GET grookilteepsou.net/pfe/current/tag.min.js?z=9152066
139.45.197.122200 OK 30 kB URL
grookilteepsou.net/pfe/current/tag.min.js?z=9152066
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (30001), with no line terminators
First Seen 2025-04-15
Last Seen 2025-04-21
Times Seen 14
Size 30 kB (30001 bytes)
MD5 f6815dbc3b25537a46cbaca5aad08396
SHA1 974f93840c5a0f403e43af5bd0d6a56268f88236
SHA256 6298c308d3124d1cdbf28929e6355fd0af4c77977916e52e0e054a70f37b963b
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pfe/current/tag.min.js?z=9152066 HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: application/javascript
last-modified: Mon, 14 Apr 2025 08:21:01 GMT
etag: W/"67fcc56d-7531"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
GET eehassoosostoa.com/500/9152064?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=eehassoosostoa.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 8.2 kB URL
eehassoosostoa.com/500/9152064?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=eehassoosostoa.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 8.2 kB (8181 bytes)
MD5 80adc4102f4a37c615120d8d133508a5
SHA1 ed127934ce3b303d88666d5982b7884ec38d2ae0
SHA256 a6f9eadd2f65df1bf1e06b12c5ace37e47affa91c26d4d02c4e881605a041fec
Certificate Info
Issuer Let's Encrypt
Subject eehassoosostoa.com
Fingerprint 87:03:13:D6:53:57:8A:14:66:25:19:23:6E:8F:F4:D7:F1:80:23:B4
Validity Sat, 22 Feb 2025 05:42:14 GMT - Fri, 23 May 2025 05:42:13 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /500/9152064?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=eehassoosostoa.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: eehassoosostoa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0301afbcacbc4cbcfe49bf7b150fa186
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:23 GMT
content-type: application/javascript
x-trace-id: f31e7012693becb7defc83710c2c9451
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
vary: Origin
access-control-allow-origin: https://pastebin.pl
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c; expires=Sat, 18 Apr 2026 23:35:23 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
GET pastebin.pl/static/asset/16262479586fe652146aefffcee5e73b9d19256f5d.css
188.114.97.1200 OK 125 kB URL
pastebin.pl/static/asset/16262479586fe652146aefffcee5e73b9d19256f5d.css
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type ASCII text, with very long lines (10418)
First Seen 2025-04-16
Last Seen 2025-07-23
Times Seen 7
Size 125 kB (124701 bytes)
MD5 ff8f51952cd68fe548aeaad52df204f0
SHA1 0650dff1188e81ae346c1b2a43813517d223f3a7
SHA256 840bc887a55611080cdb939aa4badc289f1ed695d707c4e1d632143737c60fc1
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /static/asset/16262479586fe652146aefffcee5e73b9d19256f5d.css HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: text/css
cf-ray: 9327fa1b9c035690-OSL
server: cloudflare
last-modified: Mon, 03 Jun 2024 11:32:01 GMT
vary: Accept-Encoding
etag: W/"665da9b1-1e71d"
expires: Sat, 19 Apr 2025 07:52:41 GMT
cache-control: max-age=43200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
age: 13348
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2k1acHuTyoBxs9TEYyh0b6e4ZDKMri4E990whekmhFNW7il5%2Fm8i5EUYLWrMLgfP0p6iDznBww8i%2FNOiG512Ne1KlcNyjt8lmKPq6F0nNoVkFXUSCXxEIAm3LUJKrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=901&min_rtt=441&rtt_var=699&sent=39&recv=41&lost=0&retrans=0&sent_bytes=38899&recv_bytes=2080&delivery_rate=14058252&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1505&x=0"
X-Firefox-Spdy: h2
GET pastebin.pl/themes/stikkedizr/fonts/fontawesome-webfont.woff?v=4.0.3
188.114.97.1200 OK 44 kB URL
pastebin.pl/themes/stikkedizr/fonts/fontawesome-webfont.woff?v=4.0.3
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type Web Open Font Format, TrueType, length 44432, version 1.0
First Seen 2023-04-06
Last Seen 2025-08-02
Times Seen 3721
Size 44 kB (44432 bytes)
MD5 3293616ec0c605c7c2db25829a0a509e
SHA1 04c3bf56d87a0828935bd6b4aee859995f321693
SHA256 0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /themes/stikkedizr/fonts/fontawesome-webfont.woff?v=4.0.3 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/static/asset/16262479586fe652146aefffcee5e73b9d19256f5d.css
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:10 GMT
content-type: application/font-woff
cf-ray: 9327fa1f1ea8569c-OSL
server: cloudflare
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
expires: Sat, 19 Apr 2025 23:35:10 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: BYPASS
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1LDrGP21Q8uCGpAtKxV7j38ENuP0CT78yzRTwElld%2FZ02UO1g9e0PEMp3UAsVezQZ0o1MwbPcrPp9QFFf1AcYE77gUb6YsyVYjgwPfyDeaa1pCE2e%2FewmlKa1wHoog%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4056&min_rtt=622&rtt_var=2179&sent=304&recv=259&lost=0&retrans=0&sent_bytes=102629&recv_bytes=15417&delivery_rate=399425&cwnd=48000&unsent_bytes=0&cid=444475b039203699&ts=1930&x=1", cfExtPri, cfHdrFlush;dur=0
GET pastebin.pl/main/get_cm_js/text?_=1745019311863
188.114.97.1200 OK 0 B URL
pastebin.pl/main/get_cm_js/text?_=1745019311863
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /main/get_cm_js/text?_=1745019311863 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag; cf_clearance=ouvLQLGQsb5u8xYU5VL9YGYUMiMEHOkU1YyHG1ov1cM-1745019311-1.2.1.1-Kelei_YeYoM1bcvJiEV3x5E8Q6RCsmr9KksqtF7en1eDAYy7btn0wweIKBflMx_Mb58AoIuvY0w33xXq6wQWKLYv_R6ezEygTpaFw8iERsHzEPq4mRaLe._UrDRbg0jdl0zF8LJccfz.EnMyQER9Tbu7jctFv6iMBwsfbWUk0xtiSvMJCvIw7kk2zizFFnvbcIQ6CdGH2.1JocXtSSim0fukX51EgeYkXawuxj.LbC.Bhrd5Kk7GCLn75YShEbtYYR9Ln67pUElHebC5uznU1a4EgTO6TioY0iVLR5M_7_TppTwGPeApCON61VEfHGmG55PlEF7gQfbpIpLw5fPrBBeUNd_RwvnYg2qHcSlVnKs
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:12 GMT
content-type: text/html; charset=UTF-8
content-encoding: br
cf-ray: 9327fa2cde0d569c-OSL
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VPxKzY7QNmMIZjPmlcMmtXYT0iQWMgpI4mPjB721SPq%2FDAMoBJVgJIQzJYKDiO1L9bkcHA4JLGjI27i4djO3d26p8yftTMQdjMolYEwNJsL44YW0eQppvCfAcjoAFA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2941&min_rtt=622&rtt_var=1940&sent=422&recv=281&lost=0&retrans=0&sent_bytes=230219&recv_bytes=31003&delivery_rate=24321&cwnd=96000&unsent_bytes=0&cid=444475b039203699&ts=3521&x=1", cfExtPri, cfHdrFlush;dur=0
OPTIONS grookilteepsou.net/event
139.45.197.122200 OK 0 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:13 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
POST grookilteepsou.net/event
139.45.197.122200 OK 81 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 81 B (81 bytes)
MD5 59a6ed17c3476ee5a8d233f75a6cdbd8
SHA1 8f4a9a9112bd539b439d784dee97ed8f4e044740
SHA256 9d4f795ea75c2c4899f2f47aef69ef14ff8a33f4ad6e1612c0b25f357be08284
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Content-Type: application/json
Content-Length: 388
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: application/json; charset=utf-8
content-length: 81
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
POST vaimucuvikuwu.net/wrr?z=9152062&p_rid=dfa9f392-985d-4d95-8525-d784293b9cac&rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&dmn=&userId=0081af4b6fa14d5ee944ee76f4f3ca2c
139.45.197.106204 No Content 0 B URL
vaimucuvikuwu.net/wrr?z=9152062&p_rid=dfa9f392-985d-4d95-8525-d784293b9cac&rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&dmn=&userId=0081af4b6fa14d5ee944ee76f4f3ca2c
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject vaimucuvikuwu.net
Fingerprint D3:62:57:7B:C7:80:EE:E5:F0:43:DA:8B:49:0F:B6:B3:1F:28:67:B9
Validity Sat, 22 Feb 2025 05:33:33 GMT - Fri, 23 May 2025 05:33:32 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /wrr?z=9152062&p_rid=dfa9f392-985d-4d95-8525-d784293b9cac&rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&dmn=&userId=0081af4b6fa14d5ee944ee76f4f3ca2c HTTP/1.1
