Report - lysyvan.com/login.phpWs

Report Overview

Visited public
2025-05-08 06:42:37
Tags
URL
lysyvan.com/login.phpWs
Finishing URL
lysyvan.com/login.phpWs
IP / ASN
104.21.16.1
#13335 CLOUDFLARENET
Title
Page Not Found

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
lysyvan.com	unknown	2011-08-15	2013-02-07	2025-05-02	3.8 kB	40 kB	104.21.64.1
static.cloudflareinsights.com	1294	2019-08-30	2019-09-24	2025-05-07	500 B	20 kB	104.16.80.73

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	lysyvan.com/login.phpWs	ScriptElement	921 B	2025-05-08	2025-05-08
Pretty URL lysyvan.com/login.phpWs IP 104.21.64.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-08 06:42 Last Seen2025-05-08 06:42 Times Seen1 Hash 2b9c99ef2de243d8d04656f1a4617439 e22f42e254cc1c909f501129e2fef00d81199e56 eaff1cb8d4e263d802ca4993e1288f780cacf2d574c7c87ae8a78640e1029189 Loading...

	about:blank	ScriptElement	236 B	2025-05-08	2025-05-08
Pretty URL about:blank IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-08 06:42 Last Seen2025-05-08 06:42 Times Seen1 Hash 19cb3b37b1b4d658c9b74d40f752795f 8e540fccbbf05620d5585e3b3a6453c60d521d43 7e61e39afa6bdad19471acd046879caedc137e96e63e47586183eddc65661ba8 Loading...

	static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	ScriptElement	20 kB	2024-06-07	2025-05-16
Pretty URL static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 IP 104.16.80.73 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-06-07 09:21 Last Seen2025-05-16 03:19 Times Seen50516 Hash ec18af6d41f6f278b6aed3bdabffa7bc 62c9e2cab76b888829f3c5335e91c320b22329ae 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f Loading...

	lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	ScriptElement	8.5 kB	2025-05-08	2025-05-08
Pretty URL lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 104.21.64.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-08 06:28 Last Seen2025-05-08 06:42 Times Seen2 Hash efa318a0d5b5e0c8f129b20b48485d10 4d5436cef22aa4f2a468e0dca816ff70c15415d4 dad5aa514bb4a73283acc1e7e8c467515d54834236fb9016c373b57c1b2074c2 Loading...

HTTP Transactions (9)

URL IP Response Size

lysyvan.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.524385284630114:1746684622:px7e7a5WATzNA-C7zVX2l9lSSNN8GOf-_5nyk4UwNfE/93c6f99e8cb856c6

104.21.64.1

200 OK

0 B

URL POST
lysyvan.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.524385284630114:1746684622:px7e7a5WATzNA-C7zVX2l9lSSNN8GOf-_5nyk4UwNfE/93c6f99e8cb856c6
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/login.phpWs
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.524385284630114:1746684622:px7e7a5WATzNA-C7zVX2l9lSSNN8GOf-_5nyk4UwNfE/93c6f99e8cb856c6 HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 12081
Origin: https://lysyvan.com
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/login.phpWs
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 08 May 2025 06:42:05 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Ttvj%2BeGe%2FHwegP5UrNV516%2FJfe3nngqFhftyiX%2BWpBqg%2B8VhQVg45y%2BOIEHDG9YAKUqfAjxb1zhuF5hUD5uPeqbbr2IR43S4Kj5KtaZiLqOqcd3wFNnkhleIDB2Wg%3D%3D"}],"group":"cf-nel","max_age":604800}
set-cookie: cf_clearance=ho3pWO7ydiKohS224RJ0nKjax0xZGpktNa9QPfdIJNU-1746686525-1.2.1.1-Em.WJo3gmJAyWVue.b.m06Mf2zrgfoGFTZYUkM3gF2E63rpdtr.y6k4y1poklWOwsXST6QuQPhqCXrkq07Y9JZVHWerIpmt57Rap0CLZjzPQoUrUySc_4bVXcYmOMZ6w0aWXP4yJ7JpprqxVL36CFAtnxlpeux4ff228dXuB0oyUzZuJPlnF7m8trlGWiZhBzpxhl_qTFy9AolAyGumEH2aLl2NqQq2AoQoLB.xwFmsvDBrbkKD54uDJ4QxLkMBox3m5gJAyrn11lSVtUUk6076w3OVjgxvrbmBiUKyFe1Y0tPQUk2xEl1umdIPBLQmmFpRFnNAXX898D2BRenorVqMenl0nqZLhDHDZcQ8LvwM; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=lysyvan.com; Expires=Fri, 08 May 2026 06:42:05 GMT
cf-ray: 93c6f9a2fcc156a9-OSL
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2155&min_rtt=727&rtt_var=1244&sent=212&recv=359&lost=0&retrans=0&sent_bytes=19641&recv_bytes=33718&delivery_rate=422515&cwnd=12000&unsent_bytes=0&cid=49ff19e3ba5db184&ts=828&x=16"

