2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
200 OK 21 kB URL User Request GET HTTP/1.1 2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
IP
ASN #203639 Tekka Digital SA
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (841), with CRLF line terminators
Hash dac6bbb167be63844ecd112046bd9d65
0692e36059d5c728b1aaf589b0b2d08af2dfa46d
a8b7657d1b52f94aaa8aa76b16d181d903c72314e3ca606ed77f6c0dfc9300ff
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://sweetwinsprizes.info/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/html
Content-Length: 21361
Connection: keep-alive
cache-control: private
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js
200 OK 24 kB URL GET HTTP/2 cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js
IP
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09
ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT
File type ASCII text, with very long lines (65297)
Hash a454220fc07088bf1fdd19313b6bfd50
265a733cb7fbc481fd2510a659a85ad55c93c895
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
GET /npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 4.3.1
x-jsd-version-type: version
etag: W/"1332b-JlpzPLf7xIH9JRCmWaha1VyTyJU"
content-encoding: br
accept-ranges: bytes
date: Wed, 22 Nov 2023 22:43:45 GMT
age: 3187938
x-served-by: cache-fra-eddf8230062-FRA, cache-bma1678-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 23541
X-Firefox-Spdy: h2
2243.thinkickply.live/media/mainstream/all/ab/2008_2.css
200 OK 8.0 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/2008_2.css
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type assembler source, ASCII text
Hash 3a3692009050605115ce92e15cdc4f8a
80f2be7713fc6b704492a24646632ac5b86d610d
24af2f8d21f9612e2b3012382c362743db495fa91370d0f87d22b077caf484af
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/2008_2.css HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/css
Content-Length: 7969
Connection: keep-alive
ETag: "3a3692009050605115ce92e15cdc4f8a"
Last-Modified: Wed, 20 Sep 2023 15:23:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A122758AA468C
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#284024580/gid:0/gname:root/mode:33188/mtime:1661094568#999105000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T15:09:28.999105Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/2008.css
200 OK 22 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/2008.css
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type ASCII text, with CRLF line terminators
Hash a008e2dbe07922242a5f012ccd7da015
1b0718855d0c5ca6e25d4553e312c8652df334a7
903a8f67a7fa0613988fa1ab30073aac45e856b60c7b1eace94a95b70db41e42
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/2008.css HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/css
Content-Length: 21546
Connection: keep-alive
ETag: "a008e2dbe07922242a5f012ccd7da015"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A122765F6216E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223401#763742519/gid:0/gname:root/mode:33188/mtime:1661084880#124572000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T12:28:00.124572Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
rasun.com/
173 B IP
File type HTML document, ASCII text, with no line terminators
Hash e55fce89d8aa008c0c2f9ce9177e6fed
b84769b0c1b01f49ae328811c522e32c0aef52b1
12af04f8f36f1965ca7611b7182c50ed9bfe960fa59c41b5907be8f5e24ad050
GET / HTTP/1.1
Host: rasun.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 173
Connection: keep-alive
Set-Cookie: ht_rr=1; expires=Thu, 23-Nov-2023 22:43:45 GMT; Max-Age=86400; path=/
X-Pingback: http://rasun.com/xmlrpc.php
X-Redirect-By: WordPress
Location: https://rasun.com/
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
200 OK 31 kB URL GET HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (65451)
Hash dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 22 Nov 2023 16:01:46 GMT
expires: Thu, 21 Nov 2024 16:01:46 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 24119
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
2243.thinkickply.live/media/mainstream/all/ab/2008_1.js
200 OK 15 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/2008_1.js
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type ASCII text, with very long lines (927), with CRLF line terminators
Hash 70a301508a891eb3c9f0e7d43cbd2072
37b7e329763c1285514bac3d77808a1a3389b6da
e86620b8e47101a2701a71369c8f40d6ac250beeea5a86b69fd407035b57b549
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/2008_1.js HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: application/javascript
Content-Length: 14759
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "70a301508a891eb3c9f0e7d43cbd2072"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A122790EF7082