Host: vaimucuvikuwu.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
content-type: application/json
Content-Length: 2545
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx
date: Fri, 18 Apr 2025 23:35:15 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
GET pastebin.pl/custom-images/flat_web_icon_set/color/Twitter.png
188.114.97.1200 OK 3.6 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Twitter.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2023-07-18
Last Seen 2025-07-23
Times Seen 25
Size 3.6 kB (3644 bytes)
MD5 c65574840a08aa38cee83459810dfdf0
SHA1 7f0f25f951eb7eafb843ec053c60ec5375af3e57
SHA256 49c45399074a6af07b176d55bb85b3de42b2c2889bf9efa37310b4e71cf14f43
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Twitter.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3644
cf-ray: 9327fa1b9c0d5690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-e3c"
expires: Mon, 12 May 2025 05:44:41 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 582628
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a3GJqe9Ofp6%2F2gGWbUGNDb7kyNZnMK85mW0PSJP1IzldDJpC78xeSBaVJ%2BSPT56IitWIIIdrngYM8huhB7uJ%2FNWkdUyBKcZmm8%2BxxvSqcUbKe5fiy6X6qCbPslT3bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=857&min_rtt=440&rtt_var=532&sent=80&recv=69&lost=0&retrans=0&sent_bytes=83212&recv_bytes=2080&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1522&x=0"
X-Firefox-Spdy: h2
GET vaimucuvikuwu.net/88/139693
139.45.197.106200 OK 4.0 kB URL
vaimucuvikuwu.net/88/139693
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 4.0 kB (4032 bytes)
MD5 2be333476d18d4cf5df46d22d82dce59
SHA1 5bd2943f4892fddcb0f6150698b8ab411faf2ad2
SHA256 a12705e868ab5ab4754e03908cca6ba5a5578dcd9027212e5229fb5f25ba6539
Certificate Info
Issuer Let's Encrypt
Subject vaimucuvikuwu.net
Fingerprint D3:62:57:7B:C7:80:EE:E5:F0:43:DA:8B:49:0F:B6:B3:1F:28:67:B9
Validity Sat, 22 Feb 2025 05:33:33 GMT - Fri, 23 May 2025 05:33:32 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /88/139693 HTTP/1.1
Host: vaimucuvikuwu.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:10 GMT
content-type: application/json
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
timing-allow-origin: *
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
POST grookilteepsou.net/event
139.45.197.122200 OK 81 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 81 B (81 bytes)
MD5 59a6ed17c3476ee5a8d233f75a6cdbd8
SHA1 8f4a9a9112bd539b439d784dee97ed8f4e044740
SHA256 9d4f795ea75c2c4899f2f47aef69ef14ff8a33f4ad6e1612c0b25f357be08284
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Content-Type: application/json
Content-Length: 1007
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: application/json; charset=utf-8
content-length: 81
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
GET oomaugnaps.net/www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg
104.21.7.134200 OK 14 kB URL
oomaugnaps.net/www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg
IP / ASN
104.21.7.134
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 192x192, components 3
First Seen 2024-12-24
Last Seen 2025-04-27
Times Seen 79
Size 14 kB (13638 bytes)
MD5 79d4b838ec366600aa8ddf118d0f5ffc
SHA1 62163877b2b3d92ead038a9f316c8a69dde2a12d
SHA256 fc804e50d61e636108e4c242b2efc02d17455cd65c23264aacd3c9337c2da34f
Certificate Info
Issuer Google Trust Services
Subject oomaugnaps.net
Fingerprint 46:88:55:C4:EF:5C:FE:BC:C8:46:42:24:45:00:00:E8:EE:C9:D7:BA
Validity Sat, 22 Mar 2025 09:39:52 GMT - Fri, 20 Jun 2025 10:37:28 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg HTTP/1.1
Host: oomaugnaps.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:17 GMT
content-type: image/jpeg
content-length: 13638
server: cloudflare
accept-ranges: bytes
last-modified: Thu, 27 Feb 2025 09:22:55 GMT
etag: "67c02eef-3546"
expires: Sat, 19 Apr 2025 06:42:05 GMT
cache-control: max-age=86400
timing-allow-origin: *
cf-cache-status: HIT
age: 60792
cf-ray: 9327fa4b7a5f0b69-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET glempirteechacm.com/impression/cjZK3pj9cnpw39Mj-H_k8l8gMMLxkvZeGm2WcJMsWIFOGuPB2ja9UitGuvNaFX53Uuocc7ig_Y21xFw-A9viQyM8nd5EuC4a0sTYVN-OnSaUZ2EYy39mcWA6cEPTRqdRJc0-dBPzbRAd2b8LaDr3AIByJlk9vJ2vMuaR7l85rUPZF_2sxQWGGBpV_e4eKe7Soaa5aBsXmkAf9221qbFa_rCF4iE3zCemzJKFG0b__MkG4PRCYrhZO53xkUTkgO73wxr85X9HCoa-ojmKY0RYBnJdvpv-Q1RriGEmlBN3_ATdxltzoSyUJrXyXlt7o2Y2AUaQ7jcOd8toAW_7eongqZzAhyloqOn8cOB1-SSOBlTBm0b8aVbWWq9rNHgvme54kRD29QkVNeZ4jxHpF8fcCqBPjnKb4LhTnQVqhBKDuCKZB4nY6jRq2th_4NxCMuxCveQUzXV6AIZR4RPiMEF2Zp0vljEd4D0CJDRu3E24m0_Clb8Qymg-J0eqmkPNrl1OmReP7BlUa1xBZVG-XIc9rc7foy_WR7liploTm7E0dvnlA--n1XYQIKbjnXifpabB52Oafp76FNGqIDE3s1af7w==?_z=9152065&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.106200 OK 43 B URL
glempirteechacm.com/impression/cjZK3pj9cnpw39Mj-H_k8l8gMMLxkvZeGm2WcJMsWIFOGuPB2ja9UitGuvNaFX53Uuocc7ig_Y21xFw-A9viQyM8nd5EuC4a0sTYVN-OnSaUZ2EYy39mcWA6cEPTRqdRJc0-dBPzbRAd2b8LaDr3AIByJlk9vJ2vMuaR7l85rUPZF_2sxQWGGBpV_e4eKe7Soaa5aBsXmkAf9221qbFa_rCF4iE3zCemzJKFG0b__MkG4PRCYrhZO53xkUTkgO73wxr85X9HCoa-ojmKY0RYBnJdvpv-Q1RriGEmlBN3_ATdxltzoSyUJrXyXlt7o2Y2AUaQ7jcOd8toAW_7eongqZzAhyloqOn8cOB1-SSOBlTBm0b8aVbWWq9rNHgvme54kRD29QkVNeZ4jxHpF8fcCqBPjnKb4LhTnQVqhBKDuCKZB4nY6jRq2th_4NxCMuxCveQUzXV6AIZR4RPiMEF2Zp0vljEd4D0CJDRu3E24m0_Clb8Qymg-J0eqmkPNrl1OmReP7BlUa1xBZVG-XIc9rc7foy_WR7liploTm7E0dvnlA--n1XYQIKbjnXifpabB52Oafp76FNGqIDE3s1af7w==?_z=9152065&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type GIF image data, version 89a, 1 x 1
First Seen 2023-04-05
Last Seen 2025-08-02
Times Seen 80200
Size 43 B (43 bytes)
MD5 b4491705564909da7f9eaf749dbbfbb1
SHA1 279315d507855c6a4351e1e2c2f39dd9cd2fccd8
SHA256 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Certificate Info
Issuer Let's Encrypt
Subject glempirteechacm.com
Fingerprint 47:3C:FC:98:8A:83:9E:A9:49:A6:8B:54:A1:B6:33:B6:48:94:29:B7
Validity Sat, 22 Feb 2025 05:41:31 GMT - Fri, 23 May 2025 05:41:30 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impression/cjZK3pj9cnpw39Mj-H_k8l8gMMLxkvZeGm2WcJMsWIFOGuPB2ja9UitGuvNaFX53Uuocc7ig_Y21xFw-A9viQyM8nd5EuC4a0sTYVN-OnSaUZ2EYy39mcWA6cEPTRqdRJc0-dBPzbRAd2b8LaDr3AIByJlk9vJ2vMuaR7l85rUPZF_2sxQWGGBpV_e4eKe7Soaa5aBsXmkAf9221qbFa_rCF4iE3zCemzJKFG0b__MkG4PRCYrhZO53xkUTkgO73wxr85X9HCoa-ojmKY0RYBnJdvpv-Q1RriGEmlBN3_ATdxltzoSyUJrXyXlt7o2Y2AUaQ7jcOd8toAW_7eongqZzAhyloqOn8cOB1-SSOBlTBm0b8aVbWWq9rNHgvme54kRD29QkVNeZ4jxHpF8fcCqBPjnKb4LhTnQVqhBKDuCKZB4nY6jRq2th_4NxCMuxCveQUzXV6AIZR4RPiMEF2Zp0vljEd4D0CJDRu3E24m0_Clb8Qymg-J0eqmkPNrl1OmReP7BlUa1xBZVG-XIc9rc7foy_WR7liploTm7E0dvnlA--n1XYQIKbjnXifpabB52Oafp76FNGqIDE3s1af7w==?_z=9152065&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: glempirteechacm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:19 GMT
content-type: image/gif
content-length: 43
x-trace-id: c9da6eaa76262c614614a3a122ff5dae
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
GET roagrofoogrobo.com/impression/9wdDSJFmjclPlxvmA63AI3R1LFZaec_4WxD8NVIjLLylA22dea_NW-EnoiC-ZvdQcmL-ojV_zN2rQilXZ9E08cowBFLYYK90_m-pk-_wSbLsZQPizvk_TR1zorrfMhJUgvx65XpEqI5nqneaOE2HoXkiPhiy8vGRHZVpqalG_BNaq9GC-t-f-OKV6EkBHb7B-IZwPkqG1XWXwgHZ5zObO1ykK6Fbav_UHc8iLstaVzePmPLQ31xkP75XNN7UpWgiE-59M2BughwNdabyjqBtbm8ixd8oM9_5iLmQGfZ-dxU9krS97oKbg_xBXcNewBPFVKouqzaIEV05LZFZx_0aTtW68wajo0jK2jxhTjbRTXbGxkRXiwCltF5Pf-uX3nLLbj-Lk4boJGIGtn8FG35fmDS-XCiSkMF99L7mLRC6fTue7hWVTyjUC1ZkBJMNWZzYbM4aeKyiGUTsL9okO-plsRSKTEkKhQm4XE_c-jGubjZfDT5zejZRvwnqOJ8gxU4rau-ptPsaPrf5yj5AzIWAJESIQ-B0mcOA9Xu9Z27ZwMf_Bzvsl-fbMh-UIQC7aqffzBZ4IzWRXUiJfRAlzpcw2XCjUQcem2YGwg1jDEhdpRkA52zK-dIL7KOsmvplT51F3FP80j-htkUX0BpqLf6TMG1JP1RiT3ZsqGRMwdpU4Jz9HHjBD0oiCjsgGn7BUjiELzbVbW9O8kRcjPOpKk_RR119uN6S-s6dkBjHeS1B296VXf7umtoHDiZbqt9VcYzqYI1HvyAH1YI1hp3Gn8DM6lN6jij9tHBECo51hOQsLoWoMdcVMXc1erJmWyw5YEHa?_z=9152063&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 43 B URL
