| haxnode.net/wp-content/plugins/easy-table-of-contents/assets/js/front.min.js?ver=2.0.73-1742137692 |  104.21.112.1 | 200 OK | 4.2 kB |
URL GET haxnode.net/wp-content/plugins/easy-table-of-contents/assets/js/front.min.js?ver=2.0.73-1742137692 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (4233), with no line terminators Hash774811547f86870ed5e676ed35bf9e0b 578ba30f95376ce238227be3200092b914e72365 dd3e3bd2dffba91f45f33f2e6c2b831ffa0cb76a3461d49b7d45fb8768f1d2d2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/easy-table-of-contents/assets/js/front.min.js?ver=2.0.73-1742137692 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 1472
Connection: keep-alive
Last-Modified: Sun, 16 Mar 2025 15:08:12 GMT
ETag: "1089-630770a49bd39-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4AFd5wNREKULYyBif7h%2FcFQfW3UKFy%2Fp64Yo1ahnJr2cUrtqbSiJ%2B5CbVmNBQPw5U8bkEG5jWkM4lPUS6nKxwvjdRg3thyFKMV79Q0OpnlcrRJk1emWzP%2BX6puLvyA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fd7fd356ab-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=766&min_rtt=503&rtt_var=273&sent=23&recv=21&lost=0&retrans=0&sent_bytes=22922&recv_bytes=3031&delivery_rate=23737704&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/930e038cbc1d5688/1744747067377/0Namp5VnG9r_52M | 104.18.94.41 | 200 OK | 61 B |
URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/930e038cbc1d5688/1744747067377/0Namp5VnG9r_52M IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typePNG image data, 79 x 42, 8-bit/color RGB, non-interlaced Hash09f185d81479c7051a1098c56b3fd668 3eb6494cf4acc6881cf3e89bb510a4bce660694b 93a40f7c9eafef55146940eb2b2f7195311f1fa440038360d0f041bc3b207530
GET /cdn-cgi/challenge-platform/h/b/d/930e038cbc1d5688/1744747067377/0Namp5VnG9r_52M HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:57:48 GMT
content-type: image/png
content-length: 61
priority: u=4,i=?0
server: cloudflare
cf-ray: 930e039a2f385688-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| haxnode.net/wp-content/plugins/chp-ads-block-detector/assets/img/icon.png | 104.21.112.1 | 200 OK | 16 kB |
URL GET haxnode.net/wp-content/plugins/chp-ads-block-detector/assets/img/icon.png IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typePNG image data, 350 x 350, 8-bit colormap, non-interlaced Hash134fce13c189ed0e483a1bddb6406204 eed559ac52e9731c56a1fb03eb94fc82e551bb66 723597ec6e9461e79c420faf0454170cf6f9243246a4fac3cef5f05a4b5be791
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/chp-ads-block-detector/assets/img/icon.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: image/png
Content-Length: 15671
Connection: keep-alive
Last-Modified: Tue, 18 Feb 2025 14:23:56 GMT
ETag: "3d37-62e6b6422a993"
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jT3KNuGoU29%2FrQeii2UjnlvdgWvHhsmjVg58sFYbWCiJAiuBls447IE2ONMKfAIq8C318TwmZiqHzKgfmM6q4uwTG3X4lPGxjh424RI%2FYQSiSmZWzy9Z%2Fs2BK7z5fA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e03fe0b98b4f7-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=1386&min_rtt=414&rtt_var=1222&sent=28&recv=18&lost=0&retrans=1&sent_bytes=30588&recv_bytes=3660&delivery_rate=18190954&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/themes/hueman/assets/front/webfonts/fa-regular-400.woff2?v=5.15.2 | 104.21.112.1 | 200 OK | 14 kB |
URL GET haxnode.net/wp-content/themes/hueman/assets/front/webfonts/fa-regular-400.woff2?v=5.15.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 13588, version 331.-31327 Hash847712aaabbeba674afdda86d31cab17 c07631a91ee71c0a1a84a3151db42b1f2d9a9692 b3b8c21edfe6c5e402fdc607366fd8d15949a65914f58134733dc68922bc8d61
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/hueman/assets/front/webfonts/fa-regular-400.woff2?v=5.15.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: font/woff2
Content-Length: 13588
Connection: keep-alive
Last-Modified: Fri, 13 Dec 2024 17:06:05 GMT
ETag: "3514-62929d8ad8787"
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wcdx9xOqH0pZC6YB%2F%2F6vKUJDztuP8Umg9p4L7XcgXQXwG1Swfo3ehd9eTGtWClF%2BrBM7YGAvdG2V44yzCLptOncKGdTOpgTA1u07WSYN3RoNQIrfWrUl0D0Pxtxoug%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e03fc6991b4f7-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=660&min_rtt=414&rtt_var=187&sent=12&recv=14&lost=0&retrans=0&sent_bytes=13817&recv_bytes=1855&delivery_rate=18190954&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=7.3.1 | 104.21.112.1 | 200 OK | 3.8 kB |
URL GET haxnode.net/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=7.3.1 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (1688), with CRLF line terminators Hash3554109b91690289dac4fa8bde7f92cc 1f9b6737a19c83b0bf54b572c3623a25b3f53a1a 7120727ca8fcb14d4a3b6cb9376c7df2d7bf6a9cd90970ef16846f782722d334
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=7.3.1 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 1498
Connection: keep-alive
Last-Modified: Mon, 07 Apr 2025 10:10:38 GMT
ETag: "ef5-6322d72a4ee9e-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FbYbIEgEC%2BX%2F1dfIp8F3J0bwyXhrRZBVIXt48CPCsE25sOTIjEk%2FiDKiW3PD0QL%2Blhg%2FCTgySFvR0vhT8lDOf5i0PrPIsjnQKh%2Fbnk2xNr5r1z%2B8lTV4XbvN2ACYBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fb8cba56a5-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=899&min_rtt=447&rtt_var=209&sent=76&recv=68&lost=0&retrans=0&sent_bytes=86108&recv_bytes=13399&delivery_rate=20368286&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/plugins/easy-table-of-contents/vendor/js-cookie/js.cookie.min.js?ver=2.2.1 | 104.21.112.1 | 200 OK | 2.5 kB |
URL GET haxnode.net/wp-content/plugins/easy-table-of-contents/vendor/js-cookie/js.cookie.min.js?ver=2.2.1 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (2369), with CRLF line terminators Hash634ee9f21b34eb24ea532f2ee6042baf 6c32dedd95da07aa54c3b852d789bb529956427d ef09f4bec10862578ab2a20b0b0f5cff4faef4b3ce0fe01872a1460ad0d72c50
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/easy-table-of-contents/vendor/js-cookie/js.cookie.min.js?ver=2.2.1 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 1101
Connection: keep-alive
Last-Modified: Sun, 16 Mar 2025 15:08:12 GMT
ETag: "9ee-630770a49ccd9-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=38RYTJPpt9Y2U09P4Yw13lL721YGSyC33WjeOt7X8p0V%2Fr8xqZVXzLG4VKnlxomNqKwzy%2BNVaRKpZNInbGgm%2F%2BcB1D%2Faih27LSnDFHYgRuhfsnKq9P9uVBAIioIo7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fd5a11b529-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=1180&min_rtt=482&rtt_var=1388&sent=62&recv=9&lost=0&retrans=0&sent_bytes=83703&recv_bytes=2757&delivery_rate=7083158&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 |  142.250.178.67 | 200 OK | 51 kB |
URL GET fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 IP142.250.178.67:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 51404, version 1.0 Hashb904fcdf1c4c6059fadd6893a7bc7619 f41d1674f02616f03ef77d4e84b3ad8ba28a36fc 517edd119c5b2719e6ac4b30bf1fd864a6395179a41d273c0afc0696e7495d8e
GET /s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 51404
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 12 Apr 2025 08:27:21 GMT
Expires: Sun, 12 Apr 2026 08:27:21 GMT
Cache-Control: public, max-age=31536000