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676810017#673891798/gid:0/gname:root/mode:33188/mtime:1661082594#618119000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T11:49:54.618119Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/2008_3.js
200 OK 7.5 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/2008_3.js
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
Hash f235f98748487db96795fd73ed48a46d
4cf6f3d733184af759d2f6d2251321df778accdd
5ee7e3f6c675569417eabed4df39057a60e056b0a5eb5abbecf0c1979780d684
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/2008_3.js HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/javascript
Content-Length: 7481
Connection: keep-alive
ETag: "f235f98748487db96795fd73ed48a46d"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A12277868C937
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223401#775742546/gid:0/gname:root/mode:33188/mtime:1661082623#6152000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T11:50:23.006152Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
sweetwinsprizes.info/?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw==
200 OK 20 kB URL User Request GET HTTP/2 sweetwinsprizes.info/?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw==
IP
Certificate IssuerGoogle Trust Services LLC
Subjectsweetwinsprizes.info
FingerprintCC:EF:C2:9D:32:47:CC:3D:BC:4E:23:BC:65:F0:46:3C:08:87:7B:6B
ValidityTue, 17 Oct 2023 11:26:33 GMT - Mon, 15 Jan 2024 11:26:32 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (21447), with CRLF line terminators
Hash ff9e08b8122f6a5b5444dc349406c2a9
c5efbfc90d54e8d36bc58dd11778a0f672194d10
d10da718cf4a93a66d2490612385821fc95dd26e473e352893eae120ad25d6a4
GET /?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw== HTTP/1.1
Host: sweetwinsprizes.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rasun.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 22 Nov 2023 22:43:44 GMT
content-type: text/html
cache-control: private
set-cookie: sid=t1~b4dx3mqfpkz1epazcf3qwnsf; path=/
sid=t1~b4dx3mqfpkz1epazcf3qwnsf; path=/
p1=https://thinkickply.live/bukkihgn/; path=/
s1=1incrzlnu4onuift; path=/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBthGlxuigm5Aj7dm644c%2FfFPbBfasb63o5jZ5bvhdqz%2BB4ljdtqdTN%2FXOjfJXCVjqMQplBOwZCtL66o1m%2BIO%2BDDK8QfHrwgwoS6KfX00qsNDL7XvSwCkQ%2BCmRrGWYznGf4t8VgKcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82a4b16b6b9956cc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
2243.thinkickply.live/media/mainstream/flag-icon/css/flag-icon.css
200 OK 40 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/flag-icon/css/flag-icon.css
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type ASCII text, with CRLF line terminators
Hash b7a46a018dcd21a4828bae0b04ddcc6c
1d8418d6cc45e5c29e1aab008c18ea633e7730c4
299595fd56aa6a2fcfac34fcf780d33b61785ad96f19485e65a33ead8fd69cbc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/css
Content-Length: 39806
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "b7a46a018dcd21a4828bae0b04ddcc6c"
Last-Modified: Mon, 20 Feb 2023 09:33:58 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A12276DC4183E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843396#99757504/gid:0/gname:root/mode:33279/mtime:1655387459#318598233/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:59.318598233Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/sound.js
200 OK 5.0 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/sound.js
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type ASCII text, with very long lines (5014), with no line terminators
Hash 1f1fed792da20aa1e75213d3f1839a0d
b5744653854dc322effae7e83ba3b99f8818dffc
32cde492155502743e1b7c5ec41ba974216be8c331db01e5cd933726443241df
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/sound.js HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: application/javascript
Content-Length: 5014
Connection: keep-alive
ETag: "1f1fed792da20aa1e75213d3f1839a0d"
Last-Modified: Wed, 20 Sep 2023 15:25:15 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A12277C9A9235
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#348024780/gid:0/gname:root/mode:33279/mtime:1655387452#846583343/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.846583343Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/no/2.js
200 OK 416 B URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/no/2.js
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 9075531370b86e49402928b23fc26c0e
b88fc53cd5ef41285a5c1be4b1aecc1a54a7ce0e
31e764b82e550f1e27b814ac8047f8832da32e4a3d7045043f8de1e312112ca3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/no/2.js HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: text/javascript
Content-Length: 416
Connection: keep-alive