roagrofoogrobo.com/impression/9wdDSJFmjclPlxvmA63AI3R1LFZaec_4WxD8NVIjLLylA22dea_NW-EnoiC-ZvdQcmL-ojV_zN2rQilXZ9E08cowBFLYYK90_m-pk-_wSbLsZQPizvk_TR1zorrfMhJUgvx65XpEqI5nqneaOE2HoXkiPhiy8vGRHZVpqalG_BNaq9GC-t-f-OKV6EkBHb7B-IZwPkqG1XWXwgHZ5zObO1ykK6Fbav_UHc8iLstaVzePmPLQ31xkP75XNN7UpWgiE-59M2BughwNdabyjqBtbm8ixd8oM9_5iLmQGfZ-dxU9krS97oKbg_xBXcNewBPFVKouqzaIEV05LZFZx_0aTtW68wajo0jK2jxhTjbRTXbGxkRXiwCltF5Pf-uX3nLLbj-Lk4boJGIGtn8FG35fmDS-XCiSkMF99L7mLRC6fTue7hWVTyjUC1ZkBJMNWZzYbM4aeKyiGUTsL9okO-plsRSKTEkKhQm4XE_c-jGubjZfDT5zejZRvwnqOJ8gxU4rau-ptPsaPrf5yj5AzIWAJESIQ-B0mcOA9Xu9Z27ZwMf_Bzvsl-fbMh-UIQC7aqffzBZ4IzWRXUiJfRAlzpcw2XCjUQcem2YGwg1jDEhdpRkA52zK-dIL7KOsmvplT51F3FP80j-htkUX0BpqLf6TMG1JP1RiT3ZsqGRMwdpU4Jz9HHjBD0oiCjsgGn7BUjiELzbVbW9O8kRcjPOpKk_RR119uN6S-s6dkBjHeS1B296VXf7umtoHDiZbqt9VcYzqYI1HvyAH1YI1hp3Gn8DM6lN6jij9tHBECo51hOQsLoWoMdcVMXc1erJmWyw5YEHa?_z=9152063&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type GIF image data, version 89a, 1 x 1
First Seen 2023-04-05
Last Seen 2025-08-02
Times Seen 80200
Size 43 B (43 bytes)
MD5 b4491705564909da7f9eaf749dbbfbb1
SHA1 279315d507855c6a4351e1e2c2f39dd9cd2fccd8
SHA256 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impression/9wdDSJFmjclPlxvmA63AI3R1LFZaec_4WxD8NVIjLLylA22dea_NW-EnoiC-ZvdQcmL-ojV_zN2rQilXZ9E08cowBFLYYK90_m-pk-_wSbLsZQPizvk_TR1zorrfMhJUgvx65XpEqI5nqneaOE2HoXkiPhiy8vGRHZVpqalG_BNaq9GC-t-f-OKV6EkBHb7B-IZwPkqG1XWXwgHZ5zObO1ykK6Fbav_UHc8iLstaVzePmPLQ31xkP75XNN7UpWgiE-59M2BughwNdabyjqBtbm8ixd8oM9_5iLmQGfZ-dxU9krS97oKbg_xBXcNewBPFVKouqzaIEV05LZFZx_0aTtW68wajo0jK2jxhTjbRTXbGxkRXiwCltF5Pf-uX3nLLbj-Lk4boJGIGtn8FG35fmDS-XCiSkMF99L7mLRC6fTue7hWVTyjUC1ZkBJMNWZzYbM4aeKyiGUTsL9okO-plsRSKTEkKhQm4XE_c-jGubjZfDT5zejZRvwnqOJ8gxU4rau-ptPsaPrf5yj5AzIWAJESIQ-B0mcOA9Xu9Z27ZwMf_Bzvsl-fbMh-UIQC7aqffzBZ4IzWRXUiJfRAlzpcw2XCjUQcem2YGwg1jDEhdpRkA52zK-dIL7KOsmvplT51F3FP80j-htkUX0BpqLf6TMG1JP1RiT3ZsqGRMwdpU4Jz9HHjBD0oiCjsgGn7BUjiELzbVbW9O8kRcjPOpKk_RR119uN6S-s6dkBjHeS1B296VXf7umtoHDiZbqt9VcYzqYI1HvyAH1YI1hp3Gn8DM6lN6jij9tHBECo51hOQsLoWoMdcVMXc1erJmWyw5YEHa?_z=9152063&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:20 GMT
content-type: image/gif
content-length: 43
x-trace-id: 6ab0583a61895f5f8c78c91e0dad67b5
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
GET roagrofoogrobo.com/500/9152063?excludes=22954943&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 1.7 kB URL
roagrofoogrobo.com/500/9152063?excludes=22954943&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 1.7 kB (1725 bytes)
MD5 342b284dd8672a19fc8fb54b2193a800
SHA1 60e85d4ca17429de6b68c6986c3508293ecd0a31
SHA256 b3d1e745487fc56470876fa728fb9955848d0d68d5ea3f4c614eba9f433c3a15
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /500/9152063?excludes=22954943&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:21 GMT
content-type: application/javascript
x-trace-id: 8f32b6d3caf9273f24840587b8efd4aa
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://pastebin.pl
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c; expires=Sat, 18 Apr 2026 23:35:21 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
GET pastebin.pl/custom-images/flat_web_icon_set/color/Tumblr.png
188.114.97.1200 OK 3.4 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Tumblr.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2023-07-18
Last Seen 2025-07-23
Times Seen 16
Size 3.4 kB (3439 bytes)
MD5 821beb661aa7a7dbdc3928bdefe78de1
SHA1 c96f500c12beb8eb03492e83b64801373d4b5a34
SHA256 c285eb7872ade449e43574b5d1637d2e9973d0cc0c94b28630cd6c3b4ddef451
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Tumblr.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3439
cf-ray: 9327fa1bac155690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-d6f"
expires: Tue, 29 Apr 2025 15:25:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 1671004
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W8Dr9Gvnk94NJJzhghFS1UsRHCbhAU0Y6DioVX%2B%2Fu6E0SQ6KMdPq%2B5MRM3vV6TgDEz4tFCEDbNEk1N7ndqmVofoDvdJ1IoQYWMkvrXxArWmsRjZxSP%2BJzrscr5SkTw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=846&min_rtt=440&rtt_var=492&sent=70&recv=61&lost=0&retrans=0&sent_bytes=74570&recv_bytes=2080&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1513&x=0"
X-Firefox-Spdy: h2
GET pastebin.pl/favicon.ico
188.114.97.1200 OK 549 B URL
pastebin.pl/favicon.ico
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type GIF image data, version 89a, 16 x 16
First Seen 2023-06-18
Last Seen 2025-07-23
Times Seen 23
Size 549 B (549 bytes)
MD5 c2c08025203e58f4e7a4e4763c41a30a
SHA1 4cfdf2ba58f5936c8603b7ecc31af03a0c9bc9dd
SHA256 7b305cc77b5d5da6706af9d06021c561ebf2c64f53a2f4ce4b545f3243eab67d
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /favicon.ico HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: image/x-icon
content-encoding: br
cf-ray: 9327fa24f931569c-OSL
last-modified: Wed, 14 Jul 2021 07:32:42 GMT
etag: W/"60ee931a-225"
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=3600
cf-cache-status: REVALIDATED
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZqBjEDsIPwgCerODceu24oSeOdw0NYB9LFKkVA%2B3wfG0AXxt5dMh3CWSygDOdQcLWbC5vcshHL5%2Bko33ouDxANpD70o15PX1Ef6klSXsqmwmCpdOyAhvgKVugaVKDw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3334&min_rtt=622&rtt_var=2226&sent=418&recv=277&lost=0&retrans=0&sent_bytes=228522&recv_bytes=29536&delivery_rate=3216786&cwnd=96000&unsent_bytes=0&cid=444475b039203699&ts=2771&x=1", cfExtPri, cfHdrFlush;dur=0
GET pastebin.pl/static/asset/17092055377430a1044da8a37b18147203f4015289.js
188.114.97.1200 OK 212 kB URL
pastebin.pl/static/asset/17092055377430a1044da8a37b18147203f4015289.js
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65535)
First Seen 2025-04-16
Last Seen 2025-07-23
Times Seen 6
Size 212 kB (212430 bytes)
MD5 c7192d1a4a90aedbdc0318dafa009cee
SHA1 5adb5696f1a184b73fd6099208322500212389ff
SHA256 a84b47af6771a16e70ce39032dd82089965ea697822de088b651e52174461a6c
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /static/asset/17092055377430a1044da8a37b18147203f4015289.js HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag; cf_clearance=ouvLQLGQsb5u8xYU5VL9YGYUMiMEHOkU1YyHG1ov1cM-1745019311-1.2.1.1-Kelei_YeYoM1bcvJiEV3x5E8Q6RCsmr9KksqtF7en1eDAYy7btn0wweIKBflMx_Mb58AoIuvY0w33xXq6wQWKLYv_R6ezEygTpaFw8iERsHzEPq4mRaLe._UrDRbg0jdl0zF8LJccfz.EnMyQER9Tbu7jctFv6iMBwsfbWUk0xtiSvMJCvIw7kk2zizFFnvbcIQ6CdGH2.1JocXtSSim0fukX51EgeYkXawuxj.LbC.Bhrd5Kk7GCLn75YShEbtYYR9Ln67pUElHebC5uznU1a4EgTO6TioY0iVLR5M_7_TppTwGPeApCON61VEfHGmG55PlEF7gQfbpIpLw5fPrBBeUNd_RwvnYg2qHcSlVnKs
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: application/javascript
cf-ray: 9327fa26fa59569c-OSL
server: cloudflare
last-modified: Mon, 03 Jun 2024 11:32:01 GMT
vary: Accept-Encoding
etag: W/"665da9b1-33dce"
expires: Sat, 19 Apr 2025 09:48:37 GMT
cache-control: max-age=43200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
age: 6394
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xDUjNRUayZSApLX1kMvt5nZfqUwBn6q4he7c2ieiHAQWxbrEBxdnOG%2B2P89VYb4htnnmPcLhkgL0MlQzOp%2BIwQUDiCCi3GLSKAmbhsZRjpoLrKkHTqVZrKRD8bdWeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3006&min_rtt=622&rtt_var=1982&sent=351&recv=275&lost=0&retrans=0&sent_bytes=150184&recv_bytes=29444&delivery_rate=31834&cwnd=48000&unsent_bytes=0&cid=444475b039203699&ts=2436&x=1", cfExtPri, cfHdrFlush;dur=0
OPTIONS grookilteepsou.net/event
139.45.197.122200 OK 0 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
142.250.74.35200 OK 40 kB URL
fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
IP / ASN
142.250.74.35
#15169 GOOGLE
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type Web Open Font Format (Version 2), TrueType, length 40128, version 1.0