Age: 300643
Last-Modified: Wed, 18 Oct 2023 17:52:59 GMT
Content-Type: font/woff2
|
|
| challenges.cloudflare.com/turnstile/v0/b/580ba44007a6/api.js?onload=cvpQy6&render=explicit | 104.18.94.41 | 200 OK | 48 kB |
URL GET challenges.cloudflare.com/turnstile/v0/b/580ba44007a6/api.js?onload=cvpQy6&render=explicit IP104.18.94.41:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typeJavaScript source, ASCII text, with very long lines (48122) Hashd00e161860ff36cf8482d4768e280cab a6d5b477886524767e67d3edee385cd2c9f41a54 ca540bf2ebcfb08c9c8c92512c58707f1a62a572efd7ac409cba2229b55f012c
GET /turnstile/v0/b/580ba44007a6/api.js?onload=cvpQy6&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Apr 2025 19:57:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Fri, 04 Apr 2025 13:58:27 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 930e0388af4356ae-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ | 104.18.94.41 | 200 OK | 28 kB |
URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ IP104.18.94.41:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typeHTML document, ASCII text, with very long lines (22054) Hashc4fb2c587c451443ec3bf24a799a6b4d 8a925dcf5b710497ddaa51dcc38f0b4fb9f7e3e5 56d90563529ddeebd4cfb24082bffc3a8fd500268fe2a3dd9402330a26810565
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:57:46 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
content-security-policy: default-src 'none'; script-src 'nonce-PguKuc7QvewqaCg6' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
referrer-policy: same-origin
document-policy: js-profiling
priority: u=4,i=?0
server: cloudflare
cf-ray: 930e038cbc1d5688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| haxnode.net/wp-content/themes/hueman/assets/front/js/scripts.min.js?ver=3.7.27 | 104.21.112.1 | 200 OK | 76 kB |
URL GET haxnode.net/wp-content/themes/hueman/assets/front/js/scripts.min.js?ver=3.7.27 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (39708), with CRLF line terminators Hash3fb19d6ce1004b6c456dec717f222599 c90c583ad2ac468b93e0ad50276cd18a4d888b27 1891b054a7cf74a81590ee3ea25baa920520a70de1e1ab716a8fe2639b827e00
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/hueman/assets/front/js/scripts.min.js?ver=3.7.27 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 21302
Connection: keep-alive
Last-Modified: Fri, 13 Dec 2024 17:06:05 GMT
ETag: "1295c-62929d8ad6847-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lL1AYNPKOeE6xrcUO68cofQm2FK%2FvYmQZK3DL7%2BReF3ynD9K2PeEPOKRwKKeEantncg36nzYHljUwfpCiD5sU8eRdiejMC%2B%2BUmTjwOiVdb3vgb51cliw6r913EYn5w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fde89356a5-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=885&min_rtt=447&rtt_var=306&sent=139&recv=74&lost=0&retrans=0&sent_bytes=169459&recv_bytes=16128&delivery_rate=56546722&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-json/wordpress-popular-posts/v2/views/23533 | 104.21.32.1 | 403 Forbidden | 0 B |
URL OPTIONS haxnode.net/wp-json/wordpress-popular-posts/v2/views/23533 IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
OPTIONS /wp-json/wordpress-popular-posts/v2/views/23533 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-requested-with,x-wp-nonce
Referer: http://haxnode.net/
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Tue, 15 Apr 2025 19:58:04 GMT
content-type: text/html; charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vzCvD0gxC9hsigPkl9eYZT1KuBk95UrIHQR4wCePp43iJnmLUnWip4KXSzjSUuN1ujqAVh%2BkbCt%2FdPldEQGEfXfXRl7%2FxK7qHm%2F9I1UI2C4kEz15gdEOa3uv8GR2TQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-encoding: br
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server-timing: chlray;desc="930e03fc68d00b31", cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=18134&x=16"
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
cf-ray: 930e03fc68d00b31-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
|
|
| haxnode.net/favicon.ico | 104.21.112.1 | 302 Found | 0 B |
IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/?__cf_chl_rt_tk=8QGPB98eo.D_.PKqA5qcRknh0rMA9c8jBnpnm.N.7yY-1744747065-1.0.1.1-SRRS2DtA00SIGl4BzrhSlgck9SpHD1kcq3BJggxLEI0
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Tue, 15 Apr 2025 19:57:45 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://haxnode.net/wp-json/>; rel="https://api.w.org/"
X-Redirect-By: WordPress
Location: https://haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png
CF-Cache-Status: BYPASS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AjYVAulpcMAmA9FDmTG5CY764Z2l0LqR8PnY6v7QCVDbfSCCNvAzKGksg0de5XgO0vNdbwxTbEFVEyvgilVZAhr8yXBSk5rxEpBXvjLaEr5KTZzBPrRNZmCcfLfv9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e0387fde956a5-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=709&min_rtt=447&rtt_var=173&sent=30&recv=22&lost=0&retrans=0&sent_bytes=37132&recv_bytes=1040&delivery_rate=17079947&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/cdn-cgi/challenge-platform/h/b/flow/ov1/119380093:1744745139:EEHF1abbIy4B2cDwSFAC3mevmGtDX6YlOD6hCg6zIUw/930e0385cec456b4/P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ | 104.21.112.1 | 200 OK | 17 kB |
URL POST haxnode.net/cdn-cgi/challenge-platform/h/b/flow/ov1/119380093:1744745139:EEHF1abbIy4B2cDwSFAC3mevmGtDX6YlOD6hCg6zIUw/930e0385cec456b4/P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (16952), with no line terminators Hasha76314cae8796c7e38b4b0da1ee9a623 dc6f3cc9542e5cf8efa27120a22b5bc348347820 30c8c6f66ce603038242e16dc016d42ef678bede8fea7afabdc3ac143d96f726
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/119380093:1744745139:EEHF1abbIy4B2cDwSFAC3mevmGtDX6YlOD6hCg6zIUw/930e0385cec456b4/P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/
cf-chl: P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 1993
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:57:45 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: WCDvX/WU8iRbZYSaqopfYvGdB4yPh+RrIV1avwcd7EI=$dgq1sX7z89V5f0xDrdf+VQ==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XcDr7v7zXOxDXp3uP9ZTi9VWePBwbfOFbjBJmgI2Nf5fwGygLs0Hkg7vgvVN6kn9mwveMEwTrqtmu0%2BmfBwTwZugDBUW3yg5emOCUGLOVJkeGkjCdpvpYak2Sr2hcA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e0389b80056a5-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=879&min_rtt=447&rtt_var=470&sent=33&recv=25&lost=0&retrans=0&sent_bytes=38112&recv_bytes=3868&delivery_rate=17079947&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js | 142.250.74.170 | 200 OK | 90 kB |
URL GET ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js IP142.250.74.170:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint3C:2E:67:30:A6:95:F3:D3:61:49:AB:AC:BC:D1:CF:77:3E:33:8F:B7 ValidityThu, 20 Mar 2025 11:19:46 GMT - Thu, 12 Jun 2025 11:19:45 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash00727d1d5d9c90f7de826f1a4a9cc632 ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2 a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
GET /ajax/libs/jquery/3.6.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31100
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Apr 2025 09:17:32 GMT
expires: Fri, 10 Apr 2026 09:17:32 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 470433