static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

104.16.80.73

200 OK

20 kB

URL GET
static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
IP
104.16.80.73:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/login.phpWs
Certificate
IssuerGoogle Trust Services
Subjectcloudflareinsights.com
FingerprintEA:C7:0D:68:3A:45:CB:AD:C5:33:41:B6:DF:F1:60:64:E1:0F:52:6A
ValiditySun, 27 Apr 2025 18:18:02 GMT - Sat, 26 Jul 2025 19:17:55 GMT

File type
JavaScript source, ASCII text, with very long lines (19948), with no line terminators
Size
20 kB (19948 bytes)
Hash
ec18af6d41f6f278b6aed3bdabffa7bc
62c9e2cab76b888829f3c5335e91c320b22329ae
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

HTTP Headers

GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://lysyvan.com
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 08 May 2025 06:42:05 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.6.1"
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 93c6f9a1290eb4f4-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

lysyvan.com/login.phpWs

104.21.64.1

301 Moved Permanently

4.3 kB

URL User Request GET
lysyvan.com/login.phpWs
IP
104.21.64.1:80
ASN
#13335 CLOUDFLARENET

File type

Size
4.3 kB (4319 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.phpWs HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Thu, 08 May 2025 06:42:05 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 08 May 2025 07:42:05 GMT
Location: https://lysyvan.com/login.phpWs
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9nVSq4UK0jg1izOqltCFscFOuuO7ebwwOgNJf36c9yMDmkoRyfdsLNRj3OIFMkNn6BIsxaNQGTQvUl%2Br5OBajqnhfyW6czo0IKb0fuH7QqkurFQov3wAJ%2FSXBtU5Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 93c6f99e6d7d712e-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=497&min_rtt=497&rtt_var=248&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=407&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

lysyvan.com/login.phpWs

104.21.64.1

404 Not Found

4.3 kB

URL User Request GET
lysyvan.com/login.phpWs
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
HTML document, ASCII text, with very long lines (1421)
Size
4.3 kB (4319 bytes)
Hash
5432fbe322033834f7182ca89706b1f9
73178a931b2365c7f88ae2f105205c2d7c2fb9e9
aa744b950312bdae8d6977947237853a020884496fabe7a57f0795d6bd958e42

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.phpWs HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Thu, 08 May 2025 06:42:05 GMT
content-type: text/html; charset=utf-8
cf-ray: 93c6f99e8cb856c6-OSL
server: cloudflare
content-encoding: br
vary: Accept-Encoding
last-modified: Mon, 10 Mar 2025 09:59:17 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pIXP%2BTGjH9Jj%2BKXN2kUUFDX3pmcqHkZPgyLGY0H2KHQO387X7uzq1u3BADncHevIHbllfDsWq5kr29ty3HUOGSlxgkhLw9XoE9jL56BAKnF97PYjKZKzWDPUcBx2RA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="DYNAMIC", cfL4;desc="?proto=TCP&rtt=601&min_rtt=430&rtt_var=219&sent=12&recv=12&lost=0&retrans=0&sent_bytes=6072&recv_bytes=1330&delivery_rate=7541666&cwnd=257&unsent_bytes=0&cid=4929a7f190e2b824&ts=593&x=0"
X-Firefox-Spdy: h2

lysyvan.com/favicon.ico

104.21.64.1

404 Not Found

2.9 kB

URL GET
lysyvan.com/favicon.ico
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/login.phpWs
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
HTML document, ASCII text, with very long lines (634)
Size
2.9 kB (2898 bytes)
Hash
f01ba522c3539135df33250082846848
af31de06cf3d07cf83f104af8755b0cc5222ffc6
2e8deb28946a6b41ccb927eaa43bbaa78ea82cef39a40638f2e5afa8e90e73ca