First Seen 2025-01-08
Last Seen 2025-08-02
Times Seen 97640
Size 40 kB (40128 bytes)
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Certificate Info
Issuer Google Trust Services
Subject *.gstatic.com
Fingerprint 62:05:36:C2:8E:4C:CD:95:1E:1C:75:06:44:A3:57:E5:C0:17:02:80
Validity Mon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
GET /s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 40128
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Apr 2025 10:03:46 GMT
expires: Fri, 17 Apr 2026 10:03:46 GMT
cache-control: public, max-age=31536000
age: 135095
last-modified: Wed, 08 Jan 2025 18:23:10 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET pastebin.pl/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
188.114.97.1200 OK 1.2 kB URL
pastebin.pl/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (1238)
First Seen 2023-03-07
Last Seen 2025-08-02
Times Seen 96879
Size 1.2 kB (1239 bytes)
MD5 9e8f56e8e1806253ba01a95cfc3d392c
SHA1 a8af90d7482e1e99d03de6bf88fed2315c5dd728
SHA256 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: application/javascript
last-modified: Fri, 18 Apr 2025 14:27:47 GMT
content-encoding: gzip
cache-control: max-age=172800, public
etag: W/"68026163-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFsc38Gw3W5oi9CcIVsQpNN9Q%2FRd9CsjqxhtDMTxcVB2OzHzVB28%2Fx5j1918ageTU5jDzOqYVFz9%2BHNbNKWW%2Br7POv3u%2BvURyNrGzf2YQVH94QMn4PkFW8HwxC%2FZ7A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 9327fa1c0c645690-OSL
x-frame-options: DENY
expires: Sun, 20 Apr 2025 23:35:09 GMT
X-Firefox-Spdy: h2
GET glempirteechacm.com/401/9152065
139.45.197.106200 OK 144 kB URL
glempirteechacm.com/401/9152065
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 144 kB (143723 bytes)
MD5 d0796a87e9fc036c8e022700f310099b
SHA1 d4a8f05b3ce286e4416fa67f69e69f00736f8bca
SHA256 bf13cac936c39ea997d78785190b2a72db5798f2b6900f5a7368b4ffc4b5baf6
Certificate Info
Issuer Let's Encrypt
Subject glempirteechacm.com
Fingerprint 47:3C:FC:98:8A:83:9E:A9:49:A6:8B:54:A1:B6:33:B6:48:94:29:B7
Validity Sat, 22 Feb 2025 05:41:31 GMT - Fri, 23 May 2025 05:41:30 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /401/9152065 HTTP/1.1
Host: glempirteechacm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: application/javascript
x-trace-id: a543bb70eb63fa99fe8d65857e6240d6
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0301af60cea645a4f656d366577b821a; expires=Sat, 18 Apr 2026 23:35:11 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.googletagmanager.com/td?id=G-88PKPGCEBF&v=3&t=t&pid=1628516402&exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&dl=pastebin.pl%2Fview%2Ff7aef741&tdp=G-88PKPGCEBF;82783435;0;0;0&frm=0&bt=0&ct=3&z=0
142.250.74.136204 No Content 0 B URL
www.googletagmanager.com/td?id=G-88PKPGCEBF&v=3&t=t&pid=1628516402&exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&dl=pastebin.pl%2Fview%2Ff7aef741&tdp=G-88PKPGCEBF;82783435;0;0;0&frm=0&bt=0&ct=3&z=0
IP / ASN
142.250.74.136
#15169 GOOGLE
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Google Trust Services
Subject *.google-analytics.com
Fingerprint B7:82:F3:C7:93:B0:60:B0:83:49:F8:74:0D:49:78:23:65:0B:37:01
Validity Mon, 31 Mar 2025 08:54:29 GMT - Mon, 23 Jun 2025 08:54:28 GMT
GET /td?id=G-88PKPGCEBF&v=3&t=t&pid=1628516402&exp=102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&dl=pastebin.pl%2Fview%2Ff7aef741&tdp=G-88PKPGCEBF;82783435;0;0;0&frm=0&bt=0&ct=3&z=0 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 204 No Content
date: Fri, 18 Apr 2025 23:35:12 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgtc:45:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgtc:45:0
report-to: {"group":"ascnsrsgtc:45:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgtc:45:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
OPTIONS glempirteechacm.com/500/9152065?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.106200 OK 0 B URL
glempirteechacm.com/500/9152065?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject glempirteechacm.com
Fingerprint 47:3C:FC:98:8A:83:9E:A9:49:A6:8B:54:A1:B6:33:B6:48:94:29:B7
Validity Sat, 22 Feb 2025 05:41:31 GMT - Fri, 23 May 2025 05:41:30 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /500/9152065?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: glempirteechacm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:16 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://pastebin.pl
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-credentials: true
access-control-max-age: 600
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
GET oomaugnaps.net/www/images/700e9af867b5f8ca1389e4268b6ea7e8.png
104.21.7.134200 OK 49 kB URL
oomaugnaps.net/www/images/700e9af867b5f8ca1389e4268b6ea7e8.png
IP / ASN
104.21.7.134
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
First Seen 2025-03-05
Last Seen 2025-05-08
Times Seen 41
Size 49 kB (48876 bytes)
MD5 700e9af867b5f8ca1389e4268b6ea7e8
SHA1 8177fed64bae4e4d2ac369d503c4ce40e538c5e5
SHA256 d52c0e5f8c36487234c93ad8c1c08e74f0f7d76c6537a3ce7ea37ac6b5f3fd88
Certificate Info
Issuer Google Trust Services
Subject oomaugnaps.net
Fingerprint 46:88:55:C4:EF:5C:FE:BC:C8:46:42:24:45:00:00:E8:EE:C9:D7:BA
Validity Sat, 22 Mar 2025 09:39:52 GMT - Fri, 20 Jun 2025 10:37:28 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /www/images/700e9af867b5f8ca1389e4268b6ea7e8.png HTTP/1.1
Host: oomaugnaps.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:18 GMT
content-type: image/png
content-length: 48876
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=msaWU%2FRnNziSZUb6cNMswNYryP8SQYd8tVXTbeHbsD8boZqU8xU2EcVMqvoh3Q9sJkvz%2FWB5GHEw8ewx1GuzLMVTG7eUd4mcKvDcvTCTpxYrs4Yhu%2FNARg4RtEQwOhyLzg%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Wed, 05 Mar 2025 02:17:07 GMT
etag: "67c7b423-beec"
expires: Sat, 19 Apr 2025 22:40:37 GMT
cache-control: max-age=86400
timing-allow-origin: *
cf-cache-status: HIT
age: 3281
accept-ranges: bytes
cf-ray: 9327fa52a90c1c06-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=12004&min_rtt=4784&rtt_var=6436&sent=52&recv=53&lost=0&retrans=0&sent_bytes=5915&recv_bytes=3545&delivery_rate=2388&cwnd=12000&unsent_bytes=0&cid=3248c894ba0315be&ts=1136&x=16"
GET pastebin.pl/static/asset/17092055377430a1044da8a37b18147203f4015289.js
188.114.97.1200 OK 212 kB URL
pastebin.pl/static/asset/17092055377430a1044da8a37b18147203f4015289.js
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65535)
First Seen 2025-04-16
Last Seen 2025-07-23
Times Seen 6
Size 212 kB (212430 bytes)
MD5 c7192d1a4a90aedbdc0318dafa009cee
SHA1 5adb5696f1a184b73fd6099208322500212389ff
SHA256 a84b47af6771a16e70ce39032dd82089965ea697822de088b651e52174461a6c
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /static/asset/17092055377430a1044da8a37b18147203f4015289.js HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:10 GMT
content-type: application/javascript
cf-ray: 9327fa215f9f569c-OSL
server: cloudflare
last-modified: Mon, 03 Jun 2024 11:32:01 GMT
vary: Accept-Encoding
etag: W/"665da9b1-33dce"
expires: Sat, 19 Apr 2025 09:48:37 GMT
cache-control: max-age=43200
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
age: 6393
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PACJRxm7BjnzMd3saQW4ovZ9bZfnaAB%2BaoxCE9sjw%2FzJ0zNl6qCZ8xFcWL99zxxmPWqHDhWG78hCF3%2BOgUgtXOHlvAibySNSw%2BIqAieH4lzgz0nzfeu9lIRTJ2Em2A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3708&min_rtt=622&rtt_var=2240&sent=227&recv=251&lost=0&retrans=0&sent_bytes=15545&recv_bytes=14573&delivery_rate=226390&cwnd=12000&unsent_bytes=0&cid=444475b039203699&ts=1534&x=1", cfExtPri, cfHdrFlush;dur=0
GET pastebin.pl/cdn-cgi/challenge-platform/scripts/jsd/main.js
188.114.97.1302 Found 8.5 kB URL