last-modified: Thu, 08 Sep 2022 18:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| haxnode.net/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 | 104.21.112.1 | 200 OK | 88 kB |
URL GET haxnode.net/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (65447) Hash826eb77e86b02ab7724fe3d0141ff87c 79cd3587d565afe290076a8d36c31c305a573d18 cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 30368
Connection: keep-alive
Last-Modified: Wed, 07 Aug 2024 14:34:37 GMT
ETag: "15601-61f18cf3fb940-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Br4hyRLsDO3%2FXRWrMnP3drOP5%2BmjbwUv%2BZg1hWUf406OpIE0OBHk8ig3gQ%2BXsUDKRGn5VwZLn5hNkKUUWLSlWhfr7AzVhAnj8iBb8c%2B6atRAMn9e%2FPSBJwEHeCtdsA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fc7b850b3d-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=423&min_rtt=394&rtt_var=163&sent=4&recv=6&lost=0&retrans=0&sent_bytes=1501&recv_bytes=1759&delivery_rate=5526717&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDwM9.woff2 | 142.250.178.67 | 200 OK | 57 kB |
URL GET fonts.gstatic.com/s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDwM9.woff2 IP142.250.178.67:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 56996, version 1.0 Hashd5547aea79a622cb2b4d18c905ab22c2 3d69fb0712097f39bd7bf057866fcc4448a37008 4e0d02c04fe3bb456ed7318a162a6248bd481b6f8e955fecda064d7c0ad3d792
GET /s/robotocondensed/v27/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDwM9.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 56996
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 14 Apr 2025 14:39:34 GMT
Expires: Tue, 14 Apr 2026 14:39:34 GMT
Cache-Control: public, max-age=31536000
Age: 105510
Last-Modified: Wed, 18 Oct 2023 17:53:14 GMT
Content-Type: font/woff2
|
|
| haxnode.net/wp-content/uploads/2019/09/cropped-haxnode.png | 104.21.32.1 | 200 OK | 18 kB |
URL GET haxnode.net/wp-content/uploads/2019/09/cropped-haxnode.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
File typePNG image data, 876 x 312, 8-bit/color RGBA, non-interlaced Hash5f0ce6ceae4e64c0d5a57ea6dcb07cc7 10106d17208d4ed5cff623074984d229ff8b5f51 83d1ef699bfc77c78238fd2e90f720632161cb9a99ee63aa4948b15e1eb725cd
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2019/09/cropped-haxnode.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:58:04 GMT
content-type: image/png
content-length: 17653
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3a8Y7eYEg2R0GNEh2mLBD4U5w0KUrGrXOGqC42EIyjKjHi5fmzGoHmQisq%2Ffm4fT%2F63lF5eOvx5j5TfbUJ4tKc8YwN%2BsjjvgLBweukaQmvSVBpsgrZmdU4qpAtaz%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 15 Mar 2021 19:44:32 GMT
etag: "44f5-5bd987a888800"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
cf-ray: 930e03fba8be0b31-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=18190&x=16"
|
|
| fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 | 142.250.178.67 | 200 OK | 51 kB |
URL GET fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 IP142.250.178.67:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 51404, version 1.0 Hashb904fcdf1c4c6059fadd6893a7bc7619 f41d1674f02616f03ef77d4e84b3ad8ba28a36fc 517edd119c5b2719e6ac4b30bf1fd864a6395179a41d273c0afc0696e7495d8e
GET /s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 51404
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 12 Apr 2025 08:27:21 GMT
Expires: Sun, 12 Apr 2026 08:27:21 GMT
Cache-Control: public, max-age=31536000
Age: 300643
Last-Modified: Wed, 18 Oct 2023 17:52:59 GMT
Content-Type: font/woff2
|
|
| haxnode.net/wp-content/plugins/wordpress-popular-posts/assets/css/wpp.css?ver=7.3.1 | 104.21.112.1 | 200 OK | 1.7 kB |
URL GET haxnode.net/wp-content/plugins/wordpress-popular-posts/assets/css/wpp.css?ver=7.3.1 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with CRLF line terminators Hashc45f68fb3fc3a1b08f93a0827ea4b067 bded618d3417d75a378470e91e070ff92d6c097c 1860b9a4475b564ae977f1a4413f7bbb668ec4a3de07a974baeaae0a6803c02d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/wordpress-popular-posts/assets/css/wpp.css?ver=7.3.1 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/css
Content-Length: 578
Connection: keep-alive
Last-Modified: Mon, 07 Apr 2025 10:10:38 GMT
ETag: "6cf-6322d72a4defe-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lQeQ7FNplrtw9UheqHvr3o%2FIDKtAwX7i67sPO0w8v9NFtyr33p2T6PgzSXkG3Ova3BuNbiuP13ZDaWyczFmtrC6p4NKPnRUS9FMcmpEBJgyfeJQPG%2FfeKtL4CtPwFA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fb9a840b3d-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=394&min_rtt=394&rtt_var=197&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=900&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/plugins/easy-table-of-contents/assets/js/smooth_scroll.min.js?ver=2.0.73 | 104.21.112.1 | 200 OK | 1.2 kB |
URL GET haxnode.net/wp-content/plugins/easy-table-of-contents/assets/js/smooth_scroll.min.js?ver=2.0.73 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (1239), with no line terminators Hash81f0d173893eab3401131bea6b2a24de cbe1ff491cc8f890c5ac8511302dd89cea5c1239 23288a00ecc43659a2cdfbd9b13996f510fb709bb15bd48712849763491ec420
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/easy-table-of-contents/assets/js/smooth_scroll.min.js?ver=2.0.73 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 553
Connection: keep-alive
Last-Modified: Sun, 16 Mar 2025 15:08:12 GMT
ETag: "4d7-630770a49bd39-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0U8Bn06zcz9sdh45p5JpHEhVPuMDkMIC5cPx3uW5Zr6KKgPf3SN8xhQYRcAaEvOGlKNzuioznTmjyi7wDG4K4K%2B0Q5YYgzFu5AX%2BeO4CxBLA9WMrDIEksEb4TrgLAg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fd2f4256a5-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=929&min_rtt=447&rtt_var=305&sent=136&recv=72&lost=0&retrans=0&sent_bytes=167959&recv_bytes=15248&delivery_rate=56546722&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-includes/js/wp-emoji-release.min.js?ver=6.7.2 | 104.21.112.1 | 200 OK | 19 kB |
URL GET haxnode.net/wp-includes/js/wp-emoji-release.min.js?ver=6.7.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (15752) Hashb976b651932bfd25b9ddb5b7693d88a7 7fcb7cb5c11227f9213b1e08a07d0212209e1432 4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/wp-emoji-release.min.js?ver=6.7.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 5062
Connection: keep-alive
Last-Modified: Thu, 08 Aug 2024 03:12:25 GMT
ETag: "4926-61f23655e0c3c-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HbudPPeZO3qICGN1MG1Nu6UyVzdjybS6kFkv8HV6VbBKxP%2B%2FKOjYaTMEWo%2B45y21lXEoPn03M5rdYEInoPdlsQgUJ%2B35bCF3cjl9cXZnhHp96gjp9qfdiAksf1zn0w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e04003eaeb529-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=1125&min_rtt=482&rtt_var=1151&sent=65&recv=11&lost=0&retrans=0&sent_bytes=85755&recv_bytes=3619&delivery_rate=7083158&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/uploads/2019/03/hn-logo.png | 104.21.32.1 | 200 OK | 4.6 kB |
URL GET haxnode.net/wp-content/uploads/2019/03/hn-logo.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
File typePNG image data, 400 x 332, 8-bit/color RGBA, non-interlaced Hash1042c6a64956cd4d496049ca6a6b11ae f66a26b7bf6d57babd930ba54086755a9647dcc0 d24ff7ccd6e6cfa03a826c6081250021965676dcb54f52d82b3791a9cc802d78