ETag: "9075531370b86e49402928b23fc26c0e"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A134BDA0184BB
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#539744264/gid:0/gname:root/mode:33279/mtime:1653412332#133070000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:12.13307Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/u.js
200 OK 25 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/u.js
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type ASCII text, with very long lines (25177), with no line terminators
Hash e44aa4ca20702394c8ca04144c3e9e74
b3734a4cde021bb14d2d296c0ae5dfa8112376f6
e075018e9a06d85a147b1f0d79e8e777da51019b4f306076f8fbba751d42d566
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/u.js HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: application/javascript
Content-Length: 25177
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "e44aa4ca20702394c8ca04144c3e9e74"
Last-Modified: Mon, 20 Feb 2023 09:35:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A12EE38CC2A31
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676848788#311374889/gid:0/gname:root/mode:33188/mtime:1657924117#384361000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-15T22:28:37.384361Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr4.jpg
200 OK 4.3 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr4.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash f96150cbbb80ac607b3f264141a7faef
9ed21cb4e5c552f29bc23db55684c945e7582071
f013c5f2d9aedd8072d4bf01749c7dfcbacb80a43d06aa579403adfd8fd21fd3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 4307
Connection: keep-alive
ETag: "f96150cbbb80ac607b3f264141a7faef"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227DAB0EBA5
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412324#641054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.641054Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr3.jpg
200 OK 3.6 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr3.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash c74a5befd416e24626972e88ed65526d
4e8c25553248600cf23c3d6bcec488d986a129f8
53bb570f4465306a78670ecbea911ba0362251d2dc825d9ea0cb5d1c70f413ac
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 3601
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "c74a5befd416e24626972e88ed65526d"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A1227DC129D11
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#581053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.581053Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr1.jpg
200 OK 2.9 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr1.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash 4c88ebf87b0cc26121497de03db7f64a
a1256a5cfcd62223172eb3633659caddff6cf005
28db5edb0fe5e61f42eb8a0d10250a317f3ac840e074ffa761cb953c330f2cf6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 2939
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "4c88ebf87b0cc26121497de03db7f64a"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A1227CDD2CA41
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#385053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.385053Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/l.png
200 OK 9.2 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/l.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 768 x 293, 8-bit colormap, non-interlaced\012- data
Hash a0560779cf67aeb9a0c19f68f3582024
ff8d079fbbbad6b70be4d83c760a4a61bc51ff33
b585ee5fc0af431c584664f82e390e5a65bbbc6f201fe495d7c289ea618f5d5e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/l.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 9224
Connection: keep-alive
ETag: "a0560779cf67aeb9a0c19f68f3582024"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227A4530959
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#367743877/gid:0/gname:root/mode:33188/mtime:1675688264#107993000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2023-02-06T12:57:44.107993Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr5.jpg
200 OK 3.0 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr5.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash 7f103bc91a8084cd154189b5ebb2cf86
375e58c42a8c409bbf111847a1f6798ba6c0d5f5
346139aaec984853288672896d297ded47ac7ee1cb77ca43b63e130952cdd946
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 3043
Connection: keep-alive
ETag: "7f103bc91a8084cd154189b5ebb2cf86"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227DE7515C0
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#123743329/gid:0/gname:root/mode:33279/mtime:1653412324#705054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.705054Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/muti_iphone14pro.png