pastebin.pl/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 8.5 kB (8489 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Fri, 18 Apr 2025 23:35:10 GMT
content-length: 0
cf-ray: 9327fa21bfc8569c-OSL
server: cloudflare
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JfdRiKRU7oJD1ii6UHFkVE1o%2BCbfpP9q2tY2mkchjLOENs8wfZhEjltCikTZpAw%2BfklxWNKDN4HHzB1zyCQap1sY7NdA61kgBDtxt4wqxbDFTG03uWgghZXDIwIqTw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3328&min_rtt=622&rtt_var=1864&sent=297&recv=256&lost=0&retrans=0&sent_bytes=97091&recv_bytes=15033&delivery_rate=567328&cwnd=48000&unsent_bytes=0&cid=444475b039203699&ts=1593&x=1", cfExtPri, cfHdrFlush;dur=0
GET grookilteepsou.net/zone?pub=0&zone_id=9152066&is_mobile=false&domain=pastebin.pl&var=&ymid=&var_3=&tg=0&sw=3.1.610&drf=
139.45.197.122200 OK 552 B URL
grookilteepsou.net/zone?pub=0&zone_id=9152066&is_mobile=false&domain=pastebin.pl&var=&ymid=&var_3=&tg=0&sw=3.1.610&drf=
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 552 B (552 bytes)
MD5 56fee90dc20e2d94014bc3d1ef8deeef
SHA1 3b88b723833c5524f43a8a17531b4b5b3c53f7b3
SHA256 54d5211536bbc8d3d9ea264176553c065f3c8a9c7e8f9aa77c6cd1713c8d524e
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /zone?pub=0&zone_id=9152066&is_mobile=false&domain=pastebin.pl&var=&ymid=&var_3=&tg=0&sw=3.1.610&drf= HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:12 GMT
content-type: application/json; charset=utf-8
content-length: 552
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
OPTIONS grookilteepsou.net/event
139.45.197.122200 OK 0 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700
142.250.74.10200 OK 27 kB URL
fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700
IP / ASN
142.250.74.10
#15169 GOOGLE
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type ASCII text, with very long lines (1572)
First Seen 2025-01-15
Last Seen 2025-06-02
Times Seen 713
Size 27 kB (26935 bytes)
MD5 da8ad2595d78edf21895319e7d02fe73
SHA1 d707ec9d6f68fbcfc0e2ebe711b97ad7d67e9aa9
SHA256 95bce9ed84dcd1e30d88c5e2b2368d24c4e6c60ca58210293d28b3394d1d629a
Certificate Info
Issuer Google Trust Services
Subject upload.video.google.com
Fingerprint 06:13:4C:49:F4:23:BB:58:C3:31:41:0E:F9:E0:C5:EF:74:A9:0C:67
Validity Mon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
GET /css2?family=Roboto:wght@100;300;400;500;700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 18 Apr 2025 23:35:21 GMT
date: Fri, 18 Apr 2025 23:35:21 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET oomaugnaps.net/www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg
104.21.7.134200 OK 14 kB URL
oomaugnaps.net/www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg
IP / ASN
104.21.7.134
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 192x192, components 3
First Seen 2024-12-24
Last Seen 2025-04-27
Times Seen 79
Size 14 kB (13638 bytes)
MD5 79d4b838ec366600aa8ddf118d0f5ffc
SHA1 62163877b2b3d92ead038a9f316c8a69dde2a12d
SHA256 fc804e50d61e636108e4c242b2efc02d17455cd65c23264aacd3c9337c2da34f
Certificate Info
Issuer Google Trust Services
Subject oomaugnaps.net
Fingerprint 46:88:55:C4:EF:5C:FE:BC:C8:46:42:24:45:00:00:E8:EE:C9:D7:BA
Validity Sat, 22 Mar 2025 09:39:52 GMT - Fri, 20 Jun 2025 10:37:28 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg HTTP/1.1
Host: oomaugnaps.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:23 GMT
content-type: image/jpeg
content-length: 13638
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pIeq4sdY90JA0rYJq8cu85E99FDIl4huzMBKV3imehziDxULGglJwPPZMpyTiAe%2F90EyZUQhjYY4CgXPjBWCI%2FACyjfv9Uz6b4spxPslcFibIM1S4PdTT5HJNyPCtQTOGg%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 27 Feb 2025 09:22:55 GMT
etag: "67c02eef-3546"
expires: Sat, 19 Apr 2025 06:42:05 GMT
cache-control: max-age=86400
timing-allow-origin: *
cf-cache-status: HIT
age: 60798
accept-ranges: bytes
cf-ray: 9327fa71d9ac1c06-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=9513&min_rtt=2201&rtt_var=6470&sent=183&recv=62&lost=0&retrans=0&sent_bytes=156135&recv_bytes=4701&delivery_rate=9414181&cwnd=68100&unsent_bytes=0&cid=3248c894ba0315be&ts=6129&x=16"
GET pastebin.pl/custom-images/flat_web_icon_set/color/Email.png
188.114.97.1200 OK 3.7 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Email.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2023-07-18
Last Seen 2025-07-23
Times Seen 25
Size 3.7 kB (3676 bytes)
MD5 8d908d753a0f6ba4ce4415a29923f831
SHA1 68a030082f447608d18ef5e74079f887eb411aa5
SHA256 dec2d47a7e0bea7d7ff08fc9900b45fcd381c19ce7299512e1d363dc25a8f687
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Email.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3676
cf-ray: 9327fa1bec4f5690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-e5c"
expires: Mon, 12 May 2025 06:58:46 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 578183
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OqVMVYNRa%2B1GbEEWediakHTQ6ZZCjA5mbRcoGpXKLfu5Mfw4ZKj5VJz5eKr9kQIYjB5Ln125vCOh3OEHiqnkiEreAntclGk2s4CcWnjacYZgUi4%2BNS0DuDI8jP4iNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=440&rtt_var=1633&sent=92&recv=80&lost=0&retrans=0&sent_bytes=91905&recv_bytes=2450&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1557&x=0"
X-Firefox-Spdy: h2
GET roagrofoogrobo.com/impression/vXzsPIQy-btcBkv0H3znvtTb6oXQ_UGQYigcvu2Zk5dkUdtAGN49PJ5cgYI-_ezGOnASVzOxjjK_ZrE5zjpVVCaIh-kNFMUWacLoxmkZy0azEemwiZuTzfi0UfCFDn4t4wXkg_2xEskCmqytAm5lu5NCh2tlUJ4PuJtxV7IzHShd-vLAl82UqHonq22xm4LyS0MavsMtOQmKeTy6n2eVNK3RHwPNMUJOu8PSNJWaR8SwTb5XjtpwGil5y9aFZsJzW9Q59J5k_WcqSXVFZMpXJGUiRhsNnJtnou774Ug6DkhgcSnXUUAbULYpVYACjmnAT6ecyN_2zplZBq1Wgai-DqqMnrb9_p0p9uFCGycrfjY_pigaCD0CIBUtrGxg24tesi4TdN-uzqXuZ-NPS_4FfJpSaCzb5REOPIqIZBLITxbrl7m3qjjxwlreNMcADzoURVQLRZPAeVlXLCHRacMpaqMtQ162etmhCvDJPWAlItFWcCGSANPOUAjAD9yFKF3WbC4eeW7aY6xiXi1lMmp4PwRpYsuWWr02nEiZ9eVSm3C9KgTO551gc5HqkXgMAKhAVsLrC2OyRlzsSeS8WAiiB1xOUmMxmOrMrbxeJRw8wan-7Xm78aAeg7z2nVNk24yl9VnzxvJo4pDmMkQNaA4_4tLOdsczEKnJejtXqDRKUb6DFL6wWvAejw9tsvMku3Yr4IJ9p1DJyiDALQXil61t6FHv8cNyLC3hlAaRAwtbTrclwD__TUxLqz-pZ4NFDTl3Gi5v2xANtiDCg7GoRtwpZgd21z7gg1SHioaYO4nr3Gx-1715MNGe_iRudtM98WlF?_z=9152063&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 43 B URL
roagrofoogrobo.com/impression/vXzsPIQy-btcBkv0H3znvtTb6oXQ_UGQYigcvu2Zk5dkUdtAGN49PJ5cgYI-_ezGOnASVzOxjjK_ZrE5zjpVVCaIh-kNFMUWacLoxmkZy0azEemwiZuTzfi0UfCFDn4t4wXkg_2xEskCmqytAm5lu5NCh2tlUJ4PuJtxV7IzHShd-vLAl82UqHonq22xm4LyS0MavsMtOQmKeTy6n2eVNK3RHwPNMUJOu8PSNJWaR8SwTb5XjtpwGil5y9aFZsJzW9Q59J5k_WcqSXVFZMpXJGUiRhsNnJtnou774Ug6DkhgcSnXUUAbULYpVYACjmnAT6ecyN_2zplZBq1Wgai-DqqMnrb9_p0p9uFCGycrfjY_pigaCD0CIBUtrGxg24tesi4TdN-uzqXuZ-NPS_4FfJpSaCzb5REOPIqIZBLITxbrl7m3qjjxwlreNMcADzoURVQLRZPAeVlXLCHRacMpaqMtQ162etmhCvDJPWAlItFWcCGSANPOUAjAD9yFKF3WbC4eeW7aY6xiXi1lMmp4PwRpYsuWWr02nEiZ9eVSm3C9KgTO551gc5HqkXgMAKhAVsLrC2OyRlzsSeS8WAiiB1xOUmMxmOrMrbxeJRw8wan-7Xm78aAeg7z2nVNk24yl9VnzxvJo4pDmMkQNaA4_4tLOdsczEKnJejtXqDRKUb6DFL6wWvAejw9tsvMku3Yr4IJ9p1DJyiDALQXil61t6FHv8cNyLC3hlAaRAwtbTrclwD__TUxLqz-pZ4NFDTl3Gi5v2xANtiDCg7GoRtwpZgd21z7gg1SHioaYO4nr3Gx-1715MNGe_iRudtM98WlF?_z=9152063&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type GIF image data, version 89a, 1 x 1
First Seen 2023-04-05
Last Seen 2025-08-02
Times Seen 80200
Size 43 B (43 bytes)
MD5 b4491705564909da7f9eaf749dbbfbb1
SHA1 279315d507855c6a4351e1e2c2f39dd9cd2fccd8
SHA256 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impression/vXzsPIQy-btcBkv0H3znvtTb6oXQ_UGQYigcvu2Zk5dkUdtAGN49PJ5cgYI-_ezGOnASVzOxjjK_ZrE5zjpVVCaIh-kNFMUWacLoxmkZy0azEemwiZuTzfi0UfCFDn4t4wXkg_2xEskCmqytAm5lu5NCh2tlUJ4PuJtxV7IzHShd-vLAl82UqHonq22xm4LyS0MavsMtOQmKeTy6n2eVNK3RHwPNMUJOu8PSNJWaR8SwTb5XjtpwGil5y9aFZsJzW9Q59J5k_WcqSXVFZMpXJGUiRhsNnJtnou774Ug6DkhgcSnXUUAbULYpVYACjmnAT6ecyN_2zplZBq1Wgai-DqqMnrb9_p0p9uFCGycrfjY_pigaCD0CIBUtrGxg24tesi4TdN-uzqXuZ-NPS_4FfJpSaCzb5REOPIqIZBLITxbrl7m3qjjxwlreNMcADzoURVQLRZPAeVlXLCHRacMpaqMtQ162etmhCvDJPWAlItFWcCGSANPOUAjAD9yFKF3WbC4eeW7aY6xiXi1lMmp4PwRpYsuWWr02nEiZ9eVSm3C9KgTO551gc5HqkXgMAKhAVsLrC2OyRlzsSeS8WAiiB1xOUmMxmOrMrbxeJRw8wan-7Xm78aAeg7z2nVNk24yl9VnzxvJo4pDmMkQNaA4_4tLOdsczEKnJejtXqDRKUb6DFL6wWvAejw9tsvMku3Yr4IJ9p1DJyiDALQXil61t6FHv8cNyLC3hlAaRAwtbTrclwD__TUxLqz-pZ4NFDTl3Gi5v2xANtiDCg7GoRtwpZgd21z7gg1SHioaYO4nr3Gx-1715MNGe_iRudtM98WlF?_z=9152063&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:23 GMT