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2019/03/hn-logo.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:58:05 GMT
content-type: image/png
content-length: 4571
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MKJg7nEQKVVPGKYt4ti8zm4QHm8rmvCDqxQxEnJt9C94n7Foptq2dsa7sD12i5iPY1tRtOvQYWfFPxULJrT9JYqXj3lZhFecRi2rlxnX01uGP9MixYmvOHZ%2B66aItA%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 15 Mar 2021 19:44:04 GMT
etag: "11db-5bd9878dd4900"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
cf-ray: 930e0401f9190b31-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=19185&x=16"
|
|
| fonts.googleapis.com/css?family=Roboto+Condensed:400,300italic,300,400italic,700&subset=latin,cyrillic-ext | 142.250.178.74 | 200 OK | 12 kB |
URL GET fonts.googleapis.com/css?family=Roboto+Condensed:400,300italic,300,400italic,700&subset=latin,cyrillic-ext IP142.250.178.74:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
Hash5e62fc442f2c84d6a5eb1932289eb4ab 9322a461b7ca23fe0f5b4125edb3ad314581fd76 ae45a00bd1971706fc10df3224806940c560ef6425483e87c128a1c383f771a4
GET /css?family=Roboto+Condensed:400,300italic,300,400italic,700&subset=latin,cyrillic-ext HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Tue, 15 Apr 2025 19:58:04 GMT
Date: Tue, 15 Apr 2025 19:58:04 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
|
|
| haxnode.net/wp-content/plugins/easy-table-of-contents/vendor/sticky-kit/jquery.sticky-kit.min.js?ver=1.9.2 | 104.21.112.1 | 200 OK | 2.9 kB |
URL GET haxnode.net/wp-content/plugins/easy-table-of-contents/vendor/sticky-kit/jquery.sticky-kit.min.js?ver=1.9.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with CRLF line terminators Hashf74050f4bacb44b594f0014217a4b3c0 7f45d27c9185b2b4312140f234258bb76573a2c4 66361c617e79f2f0643b4ce1a922a59cb6d4e048fa3ee5cbc2309ab826af40ac
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/easy-table-of-contents/vendor/sticky-kit/jquery.sticky-kit.min.js?ver=1.9.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 1280
Connection: keep-alive
Last-Modified: Sun, 16 Mar 2025 15:08:12 GMT
ETag: "b5b-630770a49ccd9-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ubijMsODhvJ%2FTKSdAFR2rdpL4LDCc%2B5qqVJexyNezEEhm%2B7DRBLthLLBJ9Sj%2FpiRaoqeiEsCbDrlpSG22cQo5wSt81pHdoyZWh1xB7xIHmdDbTiPXz7i3KbalbEfcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fd5abbb4f7-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=1328&min_rtt=414&rtt_var=1475&sent=25&recv=16&lost=0&retrans=1&sent_bytes=28357&recv_bytes=2763&delivery_rate=18190954&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 | 142.250.178.67 | 200 OK | 51 kB |
URL GET fonts.gstatic.com/s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 IP142.250.178.67:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 51404, version 1.0 Hashb904fcdf1c4c6059fadd6893a7bc7619 f41d1674f02616f03ef77d4e84b3ad8ba28a36fc 517edd119c5b2719e6ac4b30bf1fd864a6395179a41d273c0afc0696e7495d8e
GET /s/robotocondensed/v27/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 51404
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 12 Apr 2025 08:27:21 GMT
Expires: Sun, 12 Apr 2026 08:27:21 GMT
Cache-Control: public, max-age=31536000
Age: 300643
Last-Modified: Wed, 18 Oct 2023 17:52:59 GMT
Content-Type: font/woff2
|
|
| pagead2.googlesyndication.com/pagead/js/adsbygoogle.js | 142.250.178.66 | 200 OK | 156 kB |
URL GET pagead2.googlesyndication.com/pagead/js/adsbygoogle.js IP142.250.178.66:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subject*.g.doubleclick.net Fingerprint78:5B:F8:FF:50:87:46:A8:DF:37:9D:38:26:34:7C:3B:1B:89:3C:DF ValidityThu, 20 Mar 2025 11:18:39 GMT - Thu, 12 Jun 2025 11:18:38 GMT
File typeJavaScript source, ASCII text, with very long lines (4158) Size156 kB (155767 bytes) Hash057c938233859d813aba7b3e7630aca7 2c32381c1f60efe47630aa3e5445270c53e65975 ee1179e69716b2c9d7734edf26ad40c7593e2f68ca33b34c41a6f53b838fb2d2
GET /pagead/js/adsbygoogle.js HTTP/1.1
Host: pagead2.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
vary: Accept-Encoding
date: Tue, 15 Apr 2025 19:58:05 GMT
expires: Tue, 15 Apr 2025 19:58:05 GMT
cache-control: private, max-age=3600, stale-while-revalidate=3600
content-type: text/javascript; charset=UTF-8
etag: 13613124441294287981
access-control-allow-origin: *
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 52809
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js | 172.217.21.163 | 200 OK | 562 kB |
URL GET www.gstatic.com/recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js IP172.217.21.163:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint04:FF:92:E7:16:B0:49:91:8B:B7:8D:C6:93:B9:20:B4:2A:33:9F:A8 ValidityThu, 20 Mar 2025 11:19:45 GMT - Thu, 12 Jun 2025 11:19:44 GMT
File typeJavaScript source, ASCII text, with very long lines (594) Size562 kB (561652 bytes) Hasha3ba6f3831dfac23271ed79db3467b14 2f93eae45276abdcf26b684ef45036c7bf0d7f61 9c60f375bb60b19dc9bb69d9f8abc316d7652a2f088b26c42fccbdfc15e6ff6a
GET /recaptcha/releases/hbAq-YhJxOnlU-7cpgBoAJHb/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
timing-allow-origin: *
content-length: 221651
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 15 Apr 2025 18:02:44 GMT
expires: Wed, 15 Apr 2026 18:02:44 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 24 Mar 2025 02:01:29 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 6921
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| haxnode.net/wp-content/themes/hueman/assets/front/css/font-awesome.min.css?ver=3.7.27 | 104.21.112.1 | 200 OK | 60 kB |
URL GET haxnode.net/wp-content/themes/hueman/assets/front/css/font-awesome.min.css?ver=3.7.27 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (59326), with CRLF line terminators Hash193a764767dd5968360412c9e5a5a9e6 ea38e5ef30f4f918a755b6415151e1413c80b635 6c76cae4aabc1d4236da2fecf8fcae818a2cf95406446774ccf9db5ca14d4b59
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/hueman/assets/front/css/font-awesome.min.css?ver=3.7.27 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/css
Content-Length: 12884
Connection: keep-alive
Last-Modified: Fri, 13 Dec 2024 17:06:05 GMT
ETag: "e877-62929d8ad29c7-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ASyVZ%2BZrPTB1u4JZR6pmVVIgcu3jGYn8ZsH1tmqJIVg27PEeWFzQAFx55ekq5kYezt0kyz%2BqoPMRTzMmLHCyW%2BMRYn0C9Db6pAOFtWIU9R3uhCx%2BRRt35uwFoKBtYA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fb9868b4f7-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=414&min_rtt=414&rtt_var=207&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=902&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/uploads/2023/12/Faronics-Deep-Freeze-Standard.png | 104.21.32.1 | 200 OK | 30 kB |
URL GET haxnode.net/wp-content/uploads/2023/12/Faronics-Deep-Freeze-Standard.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
File typePNG image data, 400 x 320, 8-bit colormap, non-interlaced Hashb7f9a789cdc571c4257865076367532f 6ae52f7d34b89684864d0877d1b79b882555a07c 5a03691b01408253b7d316c8a58af022dd0e1009428374daaa7d52e6726f4fc2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2023/12/Faronics-Deep-Freeze-Standard.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:58:04 GMT