200 OK 39 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/muti_iphone14pro.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 500 x 375, 8-bit colormap, non-interlaced\012- data
Hash 42735146d56c0e4289363b6286186f9d
8d9cfa2d7653ac990e7b4df29550e8f3fbb0ff6d
b96b3a8a526eeadaf754a2b9239fe520179c9ee48cdf07da8b6b2d136066681b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/muti_iphone14pro.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 38744
Connection: keep-alive
ETag: "42735146d56c0e4289363b6286186f9d"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227B651767B
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#284024580/gid:0/gname:root/mode:33188/mtime:1663542090#630579000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-09-18T23:01:30.630579Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/x1.png
200 OK 593 B URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/x1.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 258 x 184, 8-bit colormap, non-interlaced\012- data
Hash ee850988ed56cd6f2498cae7993a8753
965f9091ca3e7f21f5b8115347227aedc93c586e
0303153a716bc5000d737521c0f6eb517700a1856b8e22ba8c088ec8f06ed8ba
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/x1.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 593
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "ee850988ed56cd6f2498cae7993a8753"
Last-Modified: Mon, 20 Feb 2023 09:33:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A1227B8D22429
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#855577336/gid:0/gname:root/mode:33279/mtime:1653412336#881081000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:16.881081Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/box-iphone14pro.png
200 OK 4.5 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/box-iphone14pro.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 258 x 185, 8-bit colormap, non-interlaced\012- data
Hash e26ab4191e2b939c553ea223042be270
1ef6e06777ad700e46a5d5995573b8ad09d339c8
7cc901bcb50159c267c3ecd4995bb69dbd47939ca52c81ab28f527651200e472
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/box-iphone14pro.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 4457
Connection: keep-alive
ETag: "e26ab4191e2b939c553ea223042be270"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227B705BAF7
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223401#959742960/gid:0/gname:root/mode:33188/mtime:1667333084#863076000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-11-01T20:04:44.863076Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/top_red.png
200 OK 4.6 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/top_red.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 258 x 184, 8-bit colormap, non-interlaced\012- data
Hash a660370feb6a1543c3c872a52f7bcfa7
b9478ed6228e8fb34a393013d474cde8dc400848
9d1eed749548dad4b80b2d7ce32052143bd38773685029d7b60cee82a31840b7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/top_red.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 4560
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a660370feb6a1543c3c872a52f7bcfa7"
Last-Modified: Mon, 20 Feb 2023 09:33:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A1227B8781855
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#855577336/gid:0/gname:root/mode:33279/mtime:1653412335#773078000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:15.773078Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr11.jpg
200 OK 3.2 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr11.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash 752f51c4c387c0ca7f4337acdeec15d6
7f9777f95aececfce6fa930181269cce30a4a059
227cec10c842ba3865d12ed22363f87ca5135b3ac2c72e5ab1a3169c4a2d569c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 3157
Connection: keep-alive
ETag: "752f51c4c387c0ca7f4337acdeec15d6"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227E2DFE645
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412324#445053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.445053Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr6.jpg
200 OK 2.8 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr6.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash f17d127dfcaa6f94929eedd080276df0
ec801473523b8eb44e123b5634081d2b57715ba6
0108e4d428f408f819f174ae8a5923b4010e80a14fc9872b018c12781e114403
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 2814
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "f17d127dfcaa6f94929eedd080276df0"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A1227EE647FE2
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#765054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.765054Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/iphone14pro.png