content-type: image/gif
content-length: 43
x-trace-id: 1f1dd32c5b08924e851c98dae4068187
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
GET pastebin.pl/view/qr/f7aef741
188.114.97.1200 OK 386 B URL
pastebin.pl/view/qr/f7aef741
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 111 x 111, 1-bit colormap, non-interlaced
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 386 B (386 bytes)
MD5 f2301cf33a682181d12b4666cf48c322
SHA1 51efc2165324b8e5c7863756d985965365bbcb6c
SHA256 2e69ca90ca95e00ebf790c6545e7f96cc6928aba7c13727a775871df67ae7bed
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /view/qr/f7aef741 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
cf-ray: 9327fa1bec525690-OSL
server: cloudflare
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4IlMzwJkZS1MkidDRvEJ5RcyNTi3PEw0hzIs4CNICDvGsfyFSyClPWRc9Tin9SZClinKKpuk%2B4iWIFFkwo753N4RB8yGECmxQPMK024ib42W9CpeY810Dw0pVlTsPA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6515&min_rtt=440&rtt_var=11034&sent=105&recv=88&lost=0&retrans=0&sent_bytes=101615&recv_bytes=2684&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1775&x=0"
X-Firefox-Spdy: h2
GET eehassoosostoa.com/401/9152064
139.45.197.107200 OK 144 kB URL
eehassoosostoa.com/401/9152064
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 144 kB (143711 bytes)
MD5 d3289329fe8410847a5b14619963f3f9
SHA1 f08f477f1131998c5ccdc1c1633f1ea284792497
SHA256 6cbdff391b918c4715779c24d31d7d726698be981ac8740cdaa7972774da101b
Certificate Info
Issuer Let's Encrypt
Subject eehassoosostoa.com
Fingerprint 87:03:13:D6:53:57:8A:14:66:25:19:23:6E:8F:F4:D7:F1:80:23:B4
Validity Sat, 22 Feb 2025 05:42:14 GMT - Fri, 23 May 2025 05:42:13 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /401/9152064 HTTP/1.1
Host: eehassoosostoa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: application/javascript
x-trace-id: 9e1c430b6b415ad24c2b67ca521e5670
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0301afbcacbc4cbcfe49bf7b150fa186; expires=Sat, 18 Apr 2026 23:35:11 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
GET grookilteepsou.net/3bT/27mJf/universal.min.js?v=3.1.610
139.45.197.122200 OK 67 kB URL
grookilteepsou.net/3bT/27mJf/universal.min.js?v=3.1.610
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
First Seen 2025-04-15
Last Seen 2025-04-21
Times Seen 16
Size 67 kB (67368 bytes)
MD5 f480031d3a495ac3d3502ff107ecc91f
SHA1 be5f042a7ea926f9abfa248b6b3cade2676c3f5b
SHA256 7cbfc3cad84d22ad86a4509b511b6b861f57edb92a1ebdc6b74701920a5ebb05
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /3bT/27mJf/universal.min.js?v=3.1.610 HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:12 GMT
content-type: application/javascript
last-modified: Mon, 14 Apr 2025 08:21:01 GMT
etag: W/"67fcc56d-10728"
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
GET pastebin.pl/custom-images/btc.png
188.114.97.1200 OK 5.9 kB URL
pastebin.pl/custom-images/btc.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 362 x 177, 8-bit/color RGBA, non-interlaced
First Seen 2024-06-11
Last Seen 2025-07-23
Times Seen 16
Size 5.9 kB (5918 bytes)
MD5 541cb547b5a4ac3cfc2154ffdf973115
SHA1 8516e85d1fcb7796b1a1f038482afc99014a671d
SHA256 6d14cf497310bee3d3a2d4f4cc09c63d6230da3cc9e2f30c5d6ba23b36aac7f6
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/btc.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 5918
cf-ray: 9327fa1b9c075690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-171e"
expires: Tue, 29 Apr 2025 15:25:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 1671004
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PoCmDfoS%2BleGZT1PMn1yx0X4E6sUfYt%2BLcpV50Xbu3A2zBtCcGbO47Q8scQiEdpLo0QJ4AM0kJqC1cGd7AcsE6TaMtpdDiIFGT9Vak1wZzImDRlFcZKERkpHV0Dwsg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1398&min_rtt=441&rtt_var=1232&sent=33&recv=35&lost=0&retrans=0&sent_bytes=32283&recv_bytes=2080&delivery_rate=13163636&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1504&x=0"
X-Firefox-Spdy: h2
OPTIONS grookilteepsou.net/event
139.45.197.122200 OK 0 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
GET roagrofoogrobo.com/500/9152063?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 1.7 kB URL
roagrofoogrobo.com/500/9152063?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 1.7 kB (1734 bytes)
MD5 370d9e970c084a2ef9e3c2774762193b
SHA1 e0e21b5701b2b6660cc25e29a904ac5227cf2eef
SHA256 469c15250ac6f116ccadfa4bb28e2c8e0dbfefd597dee4c67a1c7fee1faa6617
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /500/9152063?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0301af48ef3d4ca2e1157690ef2bfe7b
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:17 GMT
content-type: application/javascript
x-trace-id: 2f449f63808a9ef2aa943844b1078c2b
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://pastebin.pl
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c; expires=Sat, 18 Apr 2026 23:35:17 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
GET oomaugnaps.net/www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg
104.21.7.134200 OK 14 kB URL
oomaugnaps.net/www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg
IP / ASN
104.21.7.134
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 192x192, components 3
First Seen 2024-12-24
Last Seen 2025-04-27
Times Seen 79
Size 14 kB (13638 bytes)
MD5 79d4b838ec366600aa8ddf118d0f5ffc
SHA1 62163877b2b3d92ead038a9f316c8a69dde2a12d
SHA256 fc804e50d61e636108e4c242b2efc02d17455cd65c23264aacd3c9337c2da34f
Certificate Info
Issuer Google Trust Services
Subject oomaugnaps.net
Fingerprint 46:88:55:C4:EF:5C:FE:BC:C8:46:42:24:45:00:00:E8:EE:C9:D7:BA
Validity Sat, 22 Mar 2025 09:39:52 GMT - Fri, 20 Jun 2025 10:37:28 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /www/images/79d4b838ec366600aa8ddf118d0f5ffc.jpg HTTP/1.1
Host: oomaugnaps.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:20 GMT
content-type: image/jpeg
content-length: 13638
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nyMPlpJNW6BXcQJLIVDjW5iiIOcEqN7aFTpMDpA7FDlaOZs2nPca90Q7m6mZ9B0idAJ3l1KYhg0t9mSCpnn1RWubDSbhmNg13Vzf7K6sOOcwzhRPeuLGUB7oPIUZz4IA1g%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Thu, 27 Feb 2025 09:22:55 GMT
etag: "67c02eef-3546"
expires: Sat, 19 Apr 2025 06:42:05 GMT
cache-control: max-age=86400
timing-allow-origin: *
cf-cache-status: HIT
age: 60795
accept-ranges: bytes
cf-ray: 9327fa6409521c06-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=12092&min_rtt=2201&rtt_var=6408&sent=96&recv=57&lost=0&retrans=0&sent_bytes=56733&recv_bytes=3962&delivery_rate=1152403&cwnd=37200&unsent_bytes=0&cid=3248c894ba0315be&ts=3919&x=16"
GET fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
142.250.74.35200 OK 40 kB URL
fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
IP / ASN
142.250.74.35
#15169 GOOGLE
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type Web Open Font Format (Version 2), TrueType, length 40128, version 1.0
First Seen 2025-01-08
Last Seen 2025-08-02
Times Seen 97640
Size 40 kB (40128 bytes)
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Certificate Info
Issuer Google Trust Services
Subject *.gstatic.com
Fingerprint 62:05:36:C2:8E:4C:CD:95:1E:1C:75:06:44:A3:57:E5:C0:17:02:80
Validity Mon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
GET /s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 40128