content-type: image/png
content-length: 29623
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xAJc8eV9KzDD7Jp74R%2BndNelWDsFnnCbB1cosu%2FfcFVw6FGTPNssHc8YBbR6VLT1zp4w%2FA1g4DmPXW0JxsusUOG%2FudqE1AtMt1WiNUiNWoO%2BIUUU0YS61I8i917IMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Sun, 31 Dec 2023 16:36:09 GMT
etag: "73b7-60dd0dcd88e2e"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
cf-ray: 930e03fba8bf0b31-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=18227&x=16"
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1459382755:1744745152:Z5AiYg5gRDuO2TTmHtKmlzSrk4uNKcESg-OLATKce30/930e038cbc1d5688/6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ | 104.18.94.41 | 200 OK | 229 kB |
URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1459382755:1744745152:Z5AiYg5gRDuO2TTmHtKmlzSrk4uNKcESg-OLATKce30/930e038cbc1d5688/6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size229 kB (228684 bytes) Hasha4ce7d31899dfa599ceb91a4fef9f7c0 937f2083fbb0a96f68dbfb33202e6219fa0bd7b9 dbd1dc729feb6e21bc5ab4c91f414968c9261700753f111819e92e3c4a5d3499
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1459382755:1744745152:Z5AiYg5gRDuO2TTmHtKmlzSrk4uNKcESg-OLATKce30/930e038cbc1d5688/6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/
cf-chl: 6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 3767
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:57:47 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: I/zz4ZO5Uu5+lrpra3otdqRJO3QKEGE+Ofs/dGxGNfMiUhaUvezKk1c0Nt2QLUCFPJvSVxV1F6CBnuusgjuMa25Vf/FPCx55SZ1oRMNbPo8zdVPcsut+F67Qgjna3xfL60ZPWZif4zXF5qj96PbaPSP2+eNW9rNhoICOYkN+8BAa8e3yBirAoabLlsAYd4shD0v2KNmB3WkKCrEUOnbvIRculHKB2byA4qzh/VOmAXyyI0TasruKLZuvX3Hv2BU/zWFjXE6TPYOfQCZ15Z6MgleWYX3VooW/dAIHlLH9SjLkg7h2JgRx7ggnacj9QQgn1Dd5Ktyhvoh77463mBNvY8YJIx8EPAI5kTo712ZFUaFzruVR35Xgv4oxMsSQ63xrHCaeMfkJ/fbfOA2qNRsU4PVhn5qfa6N1TdzQvaPBDQSOBKiM3NyhNtJgiHq8QaqNPBsBh0+Xr4xBpK5eE+iVm1tlChfC4YPh3DNKz1URNYbWUC20KTZBEB3D0mf4yL2GbvPmysog2PbXYuLnW7rPxUihnsPqe52ckOlr2LY3T/7ShDA8lGPnvDAhdiOxS00S4bRxI31+rnGCfrDjxNRlnMfQ06Bk8g2b/o/JSr0HiVzcGC1QWGhhUTOnIiKhLwQ9xgrdtP0z1c7AsxFfgEvqsRhOwQhAtQhvWH430AvOuMJwinaYrnkiVG3k58qBFTkb3ts+0RLxIk101s1GJoc+H5exacxOMMeF5fjZJr0Hq1RJqBADTeyQBH+5LE/VB+7lR/LBGIzsojMSE8OZmtEBmQ==$p8dt2LFb6RT535XWNs9TbA==
priority: u=3,i=?0
server: cloudflare
cf-ray: 930e0392fd945688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| haxnode.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=930e0385cec456b4 | 104.21.112.1 | 200 OK | 96 kB |
URL GET haxnode.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=930e0385cec456b4 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash39a4fd246b923d9d955ed04ebbe38d43 9b4229bee26fd8d9d5be2919729207274bdff3b2 f02e1a6d1b1f3c30cfe850c14b3bd71b7525799e233bae8931cc0577d3e85499
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=930e0385cec456b4 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/?__cf_chl_rt_tk=8QGPB98eo.D_.PKqA5qcRknh0rMA9c8jBnpnm.N.7yY-1744747065-1.0.1.1-SRRS2DtA00SIGl4BzrhSlgck9SpHD1kcq3BJggxLEI0
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:57:45 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BNjJw6TWIg%2B2jciG%2FgFjFSrYxl0ZFHqurcjKNrmAGhVepI7ArlqpNh%2BHZdRXywpSLo5Glit24RiDz6tuJeCA28h8NMpP9HPmBIPhBaQlEZgGRKQacGO2ItDmc4LapQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03877d4456a5-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=447&min_rtt=447&rtt_var=223&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=541&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png | 104.21.32.1 | 403 Forbidden | 0 B |
URL GET haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2019/03/hn-logo-150x150.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Tue, 15 Apr 2025 19:57:46 GMT
content-type: text/html; charset=UTF-8
content-encoding: br
cf-ray: 930e038adae95694-OSL
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FUWDJmOyt4BCvWpq0mq7ErCiTjk0O9NZmiVew9RTfLYyDYMcuJKlpzdaqiJbcNoY0GLAyTa56xBT8EoBfi4imdRxI603tNFMyR4bBI0%2Fsuo81uZTh6ob4N2cdNGM7A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: chlray;desc="930e038adae95694", cfL4;desc="?proto=TCP&rtt=1136&min_rtt=593&rtt_var=599&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3276&recv_bytes=1209&delivery_rate=7180165&cwnd=253&unsent_bytes=0&cid=335fac9bb2f73752&ts=39&x=0"
X-Firefox-Spdy: h2
|
|
| haxnode.net/faronics-deep-freeze-standard/ | 104.21.80.1 | 403 Forbidden | 7.8 kB |
URL User Request GET haxnode.net/faronics-deep-freeze-standard/ IP104.21.80.1:443
CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
File typeHTML document, ASCII text, with very long lines (7772), with no line terminators Hash79af7c7276cbd36f60d269864186c189 d43e460e79073e42ceeda67db5b9d5f8978e3558 62cc1730662ae813b75635488388bad974d593e9ae2e81d7b499ab9c947db3ba
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /faronics-deep-freeze-standard/ HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Tue, 15 Apr 2025 19:57:45 GMT
content-type: text/html; charset=UTF-8
content-encoding: br
cf-ray: 930e03844c5356aa-OSL
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1vQ%2Fix%2BXWl2pE0ShFbdjcB4zb9lNeFU7Ickny1F9J%2BP2SwzPr9w%2Fr6tLqkv2YBVZNJo0hrImZmBUohLobAkD9pKdJRygwXh9A7tCJ%2Btnc51BBMtp3pZavz7ExhYgmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: chlray;desc="930e03844c5356aa", cfL4;desc="?proto=TCP&rtt=567&min_rtt=493&rtt_var=148&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3275&recv_bytes=1267&delivery_rate=7017770&cwnd=254&unsent_bytes=0&cid=7f4576bba6624c63&ts=59&x=0"
X-Firefox-Spdy: h2
|
|
| haxnode.net/wp-includes/js/comment-reply.min.js?ver=6.7.2 | 104.21.112.1 | 200 OK | 3.0 kB |
URL GET haxnode.net/wp-includes/js/comment-reply.min.js?ver=6.7.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (2991) Hashe4a49df71f8b98c1d9f9d8fce74d89e8 b95fcda0c8c26305ad94e80343d0cfca8a048a10 9d4687a19cab8f7442a3bda40c45be4d10e42488e091ddd706c3caed83c3ee1f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/comment-reply.min.js?ver=6.7.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 1375
Connection: keep-alive
Last-Modified: Wed, 18 Dec 2024 05:12:48 GMT
ETag: "bd2-6298476f8bc85-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2BamgsFn66RdiagQh4PBoLbTRaH4qQPZfLqbBOIzaOyE76QD4q1hgaCz9Ie2dm3I%2FVDBjK2VeM%2BfH1CwEKapon3XpzVarM1kr9cFgWXr8T9cvUCdWs8EHkd1uH22kw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fde88a56ab-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=749&min_rtt=503&rtt_var=238&sent=26&recv=23&lost=0&retrans=0&sent_bytes=25344&recv_bytes=3890&delivery_rate=23737704&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/themes/hueman/assets/front/webfonts/fa-solid-900.woff2?v=5.15.2 | 104.21.112.1 | 200 OK | 80 kB |
URL GET haxnode.net/wp-content/themes/hueman/assets/front/webfonts/fa-solid-900.woff2?v=5.15.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 80252, version 331.-31327 Hash9ae050d1876ac1763eb6afe4264e6d5a 72344eab2e7431eec313caa21f266cbfda7caf60 6c916669cf923b4f1b2db5c5107c83b6ca205e7ad0dcd840b251e63f0c8d28a2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/hueman/assets/front/webfonts/fa-solid-900.woff2?v=5.15.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: font/woff2
Content-Length: 80252
Connection: keep-alive
Last-Modified: Fri, 13 Dec 2024 17:06:05 GMT
ETag: "1397c-62929d8ad9727"
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K7pv2xO5zfRJkwnviEXRxeJO%2FwV7RL%2Fo%2Bs71L1Gkr1Gk1Po4SAr%2BuRqDKZ9isIHTANGzmlY%2FeUbHsU7Uf7GcGdmyT081udkT2uwTYGk3Lm1WL%2FtZ5qAEztyot1y3Dw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e03fc78c6b529-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=535&min_rtt=482&rtt_var=229&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2526&recv_bytes=1858&delivery_rate=4000000&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png | 104.21.32.1 | 200 OK | 9.8 kB |
URL GET haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
File typePNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced Hash9a4dacead90b77b35ee454b09a138b7f a59f56b02e01dc2156841f1ac9c0974f72a8a6b1 e8786d98ef6b3ae6bac929392caeb8aacc848d97b9e18e463d2019b46285d91a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2019/03/hn-logo-150x150.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:58:05 GMT
content-type: image/png
content-length: 9832
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G4%2BL%2FjkIoi0ukrOtaJnubiS6SIFekMK0eXsU7QmPFx9bzN64tWno9fQcPlZoLBXUJ%2BjBhD8OKqRGuhvl9w8emgoWC4qQ5REvFodWGA0mIqSh6Ohm0KwzdYQ886%2BKTA%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Mon, 15 Mar 2021 19:44:04 GMT
etag: "2668-5bd9878dd4900"
cache-control: max-age=14400
cf-cache-status: HIT
age: 4206
accept-ranges: bytes
cf-ray: 930e0402091a0b31-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=19040&x=16"
|
|
| haxnode.net/cdn-cgi/challenge-platform/h/b/flow/ov1/119380093:1744745139:EEHF1abbIy4B2cDwSFAC3mevmGtDX6YlOD6hCg6zIUw/930e0385cec456b4/P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ | 104.21.112.1 | 200 OK | 4.2 kB |
URL POST haxnode.net/cdn-cgi/challenge-platform/h/b/flow/ov1/119380093:1744745139:EEHF1abbIy4B2cDwSFAC3mevmGtDX6YlOD6hCg6zIUw/930e0385cec456b4/P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (4200), with no line terminators Hash872bb6fa43e0fe069b27a1dd12bb49f6 415e09a791f715a25c9121cc79f2cda4aad61e54 75308c3a4bf230d02aebd9258e4cbf2721041544709713fc89e5b3cd7d009d84
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/119380093:1744745139:EEHF1abbIy4B2cDwSFAC3mevmGtDX6YlOD6hCg6zIUw/930e0385cec456b4/P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/
cf-chl: P_GlcIzAfvPMYW7GExl4TM.xjNjFnTZ.dhUM.t7jFKY-1744747065-1.2.1.1-e.pK2Ye.UGAa1wc10l.tlhvpMdi12ITaBZT.cdR1D23p_39D2lcNy0_XysTxnuRQ
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 4199
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out: LK8bpGYgOYkTjF21BWE9ZsOQVM1+otQY4B7xbwaJM47MGwYS4MX3QcO/qUngEkGjujq/S0jWrMz+J50MSbAyNg==$y/U39UZTF2X9spC76z3gdQ==
set-cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9; HttpOnly; SameSite=Strict; Path=/; Domain=haxnode.net; Expires=Wed, 15 Apr 2026 19:58:03 GMT
cf-chl-out-s: eAkZSVOxfjQBMlRTmv/Ov41PMX2Bx6YoHmGfd+5tq9w1B4vmvPMm75j9qmVcEsaCVCwDGuE2f5qB1TaKYLVKM+dXi/NHGHJOV5uuiyc41KzP8/IwDeFII8UF7PtijjZRV5QXdHnh+MG5/7MLtdto+juhYFMlNGsl45c4Yq9tesPEGu5rfx5j4fDk4n0ln0wA3DIb3MWAR+o6sVAg064HsFZFL/f03uIp752kjn7hdqPjq7fgteLShplNMgeJS7vl$cDCo+RRfjHUlAPDCPH8TGw==
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Op81Ri9VlDo7nysVdApmXfX8qm34ShfuISB5p%2F7KwLf9E3xv97BR951SwexDeRzTVS5Y8riaE3aLBqLs5GTutg8sLlbhIRcppwlqjAwYkbWxCgo9V1oRKrTl4OFrhw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03f65ccf56a5-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=6372&min_rtt=447&rtt_var=11055&sent=46&recv=36&lost=0&retrans=0&sent_bytes=51808&recv_bytes=8902&delivery_rate=17079947&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/themes/hueman/assets/front/css/main.min.css?ver=3.7.27 | 104.21.112.1 | 200 OK | 94 kB |
URL GET haxnode.net/wp-content/themes/hueman/assets/front/css/main.min.css?ver=3.7.27 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (65536), with no line terminators Hashb5528d5457cdacb7c721bd2f7ee2ae06 2a02c213cffc42cad39fb6f75fc1eea10c28605c d39b765a83700d723062c2030cad7c7358d7e6305c11b64b81fd4381a75da5ae
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/hueman/assets/front/css/main.min.css?ver=3.7.27 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/css
Content-Length: 18018
Connection: keep-alive
Last-Modified: Fri, 13 Dec 2024 17:06:05 GMT
ETag: "17060-62929d8ad29c7-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FeD2%2FI%2FjLcLIW9y1gINWjrfUljDQBx8wHrE%2FicEs%2BIa3dFC%2F9TuEqlRwjR8PZrvaNpfNOD4tIbxYsZWeZGpvdXzIFXrBitpTg3iVgF4zqOGAIIqY82Ae67OzAZhsfg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fb9e4656a9-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=453&min_rtt=453&rtt_var=226&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=894&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.73 | 104.21.112.1 | 200 OK | 5.9 kB |
URL GET haxnode.net/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.73 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (5892), with no line terminators Hasha5041cf01d238b78b60d276f0c02127a 02e5c83e7cd98881ca3223563069c8591d6e8c28 2fdf5f9a856940c379e8cc777e289f5b58d179a3edb5ef3e1e0cff46f7dd670c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.73 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/css
Content-Length: 1603
Connection: keep-alive
Last-Modified: Sun, 16 Mar 2025 15:08:12 GMT
ETag: "1704-630770a49bd39-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ha1bQHw8jKG2aMgQvrTNEOdQykTalxvQh7Z0lcy9DkNHS1GpsvmfjxrAqGVTRVgzLkVFmRGRSgtg4vYE5c5oUBDpxuYPcESWcMe9PQyDMEt2Y192Xt4j2KqRkdW%2BmA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fb9f6eb529-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=482&min_rtt=482&rtt_var=241&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=907&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 | 104.21.112.1 | 200 OK | 14 kB |
URL GET haxnode.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (13479) Hash9ffeb32e2d9efbf8f70caabded242267 3ad0c10e501ac2a9bfa18f9cd7e700219b378738 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 4872
Connection: keep-alive
Last-Modified: Wed, 07 Aug 2024 14:34:37 GMT
ETag: "3509-61f18cf3fb940-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7oa6z6BPoRUZq1R9zlx%2FJIQG52XVi3VDTYdZt%2FV7%2FG%2BwMGI7wa5%2Fgrqg2gHoROPReYrLz6%2F2IK1pEp14dOKJcQys7C8dL89cmR7fZANx7TTQJH6lcNzC6GmBJOkeug%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fcae9556ab-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=663&min_rtt=503&rtt_var=92&sent=17&recv=19&lost=0&retrans=0&sent_bytes=17094&recv_bytes=2131&delivery_rate=23737704&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| www.google.com/recaptcha/api.js?ver=1.30 | 142.250.74.132 | 200 OK | 911 B |
URL GET www.google.com/recaptcha/api.js?ver=1.30 IP142.250.74.132:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjectwww.google.com Fingerprint40:5C:81:99:DA:01:36:FE:E4:60:2B:67:51:3D:C2:62:8D:9A:38:47 ValidityThu, 20 Mar 2025 11:20:31 GMT - Thu, 12 Jun 2025 11:20:30 GMT
File typeJavaScript source, ASCII text, with very long lines (911), with no line terminators Hash135f37843e2c07df0c7a27c7d3e73042 7cd76532ce4a294c87be1d89a03c62deaa305316 89021fb494eebf4825f0072a390cf555191b27a45f7ef77f07b598e1e4876915
GET /recaptcha/api.js?ver=1.30 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Tue, 15 Apr 2025 19:58:04 GMT
date: Tue, 15 Apr 2025 19:58:04 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| haxnode.net/wp-includes/js/underscore.min.js?ver=1.13.7 | 104.21.112.1 | 200 OK | 19 kB |
URL GET haxnode.net/wp-includes/js/underscore.min.js?ver=1.13.7 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeJavaScript source, ASCII text, with very long lines (18843) Hash16699a7f2aebe8d676042962c3bb5537 9697e3fe2d92c79debd82478603d4b59fc249714 5152316fade8c592fbfd38bc491e059464d967d3d31a582b0c885c0961deed30
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/underscore.min.js?ver=1.13.7 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/javascript
Content-Length: 7336
Connection: keep-alive
Last-Modified: Wed, 18 Dec 2024 05:12:48 GMT
ETag: "49be-6298476f8bc85-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiALWJmbAeUo6pWwLmHHwdqQdROnN10pETsxVE8MJqXPUkcOa4dOjgJOgzqFTJ5Z%2FvY0M%2FKw%2FZ9H8vgaNaKTXSO%2BdOrcbcjU1uf3c0MzB5Pjni6%2FJIk1ME3SL4P6gg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fdacd50b3d-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=871&min_rtt=394&rtt_var=1016&sent=28&recv=8&lost=0&retrans=1&sent_bytes=33743&recv_bytes=2616&delivery_rate=7553640&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png | 104.21.32.1 | 403 Forbidden | 0 B |
URL GET haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2019/03/hn-logo-150x150.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Tue, 15 Apr 2025 19:57:46 GMT
content-type: text/html; charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJeWwOYkLNhxIjp9OttxH5D9Lg5eS%2Bk0NOoI079VQH0tJycR5ALJn0cSL9%2F%2BErnkAKIDA2i9vmgTIDpnQ7TX3El7nFUKSTOMLqUvjIOwWi2ESZOoxCfAMuzO%2B4MScw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-encoding: br
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server-timing: chlray;desc="930e038d1cd00b31", cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=340&x=16"
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
cf-ray: 930e038d1cd00b31-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=930e038cbc1d5688&lang=auto | 104.18.94.41 | 200 OK | 114 kB |
URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=930e038cbc1d5688&lang=auto IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size114 kB (113984 bytes) Hash5e482c6a4f1af883d88c400daa8936d0 9e630cd4992d82bbee180e2f4a74f324ddd4e2f1 10d9ef09990b31e3d5fd56d727476cfefb79061ae22d0e38659635b4d08ca6aa
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=930e038cbc1d5688&lang=auto HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:57:46 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
priority: u=3,i=?0
server: cloudflare
cf-ray: 930e038eff135688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| haxnode.net/faronics-deep-freeze-standard/ | 104.21.112.1 | 200 OK | 141 kB |
URL User Request POST haxnode.net/faronics-deep-freeze-standard/ IP104.21.112.1:80
File typeHTML document, Unicode text, UTF-8 text, with very long lines (11716), with CRLF, LF line terminators Size141 kB (140613 bytes) Hash015574a2b18477044ca866a735980595 4105d062bc61ba39d3a0b17d9878c6c99355165c 6f2aed980c7e84ee294c1d51a1b61c12c4c17d4aa1d7af49b1da5aa9e3e1f9fd
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /faronics-deep-freeze-standard/ HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/?__cf_chl_tk=8QGPB98eo.D_.PKqA5qcRknh0rMA9c8jBnpnm.N.7yY-1744747065-1.0.1.1-SRRS2DtA00SIGl4BzrhSlgck9SpHD1kcq3BJggxLEI0
Content-Type: application/x-www-form-urlencoded
Content-Length: 2435
Origin: http://haxnode.net
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://haxnode.net/wp-json/>; rel="https://api.w.org/", <https://haxnode.net/wp-json/wp/v2/posts/23533>; rel="alternate"; title="JSON"; type="application/json", <https://haxnode.net/?p=23533>; rel=shortlink
cf-cache-status: DYNAMIC
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IlH7gCKoRQFZS2ALAQbDv%2FaiossUp5pe6%2B%2F73v5KfdshgzhSkPxl5bPSKuWbJpxcCfxktpjdTZFzQvmaRev7XMv2kDqRirRvC5lO1fwPKlvcFvhSPZvNqouf1MUvKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03f80f4e56a5-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=3230&min_rtt=447&rtt_var=5048&sent=53&recv=45&lost=0&retrans=0&sent_bytes=56828&recv_bytes=12512&delivery_rate=17079947&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/favicon.ico | 104.21.112.1 | 302 Found | 0 B |
IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Tue, 15 Apr 2025 19:57:45 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Link: <https://haxnode.net/wp-json/>; rel="https://api.w.org/"
X-Redirect-By: WordPress
Location: https://haxnode.net/wp-content/uploads/2019/03/hn-logo-150x150.png
CF-Cache-Status: BYPASS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JltSxvbcGbp56oW6NgzRroZykdWJ3RN24AN9j4NVCKPhhPLPiZ4sQl6krHvBEKJ0zTx%2Bgp%2BAZyDLHVfas0uDSFrtvMb4W1TarIZeULg%2BxHvrUQToD7EnZmvobDWFQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e03887c2b56ab-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=503&min_rtt=503&rtt_var=251&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=377&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1 | 104.18.94.41 | 200 OK | 61 B |
URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1 IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:57:46 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
priority: u=4,i=?0
server: cloudflare
cf-ray: 930e038e8e5b5688-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| haxnode.net/wp-content/themes/hueman/assets/front/webfonts/fa-brands-400.woff2?v=5.15.2 | 104.21.112.1 | 200 OK | 78 kB |
URL GET haxnode.net/wp-content/themes/hueman/assets/front/webfonts/fa-brands-400.woff2?v=5.15.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeWeb Open Font Format (Version 2), TrueType, length 78472, version 331.-31327 Hash0c9f225e8f69c622f681cf1ed973cc3d 9e355abda14ee62a7987b2ba7e2e887d33337e25 529d0a7b3944929222155bca3272ba1a87acc2faa09b2ed26a713872b7ff8794
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/hueman/assets/front/webfonts/fa-brands-400.woff2?v=5.15.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://haxnode.net/faronics-deep-freeze-standard/
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: font/woff2
Content-Length: 78472
Connection: keep-alive
Last-Modified: Fri, 13 Dec 2024 17:06:05 GMT
ETag: "13288-62929d8ad77e7"
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A3EXsW4xiSQ14dx7MtGzyKkfHTNug2EtftJYOkSQBDAQHOIsT969N6TW2BpvKg69T%2F1XpqK8cRUTIQ6gDwBoYlz8QtEqhCM%2F8ApE2n8ZOMGKmiUJexv8qVpU89SBNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e03fc5de256a5-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=856&min_rtt=447&rtt_var=213&sent=79&recv=70&lost=0&retrans=0&sent_bytes=88565&recv_bytes=14351&delivery_rate=20368286&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-content/uploads/2023/12/deep-freeze-standard.png | 104.21.32.1 | 200 OK | 13 kB |