200 OK 37 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/iphone14pro.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 440 x 514, 8-bit colormap, non-interlaced\012- data
Hash 2f6bfed27c86fb5b0cf0796e73089fb0
be5c1a83cb372816542e8f92e75fddcc12872d42
601790639edd8b031101566f42f5ca7bb57d1fd090aff2783f7a5f5a1ceb0084
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/iphone14pro.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 37189
Connection: keep-alive
ETag: "2f6bfed27c86fb5b0cf0796e73089fb0"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227B685609C
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#283743688/gid:0/gname:root/mode:33188/mtime:1663242360#392676000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-09-15T11:46:00.392676Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/fr2.jpg
200 OK 2.8 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/fr2.jpg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Hash 9b63ccbd631923743813e838190cecbf
5c6dd930c81346616e9c641ff41b6f18344c7e76
4ca9130a03f6874bab37d2d52fd4546e3de34ccccbd83aa5b9cb6ed0f923d8b3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/jpeg
Content-Length: 2815
Connection: keep-alive
ETag: "9b63ccbd631923743813e838190cecbf"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227CBE9E350
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412324#505053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.505053Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/like.png
200 OK 357 B URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/like.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 15 x 14, 8-bit colormap, non-interlaced\012- data
Hash 17586a0aeb3f7b2aa7fb15a9251fbcd4
6adffad1183c93bc0dc114c89c77365734ec0dd6
8bf8dc3a4b6f7e4fa2a6fa74495c212f37a301311980cbc758050993ed9c07e1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/like.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 357
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "17586a0aeb3f7b2aa7fb15a9251fbcd4"
Last-Modified: Mon, 20 Feb 2023 09:33:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A1227CE04A13C
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412329#505064000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:09.505064Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/box_closed.png
200 OK 5.8 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/box_closed.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 258 x 184, 8-bit colormap, non-interlaced\012- data
Hash 890d869db1b3d28af588be81685214f2
5375bd0c2c75a6e40168f5561eb4eca993d14505
ea2521add13deb769fb7abee364670a567e7a3dc7b3b4474b5f80510dc593212
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/box_closed.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 5836
Connection: keep-alive
ETag: "890d869db1b3d28af588be81685214f2"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227CA9D17FA
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#7743068/gid:0/gname:root/mode:33279/mtime:1653412322#873050000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:02.87305Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/all/ab/box_open.png
200 OK 2.7 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/all/ab/box_open.png
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type PNG image data, 258 x 185, 8-bit colormap, non-interlaced\012- data
Hash 99264bee31a1abde5d0035468e53bbfb
d1f25383b68c3769eb3bdb36783e85c112078054
8da9180789c861b8d0d67d2bca168dfcc6de98f6999ab47400c38397d122157f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/all/ab/box_open.png HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: image/png
Content-Length: 2685
Connection: keep-alive
ETag: "99264bee31a1abde5d0035468e53bbfb"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 179A1227B73A83F0
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412322#933050000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:02.93305Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
200 OK 9.1 kB URL GET HTTP/2 fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
IP
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 9132, version 1.0\012- data
Hash 358d3070946a90b4960cd111154fdc12
a0ba0bf47a7f905f9aa1a3ce15a39cdac62466ee
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
GET /s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://2243.thinkickply.live
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9132
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 Nov 2023 23:27:37 GMT
expires: Fri, 15 Nov 2024 23:27:37 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
content-type: font/woff2
age: 515769
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
2243.thinkickply.live/media/mainstream/alert.mp3
200 OK 8.8 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/alert.mp3
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural\012- data
Hash 6d2d3da2ea28ace816fa4a138829dc18
606e0ec3d7fb05c69f16233cfe1ff0a0ee760505
d79bc81189750262716692ade6cc4d6fb6c4fbc4aa01c2b9d0aa67e5788821fc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/alert.mp3 HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Cookie: cookie1=true
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:46 GMT
Content-Type: audio/mpeg
Content-Length: 8802
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "6d2d3da2ea28ace816fa4a138829dc18"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A12280C8F2D2E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843338#351669788/gid:0/gname:root/mode:33279/mtime:1655387452#802583242/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.802583242Z
Expires: Thu, 21 Nov 2024 22:43:46 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/favicon.ico
204 No Content 0 B URL GET HTTP/1.1 2243.thinkickply.live/favicon.ico
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Cookie: cookie1=true
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: openresty
Date: Wed, 22 Nov 2023 22:43:46 GMT
Connection: keep-alive
2243.thinkickply.live/media/mainstream/flag-icon/flags/1x1/no.svg
200 OK 331 B URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/flag-icon/flags/1x1/no.svg
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with CRLF line terminators
Hash d748f0d9f64c0ca1a40a0f6ec6bbb746
a76adb95e9ea9a737c72e4640b8d49b9e28cbb38
bdfbd626e4e76d0dc506e10be7dd429e4c4da684986cbd45e5398f1e9e1f28cc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/flag-icon/flags/1x1/no.svg HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/media/mainstream/flag-icon/css/flag-icon.css
Cookie: cookie1=true
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:46 GMT
Content-Type: image/svg+xml
Content-Length: 331
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "d748f0d9f64c0ca1a40a0f6ec6bbb746"
Last-Modified: Mon, 20 Feb 2023 09:33:58 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A134BFFEC7468
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843396#111757523/gid:0/gname:root/mode:33279/mtime:1655387477#774640726/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:51:17.774640726Z
Expires: Thu, 21 Nov 2024 22:43:46 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
2243.thinkickply.live/media/mainstream/icon.js
200 OK 6.6 kB URL GET HTTP/1.1 2243.thinkickply.live/media/mainstream/icon.js
IP
ASN #203639 Tekka Digital SA
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectthinkickply.live
Fingerprint9C:DD:E8:DE:94:4C:9D:49:D7:03:65:63:AA:3E:F8:00:9A:6F:69:5D
ValidityWed, 22 Nov 2023 21:00:25 GMT - Tue, 20 Feb 2024 21:00:24 GMT
File type ASCII text, with very long lines (6570), with no line terminators
Hash a8e36248f01478844f0c4db185e945a0
d822225c2e21cd5fd7910f825da1e646b21dc078
9195437b3d4ffd3d3652df03d4de4ff03c454386ec19a1777da588a2f83827c2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /media/mainstream/icon.js HTTP/1.1
Host: 2243.thinkickply.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Wed, 22 Nov 2023 22:43:45 GMT
Content-Type: application/javascript
Content-Length: 6570
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a8e36248f01478844f0c4db185e945a0"
Last-Modified: Mon, 20 Feb 2023 09:34:12 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 179A12277D9AAF8F
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843338#351669788/gid:0/gname:root/mode:33279/mtime:1655387452#842583333/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.842583333Z
Expires: Thu, 21 Nov 2024 22:43:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
jsontdsexit2.com/ExtService.svc/getextparams
200 OK 535 B URL GET HTTP/2 jsontdsexit2.com/ExtService.svc/getextparams
IP
ASN #24940 Hetzner Online GmbH
Requested by https://2243.thinkickply.live/bukkihgn/article2243.doc?u=mr1kd0x&o=f5pp7z3&t=p2&cid=ZG1zbmQ7N2QyM2RiYTdiNw&f=1&sid=t1~b4dx3mqfpkz1epazcf3qwnsf&fp=73GhQvRFNZwF6GDzqUHMsA%3D%3D
Certificate IssuerLet's Encrypt
Subjectjsontdsexit2.com
Fingerprint6A:DA:A5:0B:7A:71:61:BF:CC:12:13:26:5F:96:8B:01:5A:F9:75:30
ValidityMon, 20 Nov 2023 11:46:15 GMT - Sun, 18 Feb 2024 11:46:14 GMT
File type troff or preprocessor input, Unicode text, UTF-8 text, with very long lines (626), with no line terminators
Hash a63c589e15b1d3470e029f657948388a
ea3ab754c1ade1359690e351a8607c8934e59cc1
5e3df5d191d3c3fbbd62b70fb0aa7c19e6578c364530354e5ae173cd057d4688
GET /ExtService.svc/getextparams HTTP/1.1
Host: jsontdsexit2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://2243.thinkickply.live
DNT: 1
Connection: keep-alive
Referer: https://2243.thinkickply.live/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 22:43:46 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
64.29.151.221
185.155.186.25
136.243.216.235