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Apr 2025 10:03:46 GMT
expires: Fri, 17 Apr 2026 10:03:46 GMT
cache-control: public, max-age=31536000
age: 135095
last-modified: Wed, 08 Jan 2025 18:23:10 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET oomaugnaps.net/www/images/545b04f9bce5a70f9754bb099df3f0e9.png
104.21.7.134200 OK 82 kB URL
oomaugnaps.net/www/images/545b04f9bce5a70f9754bb099df3f0e9.png
IP / ASN
104.21.7.134
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
First Seen 2025-03-06
Last Seen 2025-07-31
Times Seen 134
Size 82 kB (81979 bytes)
MD5 545b04f9bce5a70f9754bb099df3f0e9
SHA1 ae727e3526409cc6a2ff8be3f9ef15ec804d390c
SHA256 cc6720855ee907afb29b0f8ab90c8e412016e7976515d6577d5cf61dd913be0b
Certificate Info
Issuer Google Trust Services
Subject oomaugnaps.net
Fingerprint 46:88:55:C4:EF:5C:FE:BC:C8:46:42:24:45:00:00:E8:EE:C9:D7:BA
Validity Sat, 22 Mar 2025 09:39:52 GMT - Fri, 20 Jun 2025 10:37:28 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /www/images/545b04f9bce5a70f9754bb099df3f0e9.png HTTP/1.1
Host: oomaugnaps.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:21 GMT
content-type: image/png
content-length: 81979
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RcUJEZP9mfTcWVcca19%2BJsBg9V%2B8LkNzrQB7odo5yzFiuMuEf%2FSltylSRLOzIgJ6u4oYDeOe20zr%2Fz%2BzCgyCTMmJIBX2CEKYhay5y9icm%2FN1kdo6ED6NAl2HPXP0jdQXdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 04 Mar 2025 18:50:37 GMT
etag: "67c74b7d-1403b"
expires: Sat, 19 Apr 2025 21:37:14 GMT
cache-control: max-age=86400
timing-allow-origin: *
cf-cache-status: HIT
age: 7087
accept-ranges: bytes
cf-ray: 9327fa6929611c06-OSL
server: cloudflare
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=10974&min_rtt=2201&rtt_var=7042&sent=110&recv=59&lost=0&retrans=0&sent_bytes=71398&recv_bytes=4308&delivery_rate=1361495&cwnd=37200&unsent_bytes=0&cid=3248c894ba0315be&ts=4732&x=16"
GET pastebin.pl/custom-images/flat_web_icon_set/color/Reddit.png
188.114.97.1200 OK 4.0 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Reddit.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2023-07-18
Last Seen 2025-07-23
Times Seen 17
Size 4.0 kB (3971 bytes)
MD5 8aa0ab91d0ed487cbdd3a5d20b5c1f2a
SHA1 a17392fcf6580e1f03c6368a5d392887c3130fe1
SHA256 c3a49cc082ee48a3041a22f3112ffb3cbfe73c9e739efcebcfca7eaf6e01393c
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Reddit.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3971
cf-ray: 9327fa1bac1b5690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-f83"
expires: Tue, 29 Apr 2025 15:25:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 1671004
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OQ172qCG62Gge7Xp%2BHysBr27z2IUMpVND23Bc2JxyUqcT1jNLFMwM3djyV%2FccQ0IDCEZBIV%2FKsb2XmoStCxp%2BAWWQEZ0VS2thXXijES2MnWE0F9UCFHBnZE4V5gyVw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=917&min_rtt=440&rtt_var=665&sent=75&recv=65&lost=0&retrans=0&sent_bytes=78618&recv_bytes=2080&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1515&x=0"
X-Firefox-Spdy: h2
GET pastebin.pl/view/captcha?1745019308
188.114.97.1200 OK 3.0 kB URL
pastebin.pl/view/captcha?1745019308
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality", baseline, precision 8, 180x40, components 3
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 3.0 kB (3028 bytes)
MD5 a1a974512bbebb7bad7b75504f29d5dc
SHA1 b952b93e1edb387dc165ef598904bcffdd50f0c1
SHA256 4275b576e186b37bd1571b5c06bfa1bd88eb58777087ef097aea96e0fc035307
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /view/captcha?1745019308 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:10 GMT
content-type: image/jpeg
cf-ray: 9327fa1bfc535690-OSL
server: cloudflare
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sJ8utsr3ovP1VYQPGbzuq%2FKb8rYYD8bxjIL8SasOl8nkTpOpBQTh2I0dHsaBxUZszTdOyNLtZ6ybIqlal85K%2FwQkTvAzYSwKLvMIStQ38%2BE2mfroLp9Jsp570jc%2FtA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5438&min_rtt=440&rtt_var=8076&sent=107&recv=90&lost=0&retrans=0&sent_bytes=102622&recv_bytes=2684&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=2728&x=0"
X-Firefox-Spdy: h2
POST pastebin.pl/cdn-cgi/challenge-platform/h/g/jsd/r/0.9257961215059752:1745017836:sUelYzBsBhAlgwlz9-l_R7FkXTP0Fp8huOWcJ_z4j9Q/9327fa138ec25690
188.114.97.1200 OK 0 B URL
pastebin.pl/cdn-cgi/challenge-platform/h/g/jsd/r/0.9257961215059752:1745017836:sUelYzBsBhAlgwlz9-l_R7FkXTP0Fp8huOWcJ_z4j9Q/9327fa138ec25690
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
POST /cdn-cgi/challenge-platform/h/g/jsd/r/0.9257961215059752:1745017836:sUelYzBsBhAlgwlz9-l_R7FkXTP0Fp8huOWcJ_z4j9Q/9327fa138ec25690 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 12081
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
server: cloudflare
cf-ray: 9327fa25c99e569c-OSL
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JuMShzwbiLeLvEPxCtfASTf3fQgg3JC91dnSFTfxbjlhsCkiaY9eW1iVN1r6%2FgoLAnMbAAorSlQZt1tKVOvCfBHFuDBaGGNAhYfu0KGPKzBamNseo4ggqKeWfc5KkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
set-cookie: cf_clearance=ouvLQLGQsb5u8xYU5VL9YGYUMiMEHOkU1YyHG1ov1cM-1745019311-1.2.1.1-Kelei_YeYoM1bcvJiEV3x5E8Q6RCsmr9KksqtF7en1eDAYy7btn0wweIKBflMx_Mb58AoIuvY0w33xXq6wQWKLYv_R6ezEygTpaFw8iERsHzEPq4mRaLe._UrDRbg0jdl0zF8LJccfz.EnMyQER9Tbu7jctFv6iMBwsfbWUk0xtiSvMJCvIw7kk2zizFFnvbcIQ6CdGH2.1JocXtSSim0fukX51EgeYkXawuxj.LbC.Bhrd5Kk7GCLn75YShEbtYYR9Ln67pUElHebC5uznU1a4EgTO6TioY0iVLR5M_7_TppTwGPeApCON61VEfHGmG55PlEF7gQfbpIpLw5fPrBBeUNd_RwvnYg2qHcSlVnKs; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=pastebin.pl; Expires=Sat, 18 Apr 2026 23:35:11 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3144&min_rtt=622&rtt_var=2273&sent=349&recv=273&lost=0&retrans=0&sent_bytes=149064&recv_bytes=28736&delivery_rate=10063299&cwnd=48000&unsent_bytes=0&cid=444475b039203699&ts=2240&x=1", cfExtPri, cfHdrFlush;dur=0
GET pastebin.pl/cdn-cgi/challenge-platform/scripts/jsd/main.js
188.114.97.1302 Found 8.4 kB URL
pastebin.pl/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 8.4 kB (8374 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag; cf_clearance=ouvLQLGQsb5u8xYU5VL9YGYUMiMEHOkU1YyHG1ov1cM-1745019311-1.2.1.1-Kelei_YeYoM1bcvJiEV3x5E8Q6RCsmr9KksqtF7en1eDAYy7btn0wweIKBflMx_Mb58AoIuvY0w33xXq6wQWKLYv_R6ezEygTpaFw8iERsHzEPq4mRaLe._UrDRbg0jdl0zF8LJccfz.EnMyQER9Tbu7jctFv6iMBwsfbWUk0xtiSvMJCvIw7kk2zizFFnvbcIQ6CdGH2.1JocXtSSim0fukX51EgeYkXawuxj.LbC.Bhrd5Kk7GCLn75YShEbtYYR9Ln67pUElHebC5uznU1a4EgTO6TioY0iVLR5M_7_TppTwGPeApCON61VEfHGmG55PlEF7gQfbpIpLw5fPrBBeUNd_RwvnYg2qHcSlVnKs
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Fri, 18 Apr 2025 23:35:11 GMT
content-length: 0
cf-ray: 9327fa2b7ce5569c-OSL
server: cloudflare
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6rAmD0ZxB8OKKOm6FQH%2F04KE3QNA3S4G%2FL4WfFfEpYfWtJwkpdChf%2FSlNBx%2BYq7JNUJtUXXd8OfgIjO2v9FsBo%2FJf3i7PkWeN5rB%2FqWNijtwpiUsJoyQcc8k8nfdGA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3137&min_rtt=622&rtt_var=2063&sent=420&recv=279&lost=0&retrans=0&sent_bytes=229427&recv_bytes=30211&delivery_rate=40352&cwnd=96000&unsent_bytes=0&cid=444475b039203699&ts=3154&x=1", cfExtPri, cfHdrFlush;dur=0
GET tzegilo.com/stattag.js
172.67.193.52200 OK 18 kB URL
tzegilo.com/stattag.js
IP / ASN
172.67.193.52
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (17229)
First Seen 2024-07-11
Last Seen 2025-08-02
Times Seen 2917
Size 18 kB (17879 bytes)
MD5 01227f5edc20e0ff4ed643b27cb8bb68
SHA1 d71a88f7341f2b1bdaa7deb9a66888607bd52598
SHA256 75c91d86601e23ab56d872b31b42660f893fc6d6b0785e085c06c2c038e98fb2
Certificate Info
Issuer Google Trust Services
Subject tzegilo.com
Fingerprint CB:95:E4:2C:B0:9E:53:93:29:36:BD:03:FB:B9:70:C9:D1:93:CA:49
Validity Wed, 19 Mar 2025 12:29:56 GMT - Tue, 17 Jun 2025 13:28:20 GMT
GET /stattag.js HTTP/1.1