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/login.phpWs
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Thu, 08 May 2025 06:42:06 GMT
content-type: text/html; charset=utf-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2BtEce%2FWM9mgrtdU24FqqVXWzbFxA%2FFNMKibIi%2BM%2BeGOensc8TnDmDZXLtGqW6WZ%2FdR7DZz52GvX8Y9oWiMPJidpJSofSh%2FAXTioE%2Bl%2FdOr5uxzQlwWIHMz8CctSBA%3D%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
last-modified: Mon, 10 Mar 2025 09:59:17 GMT
cache-control: max-age=14400
cf-cache-status: EXPIRED
content-encoding: br
cf-ray: 93c6f9a1acab56a9-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2029&min_rtt=727&rtt_var=1184&sent=213&recv=360&lost=0&retrans=0&sent_bytes=20650&recv_bytes=33763&delivery_rate=28847&cwnd=12000&unsent_bytes=0&cid=49ff19e3ba5db184&ts=1193&x=16"

lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.64.1

302 Found

8.5 kB

URL GET
lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/login.phpWs
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type

Size
8.5 kB (8496 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 302 Found
date: Thu, 08 May 2025 06:42:05 GMT
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mh9XhG6jcMr%2FuAkXPiS5tsprSI8W596ogskGTsQ03oeKgnc%2F5DB6TblntcCkQ84FAWecBBgcyxom209D5aY5S0MYBOBqpiGx1wrivI3lJFZu8cdxzEEZCzEdyhsDmA%3D%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
cf-ray: 93c6f9a1bcac56a9-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2454&min_rtt=727&rtt_var=1327&sent=197&recv=344&lost=0&retrans=0&sent_bytes=13859&recv_bytes=18879&delivery_rate=2228&cwnd=12000&unsent_bytes=0&cid=49ff19e3ba5db184&ts=627&x=16"

lysyvan.com/cdn-cgi/rum?

104.21.64.1

204 No Content

0 B

URL POST
lysyvan.com/cdn-cgi/rum?
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/login.phpWs
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/rum? HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
content-type: application/json
Content-Length: 1326
Origin: https://lysyvan.com
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/login.phpWs
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 204 No Content
date: Thu, 08 May 2025 06:42:05 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://lysyvan.com
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 93c6f9a1ccae56a9-OSL
x-frame-options: DENY

lysyvan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?

104.21.64.1

200 OK

8.5 kB

URL GET
lysyvan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/login.phpWs
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
JavaScript source, ASCII text, with very long lines (8496), with no line terminators
Size
8.5 kB (8496 bytes)
Hash
efa318a0d5b5e0c8f129b20b48485d10
4d5436cef22aa4f2a468e0dca816ff70c15415d4
dad5aa514bb4a73283acc1e7e8c467515d54834236fb9016c373b57c1b2074c2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js? HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 08 May 2025 06:42:05 GMT
content-type: application/javascript; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qrc4%2B1mrzaMpGfAH4sd58gj8MxefYf3N%2FszqEHf32A8q%2FXB0hhNq6xx3d5hgSNlriFXOBi%2FAroRd0kYDG3quJHfz9ZKVTZb4d6gwgOAL75Jd%2BjrjWyS6ZHfWZFsltg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
content-encoding: br
cf-ray: 93c6f9a1fcb156a9-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2255&min_rtt=727&rtt_var=1393&sent=201&recv=348&lost=0&retrans=0&sent_bytes=14806&recv_bytes=20832&delivery_rate=33452&cwnd=12000&unsent_bytes=0&cid=49ff19e3ba5db184&ts=668&x=16"

lysyvan.com/login.phpWs

104.21.64.1

404 Not Found

4.3 kB

URL User Request GET
lysyvan.com/login.phpWs
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
HTML document, ASCII text, with very long lines (1421)
Size
4.3 kB (4319 bytes)
Hash
ef3bd67907ce5ccdfff11468ad909677
64d006bab498a4553a36c58041976c6f4063ae15
342a0ae30126cbcc303eb5e13a0bb15831cef63565c26088c26955e0474c2cad

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login.phpWs HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Thu, 08 May 2025 06:42:05 GMT
content-type: text/html; charset=utf-8
cf-ray: 93c6f99c6a3556c6-OSL
server: cloudflare
content-encoding: br
vary: Accept-Encoding
last-modified: Mon, 10 Mar 2025 09:59:17 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uk%2FyehFaP5WWw0nNEtydEo2mR5dae5BROXZOBuGUXAztBC61iKEo1yvDv46z24YGb5IZ6XEbg9A9wCAFchvHsvll92BA9zDsJl9FsJSAK%2Fj8BaXWO573%2FxtAqPCESA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="DYNAMIC", cfL4;desc="?proto=TCP&rtt=601&min_rtt=430&rtt_var=291&sent=8&recv=10&lost=0&retrans=0&sent_bytes=3274&recv_bytes=1255&delivery_rate=7541666&cwnd=254&unsent_bytes=0&cid=4929a7f190e2b824&ts=247&x=0"
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL POST

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN