KNd7si6SRvKuUKGya8qxEGdxRfTcGTClecxH7r2YQwYyDFJTL%2Byu9zKMj%2FUEs98XsEdrYPOBgdVzFs12MFW%2Byg3OQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8ed34d755ee856b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=781&min_rtt=446&rtt_var=403&sent=33&recv=28&lost=0&retrans=1&sent_bytes=26109&recv_bytes=2528&delivery_rate=13865937&cwnd=254&unsent_bytes=0&cid=f3c588c0a8d55a77&ts=748&x=0"
X-Firefox-Spdy: h2
|
|
| twint-ch.me/cdn-cgi/challenge-platform/h/b/jsd/r/8ed34d73ace556b7 | 172.67.183.45 | 200 OK | 0 B |
URL twint-ch.me/cdn-cgi/challenge-platform/h/b/jsd/r/8ed34d73ace556b7 IP 172.67.183.45:0
CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/jsd/r/8ed34d73ace556b7 HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12173
Origin: https://twint-ch.me
DNT: 1
Connection: keep-alive
Referer: https://twint-ch.me/ch/panel/view.php?vid=712
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU; 54RgWQKAIdS29A0nLtwMlpZNQ-0=xGvcNAUiktZj2YWAIWEVXrdZ9fc; dDgqnrDDRIkRu5RPbwNzzooEgUk=1733394015; 7roncJcHeEnIrFkPnWgFkGXj2l8=1733480415; EsWSOX_kRuIk6R8ckIvqlY4DRXo=ET_yF1tae3Oimjf6mvULbHzk_5g; YNz06jSY3GYlvPrpr69gIH-KwFI=IQ8_KkkcBfBkKywz6RW1AyseK7U
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 05 Dec 2024 10:20:15 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.twint-ch.me; Priority=High; HttpOnly; Secure; SameSite=None
cf_clearance=qyTm2qVKepdFHhgup01B_bdJOP6VEWEEekE2F0SdEkA-1733394015-1.2.1.1-NnbSddm4ZOIi.a6Ye.s4nRil_D6gJNGeZ_qil4swbPYKNhjM7YNeHiy9WuNb8vg.AXE287sKNBthZ6v1k66rzYLYwFzXDGYZe9ra4C0UV.6s4Aa2KpBWwh_D2C7eINZR.qrK6lPPmt3Y86_BsYbOjImKoIdMzF3eM4CLAhPVZp4WRjRX5KgwFLyJJdOjKIGNAdNhSbZQEKe6i0ePtF_C.uN8pG.yWkaq.Qlr8oywqYEnmcN3AMEdi0y4jtWTo4il3ojp7skX6CNHvy2Fmu7WV7MDys2VDjb2ZjLkVam6M9zywqt4cjM_L_aaUpxHOlgRcOa22OO3T_eZ9LA7ACEUFQ; Path=/; Expires=Fri, 05-Dec-25 10:20:15 GMT; Domain=.twint-ch.me; Priority=High; HttpOnly; Secure; SameSite=None; Partitioned
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sxdCtUs1uV6k9qQmo0Qjht27kkXafwpfA6jKW4tz%2BXvDugvUp2167b2Dh3ngq867giIxqZbOSpMO%2BmrPXG0JIQgF8ToKKnU%2FMB5IwbQnS4yUq1aVJI4K0FOlo4tOLA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8ed34d76f8bdb518-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8325&min_rtt=2149&rtt_var=5217&sent=15&recv=15&lost=0&retrans=0&sent_bytes=4143&recv_bytes=14236&delivery_rate=276375&cwnd=12000&unsent_bytes=0&cid=6de370282f8b9e72&ts=247&x=1", cfHdrFlush;dur=0
|
|
| twint-ch.me/cdn-cgi/challenge-platform/scripts/jsd/main.js | 172.67.183.45 | 302 Found | 0 B |
URL GET HTTP/3twint-ch.me/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 172.67.183.45:443
Requested byhttps://twint-ch.me/ch/panel/view.php?vid=712 CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU; 54RgWQKAIdS29A0nLtwMlpZNQ-0=xGvcNAUiktZj2YWAIWEVXrdZ9fc; dDgqnrDDRIkRu5RPbwNzzooEgUk=1733394015; 7roncJcHeEnIrFkPnWgFkGXj2l8=1733480415; EsWSOX_kRuIk6R8ckIvqlY4DRXo=ET_yF1tae3Oimjf6mvULbHzk_5g; YNz06jSY3GYlvPrpr69gIH-KwFI=IQ8_KkkcBfBkKywz6RW1AyseK7U
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Thu, 05 Dec 2024 10:20:16 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=36hwRbVdV724BTWeGmHekgT2nYSg%2BxrOxRkBcKcwHHC181HjboukuQbq5SzTvwr2Jw1ZITsZdU2VZsRXsnJkTnKu8i0sQlcvAZz381K38omXuQh2FP9yR25ry7u6kQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ed34d787ab0b518-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9102&min_rtt=2149&rtt_var=7236&sent=20&recv=20&lost=0&retrans=0&sent_bytes=6474&recv_bytes=16863&delivery_rate=7320&cwnd=12000&unsent_bytes=0&cid=6de370282f8b9e72&ts=479&x=1", cfHdrFlush;dur=0
|
|
| twint-ch.me/cdn-cgi/challenge-platform/h/b/jsd/r/8ed34d773918b518 | 172.67.183.45 | 200 OK | 0 B |
URL POST HTTP/3twint-ch.me/cdn-cgi/challenge-platform/h/b/jsd/r/8ed34d773918b518 IP 172.67.183.45:443
Requested byhttps://twint-ch.me/ch/panel/view.php?vid=712 CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/jsd/r/8ed34d773918b518 HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12170
Origin: https://twint-ch.me
DNT: 1
Connection: keep-alive
Referer: https://twint-ch.me/ch/panel/view.php?vid=712
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU; 54RgWQKAIdS29A0nLtwMlpZNQ-0=xGvcNAUiktZj2YWAIWEVXrdZ9fc; dDgqnrDDRIkRu5RPbwNzzooEgUk=1733394015; 7roncJcHeEnIrFkPnWgFkGXj2l8=1733480415; EsWSOX_kRuIk6R8ckIvqlY4DRXo=ET_yF1tae3Oimjf6mvULbHzk_5g; YNz06jSY3GYlvPrpr69gIH-KwFI=IQ8_KkkcBfBkKywz6RW1AyseK7U
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 05 Dec 2024 10:20:16 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.twint-ch.me; Priority=High; HttpOnly; Secure; SameSite=None
cf_clearance=gaKm3YA1tOnBW9vtMDODN.WSsthIAMfXL8jipHDCTGY-1733394016-1.2.1.1-jJ8e3pwx5JMwnLYp_JhPp3Up8ig.9PQSUiNMYdwFVZJQC1nYenx3d.Q6C0BvIf8Up8DtYzDS.n33.f7QbvJK1g5_pQnL465i22sPJwdcK5O3BC22mDWcnmdLV0hHd55_c.UcMw62oFm1UHr9qsWvTPeVJQ9XFleNBwLy.L3VfXj0TXgcuLADN50fgB2BDnE7lKIDP78Hebs8I83MZiwFgkypSBFs..4VAY47n7PBn083qgloOhuQE1ovFmdmcfJfY1SlUsUbel7XXAhBp.bweLnfTRbLp9HyMuflRxlnORcXAUJsvkmsuH6oPcSHPGi5f2GxKEKW1uY0D4gAzQ.52w; Path=/; Expires=Fri, 05-Dec-25 10:20:16 GMT; Domain=.twint-ch.me; Priority=High; HttpOnly; Secure; SameSite=None; Partitioned
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FSLvhhionXFjR%2FinuOFaRYWnr%2BBdxvFhuBYLf0dGYYwTqR1og0UxpOlXo%2FrTGyriobmpIclqBVkuj3sWeTdtLo0l2uWVLrXiiKdMvHZkooB6IAVoUlgHmbCLJgv9ZA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8ed34d797c0bb518-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=10029&min_rtt=2149&rtt_var=8679&sent=32&recv=33&lost=0&retrans=0&sent_bytes=12900&recv_bytes=31173&delivery_rate=36321&cwnd=12000&unsent_bytes=0&cid=6de370282f8b9e72&ts=647&x=1", cfHdrFlush;dur=0
|
|
| twint-ch.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js? | 172.67.183.45 | 200 OK | 8.8 kB |
URL GET HTTP/3twint-ch.me/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js? IP 172.67.183.45:443
Requested byhttps://twint-ch.me/ch/panel/view.php?vid=712 CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
File typeJavaScript source, ASCII text, with very long lines (8765), with no line terminators Hasha9631441305e8c5989b2f4d465929af9 df4a5ec8f845a0312da0d78b2c4c3d247c06a0a8 2a51209385f0f7a815b240bfbbdbbad809166517b08ea04b4b3b435134b32d62
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js? HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU; 54RgWQKAIdS29A0nLtwMlpZNQ-0=xGvcNAUiktZj2YWAIWEVXrdZ9fc; dDgqnrDDRIkRu5RPbwNzzooEgUk=1733394015; 7roncJcHeEnIrFkPnWgFkGXj2l8=1733480415; EsWSOX_kRuIk6R8ckIvqlY4DRXo=ET_yF1tae3Oimjf6mvULbHzk_5g; YNz06jSY3GYlvPrpr69gIH-KwFI=IQ8_KkkcBfBkKywz6RW1AyseK7U
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 05 Dec 2024 10:20:16 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gx3jpbSoAn6LOX1ea%2F6XLUocDiQRD5E5F1%2ByJbVblY7ndPDO7q17trv1bjxvd9wNH0W1yRRTf3AKhw%2BgumjuTke8RYHiDhW1U7wRvFwTwRtqimUibGyY9oBJ573TsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ed34d788ad0b518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9102&min_rtt=2149&rtt_var=7236&sent=22&recv=21&lost=0&retrans=0&sent_bytes=7183&recv_bytes=17674&delivery_rate=7320&cwnd=12000&unsent_bytes=0&cid=6de370282f8b9e72&ts=496&x=1", cfHdrFlush;dur=0
|
|
| twint-ch.me/favicon.ico | 172.67.183.45 | 403 Forbidden | 146 B |
IP 172.67.183.45:443
Requested byhttps://twint-ch.me/ch/panel/view.php?vid=712 CertificateIssuerGoogle Trust Services Subjecttwint-ch.me FingerprintC5:BC:6C:A4:73:2B:F1:E8:F6:BC:58:52:9E:B2:B6:D1:40:CF:3E:E6 ValidityWed, 04 Dec 2024 08:27:58 GMT - Tue, 04 Mar 2025 08:27:57 GMT
File typeHTML document, ASCII text, with no line terminators Hashbcfacc6f2d2ee7cd5e014be08612f93e 7bb6f49a83b5186d5f8598e852bfbeee102d8a4d ef1a3d1af87d9d441ef37f001f2ffb6900ef0a7a4884a5ef165bc2b09e224b38
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: twint-ch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://twint-ch.me/ch/panel/view.php?vid=712
Cookie: Ygwxk5u12SowuslK-t7XZBzPeaM=saxTldNm919iAyEF5RGVA3zcFbk; wFd2nOXjy47_268TR96rlgwdiZw=1733394014; OmvswPiyZVsvanoeX7xegQeDFwI=1733480414; vSGXSzo_7MLRdQlgnS4T5yJhAsk=fM_xrapMKFME0eVDIhBmgShymOE; x97o5LZu80IdJCZyUluv-_1mIEk=4y5E8iaw_g-dENmkwkN46wgnZ8s; NhtBUTikjh5eDz8n_4tSm8tYZls=1733394015; 0L7Se1aGi-Xex-YgLR_jm7Sm96g=1733480415; 38hJJ9TUkDB6ja_mozcvXshLWxA=evYWXkBfr04uypSdO-EnyQkhzmY; bac9f9OPRJ1sEJs7cBBCkQguD98=lkLPZiL_UVgRTxwDers97UXe5XU; 54RgWQKAIdS29A0nLtwMlpZNQ-0=xGvcNAUiktZj2YWAIWEVXrdZ9fc; dDgqnrDDRIkRu5RPbwNzzooEgUk=1733394015; 7roncJcHeEnIrFkPnWgFkGXj2l8=1733480415; EsWSOX_kRuIk6R8ckIvqlY4DRXo=ET_yF1tae3Oimjf6mvULbHzk_5g; YNz06jSY3GYlvPrpr69gIH-KwFI=IQ8_KkkcBfBkKywz6RW1AyseK7U
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Thu, 05 Dec 2024 10:20:16 GMT
content-type: text/html
x-content-type-options: nosniff, nosniff
x-xss-protection: 1; mode=block, 1; mode=block
cache-control: public, max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, immutable
pragma: public
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GLfsoUuE1EtWytStP%2BxZHE2DX%2BOEapBemdtMwdmgJQUCTngR6yuS1C4tYmUamZx05%2F8SAOgklSHVYPsvL5sVE%2FpblUoMNZCUnVXv4gYV%2BU9R100ToRJyQ17bhE2ulA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8ed34d786aa0b518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8315&min_rtt=2149&rtt_var=7002&sent=26&recv=22&lost=0&retrans=0&sent_bytes=11970&recv_bytes=17718&delivery_rate=158369&cwnd=12000&unsent_bytes=0&cid=6de370282f8b9e72&ts=536&x=1", cfHdrFlush;dur=0
|
|