URL GET haxnode.net/wp-content/uploads/2023/12/deep-freeze-standard.png IP104.21.32.1:443
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/ CertificateIssuerGoogle Trust Services Subjecthaxnode.net Fingerprint7A:0A:20:8C:B0:91:B8:62:69:CE:50:85:D8:29:A6:DA:68:95:8E:C0 ValidityMon, 24 Mar 2025 22:51:23 GMT - Sun, 22 Jun 2025 23:49:55 GMT
File typePNG image data, 579 x 395, 8-bit/color RGBA, non-interlaced Hash37a78ef5c7f70ad5fbf149515c61d206 9d81d4efc3be514b4e6bec24671a0fc430d6c692 00b00a9d4ea04ae9ff89d955f0fab9d2d9bb2b4794ff74664d658b2310ca3476
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2023/12/deep-freeze-standard.png HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:58:04 GMT
content-type: image/png
content-length: 12837
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJjjNzLUvg7cGexfSDXPBMXBShalbsLgMdWm2LkIXkdvBBJX1U%2BLuN37zJOlhmkLhHuzCeqk5H%2BgVevrABN1%2BNvR7%2B%2FeCxYS5xalVW7NkyHwGuqlo5bl6GaLaxiYnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Sun, 31 Dec 2023 16:57:26 GMT
etag: "3225-60dd128f6cda3"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
cf-ray: 930e03fbf8c30b31-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9477&min_rtt=4327&rtt_var=3979&sent=15&recv=11&lost=0&retrans=0&sent_bytes=3911&recv_bytes=1352&delivery_rate=1860&cwnd=12000&unsent_bytes=0&cid=c725e2f1b35a5294&ts=18268&x=16"
|
|
| haxnode.net/faronics-deep-freeze-standard/ | 104.21.32.1 | 403 Forbidden | 5.6 kB |
URL User Request GET haxnode.net/faronics-deep-freeze-standard/ IP104.21.32.1:80
File typeHTML document, ASCII text, with very long lines (5553), with no line terminators Hashf6a421df23918658ad2b4f770ddba3a3 eaabfc6cfa776014201098a2a44f1ff4a90eaa20 edd522551345d48c5ec7943fffa6bb0dd5eab1ac2b874b39a68b4b9118eff9e8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /faronics-deep-freeze-standard/ HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Tue, 15 Apr 2025 19:57:45 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HD7RoJF%2FoeT4OjhyD3inhT%2Byh20d7D%2FAiz3sTMlw337F%2BGWE2%2BHwm0hIfA89g7yxJig0kaSkosKWa7sjNB1OZ%2F0QDSSncaQcskoYrqwrVYTcdByzI7yTvILp7UZCeg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 930e0385cec456b4-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: chlray;desc="930e0385cec456b4", cfL4;desc="?proto=TCP&rtt=469&min_rtt=469&rtt_var=234&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=426&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1459382755:1744745152:Z5AiYg5gRDuO2TTmHtKmlzSrk4uNKcESg-OLATKce30/930e038cbc1d5688/6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ | 104.18.94.41 | 200 OK | 28 kB |
URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1459382755:1744745152:Z5AiYg5gRDuO2TTmHtKmlzSrk4uNKcESg-OLATKce30/930e038cbc1d5688/6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint48:58:3E:CE:54:27:56:6B:A6:33:D4:C8:4B:BF:00:0E:BE:61:60:28 ValiditySat, 01 Mar 2025 17:19:38 GMT - Fri, 30 May 2025 18:19:35 GMT
File typeASCII text, with very long lines (28280), with no line terminators Hash928701be65bfdd3be9160c11afc1c7f6 1f2f61fca9df345e4472ef1f2648c0c313718c8b ccd50f444e2d016538a9f8b4c82d25fc69a80c5e1c73e0dda8216cb1a30775db
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1459382755:1744745152:Z5AiYg5gRDuO2TTmHtKmlzSrk4uNKcESg-OLATKce30/930e038cbc1d5688/6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/hal0c/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal/auto/
cf-chl: 6KD67YM3Iks38mf.AZ.4rqVr6JtP__T4w3fKoXYzk3E-1744747066-1.1.1.1-Y2UliRW9IDvLC8OgUQpB4FRDsptXKJm0vyKjSUVcDh_zkaweyYVwACc8S8_WsIQJ
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 33392
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Apr 2025 19:57:54 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: j+FEWeSBS5uSzYQOEK88tqZaBFZbkT9SPLQtwAZQdtE2KKfgxhXgEixP7Fburln2$FdKAcHUjzkuTHEixF8s1iQ==
priority: u=3,i=?0
server: cloudflare
cf-ray: 930e03be6cc25688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| haxnode.net/faronics-deep-freeze-standard/%3C?php%20echo%20$plain_url;%20?%3E?h=63ab01231419d7b8b9fcdf8e5caab556&user=7536 | 104.21.112.1 | 404 Not Found | 76 kB |
URL GET haxnode.net/faronics-deep-freeze-standard/%3C?php%20echo%20$plain_url;%20?%3E?h=63ab01231419d7b8b9fcdf8e5caab556&user=7536 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeHTML document, Unicode text, UTF-8 text, with very long lines (20834), with CRLF, LF line terminators Hash9e1a2f3b232c20a2925584cb2289bde4 238f678827c7f99469d455132c55523ae53d859b 7efe65e905beceead7da0e9fcfce37cb68ed31f9ca569ffaebb7f8c6f88e2f58
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | low | ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2 |
GET /faronics-deep-freeze-standard/%3C?php%20echo%20$plain_url;%20?%3E?h=63ab01231419d7b8b9fcdf8e5caab556&user=7536 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://haxnode.net/wp-json/>; rel="https://api.w.org/"
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=twSVN6ZgMdaYz%2BlLpOiJdrpRqlncqfGYXdUIX1Ta4QBPAb20SvcrNnU6LjguWnET86ANc%2FLQTfVgDfWu41H98skL37b3ZHaiM4wNx%2BreRmrzDJxccgoJvFNXOy6Btw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fcbffc56a9-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=755&min_rtt=453&rtt_var=155&sent=16&recv=18&lost=0&retrans=0&sent_bytes=18956&recv_bytes=1818&delivery_rate=23247706&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| haxnode.net/wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 | 104.21.112.1 | 200 OK | 115 kB |
URL GET haxnode.net/wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 IP104.21.112.1:80
Requested byhttp://haxnode.net/faronics-deep-freeze-standard/
File typeASCII text, with very long lines (59458) Size115 kB (114706 bytes) Hash8c9f31823282e4e056eb0aa7fac262a9 dc3b1a37381e079fda8db59c1a9469852cd18b80 3bb38d0f302677ff4104564454f60f495133579d6e6dfb722b3de850df596502
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 HTTP/1.1
Host: haxnode.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://haxnode.net/faronics-deep-freeze-standard/
Cookie: cf_clearance=lAzYu9iKZOxE3JvU2MD5_RIwGkKkK1QdQF.WQziXgaQ-1744747083-1.2.1.1-86_uPgWTMu4I5eoDEtprOxMTYAe1yBq_JWwXbjJbSYMppnthQmQo71busSnHbgpe.g4qGMEhd81JXx1tTAjP3QF.7Y.oVSAVSz0WtUL99ccXAn65AlStcr7oc9Mz45xd0nLs4DoarfV7RFlyQ6wm8XvPVx7rcAFRvfkOAAvVjNALHHKH9y3CSsqP.2XV141awgqXg9rMS9OffFLVC0Q32sQX.0Jnh0caimr0RsnWnnqJKMQu4BamI_9ycUQMhTA1fBINdzPruLHOsK8D9Z3dpsPkcBR8Q_Vv34R9kJ22ClKiq2_8YnDXxV22d_j1dNmPuooXqLMKC_.RzGVMnh3Y3MdUFxzBI.2pS7zTT6iYePx7Qgxqz7OoWux_2F_NQMj9
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 15 Apr 2025 19:58:04 GMT
Content-Type: text/css
Content-Length: 15177
Connection: keep-alive
Last-Modified: Wed, 18 Dec 2024 05:12:48 GMT
ETag: "1c012-6298476f74586-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F1X9D7h%2BuLvuUQtEae18LR0vzyk25w5A228u2n8CZw9DGASXQuKrT2HBdnFpT74i%2FrN0%2BPZNSvHDI9LxXR%2BgyPY1n5R2TTknIIW58AM5KhqZinUaBOVYUYIfN2fJ2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 930e03fb9ccf56ab-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=545&min_rtt=503&rtt_var=273&sent=4&recv=6&lost=0&retrans=0&sent_bytes=972&recv_bytes=1264&delivery_rate=1717674&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
0.0.0.0