Host: tzegilo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:12 GMT
content-type: application/javascript
server: cloudflare
last-modified: Thu, 11 Jul 2024 10:23:58 GMT
link: <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin
cache-control: max-age=14400
cf-cache-status: HIT
age: 3916
etag: W/"668fb2be-45d7"
content-encoding: br
cf-ray: 9327fa3028b3569b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
OPTIONS vaimucuvikuwu.net/wrr?z=9152062&p_rid=dfa9f392-985d-4d95-8525-d784293b9cac&rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&dmn=&userId=0081af4b6fa14d5ee944ee76f4f3ca2c
139.45.197.106204 No Content 0 B URL
vaimucuvikuwu.net/wrr?z=9152062&p_rid=dfa9f392-985d-4d95-8525-d784293b9cac&rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&dmn=&userId=0081af4b6fa14d5ee944ee76f4f3ca2c
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject vaimucuvikuwu.net
Fingerprint D3:62:57:7B:C7:80:EE:E5:F0:43:DA:8B:49:0F:B6:B3:1F:28:67:B9
Validity Sat, 22 Feb 2025 05:33:33 GMT - Fri, 23 May 2025 05:33:32 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /wrr?z=9152062&p_rid=dfa9f392-985d-4d95-8525-d784293b9cac&rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&dmn=&userId=0081af4b6fa14d5ee944ee76f4f3ca2c HTTP/1.1
Host: vaimucuvikuwu.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
server: nginx
date: Fri, 18 Apr 2025 23:35:15 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
OPTIONS roagrofoogrobo.com/500/9152063?excludes=22954943&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 0 B URL
roagrofoogrobo.com/500/9152063?excludes=22954943&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /500/9152063?excludes=22954943&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:21 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://pastebin.pl
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-credentials: true
access-control-max-age: 600
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
GET pastebin.pl/custom-images/flat_web_icon_set/color/Facebook.png
188.114.97.1200 OK 3.4 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Facebook.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2023-07-18
Last Seen 2025-07-23
Times Seen 25
Size 3.4 kB (3394 bytes)
MD5 6a46d2278f751d882bee1ec883f568f9
SHA1 b214cd510459f20a0a0146b287fef0f1f400126d
SHA256 89c5625aa0ecfeaa47ae9da990cda5ab80fe8088ab1cd55ee7394e870de5eafa
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Facebook.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3394
cf-ray: 9327fa1b9c0a5690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-d42"
expires: Mon, 12 May 2025 06:26:16 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 580133
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pS7Cxw9Ztm0LOOmc%2F0wdR8RGkmdht3mr%2B7Nb4QCwXEu5FQWA1MUARswQZeQXfXui0XuHuijol%2FqS8NgcWDxILnkTzy76LT7RXRLlClByr3EqtGQVBLObuYlAbIh56g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=683&min_rtt=440&rtt_var=86&sent=60&recv=53&lost=0&retrans=0&sent_bytes=66215&recv_bytes=2080&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1508&x=0"
X-Firefox-Spdy: h2
OPTIONS eehassoosostoa.com/500/9152064?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=eehassoosostoa.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 0 B URL
eehassoosostoa.com/500/9152064?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=eehassoosostoa.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject eehassoosostoa.com
Fingerprint 87:03:13:D6:53:57:8A:14:66:25:19:23:6E:8F:F4:D7:F1:80:23:B4
Validity Sat, 22 Feb 2025 05:42:14 GMT - Fri, 23 May 2025 05:42:13 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /500/9152064?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=eehassoosostoa.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=2&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: eehassoosostoa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:23 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://pastebin.pl
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-credentials: true
access-control-max-age: 600
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
POST grookilteepsou.net/event
139.45.197.122200 OK 81 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 81 B (81 bytes)
MD5 59a6ed17c3476ee5a8d233f75a6cdbd8
SHA1 8f4a9a9112bd539b439d784dee97ed8f4e044740
SHA256 9d4f795ea75c2c4899f2f47aef69ef14ff8a33f4ad6e1612c0b25f357be08284
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Content-Type: application/json
Content-Length: 896
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: application/json; charset=utf-8
content-length: 81
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
GET pastebin.pl/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
188.114.97.1200 OK 8.5 kB URL
pastebin.pl/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (8489), with no line terminators
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 2
Size 8.5 kB (8489 bytes)
MD5 aa5e514ea2e10bb647649a92fa03aeb5
SHA1 02c73afa1307e3f1685cce7ac417f7c1a66c6e45
SHA256 dca3e82699f4df324f96151927a9b68667f426b9653154ee8c79d314652bb973
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js? HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:10 GMT
content-type: application/javascript; charset=UTF-8
content-encoding: br
cf-ray: 9327fa238887569c-OSL
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZsNH6H9Q5U5iPeRj6Jaaw6XRdBUzfeEJnGP%2BTA0%2BmrahlzBRm5nDynlM4T9yrjJyB3Mv%2BTLu8aH%2BWcJbYWs3PoCs7v1veu2TibK5d43mmktW4zD6AOGFbiRjjYVPcA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3981&min_rtt=622&rtt_var=2705&sent=299&recv=258&lost=0&retrans=0&sent_bytes=97878&recv_bytes=15372&delivery_rate=21339&cwnd=48000&unsent_bytes=0&cid=444475b039203699&ts=1876&x=1", cfExtPri, cfHdrFlush;dur=0
POST grookilteepsou.net/event
139.45.197.122200 OK 81 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 81 B (81 bytes)
MD5 b01fa2ea165f6266d67b12e7988bd1f1
SHA1 de86e4f918a72681741bcc0996f8dadf2ff8ef38
SHA256 e5b1b32ee2f1e016df6f61c5b864c87fc66e80df009feff330c0a4aadf750168
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Content-Type: application/json
Content-Length: 364
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:13 GMT
content-type: application/json; charset=utf-8
content-length: 81
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
POST fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=ffeea9d8-af73-4354-8d67-87ef692059d0
139.45.195.252200 OK 12 B URL
fleraprt.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=ffeea9d8-af73-4354-8d67-87ef692059d0
IP / ASN
139.45.195.252
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2023-04-05
Last Seen 2025-08-02
Times Seen 49662
Size 12 B (12 bytes)
MD5 adb4650bfc9d2a73d4dd69583b0ceb14
SHA1 1ce399d6e936232aaf2192cd7903a279c5015f22
SHA256 21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
Certificate Info
Issuer Sectigo Limited
Subject fleraprt.com
Fingerprint 23:5D:23:03:7B:8D:47:5A:E9:9C:E7:E0:5C:7E:E6:4F:A2:DC:B6:D0
Validity Wed, 11 Dec 2024 00:00:00 GMT - Sun, 11 Jan 2026 23:59:59 GMT
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=ffeea9d8-af73-4354-8d67-87ef692059d0 HTTP/1.1
Host: fleraprt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 2117
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Fri, 18 Apr 2025 23:35:18 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://pastebin.pl
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
GET www.googletagmanager.com/gtag/js?id=G-88PKPGCEBF
142.250.74.136200 OK 441 kB URL
www.googletagmanager.com/gtag/js?id=G-88PKPGCEBF
IP / ASN
142.250.74.136
#15169 GOOGLE
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (6171)
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 441 kB (440716 bytes)
MD5 113aa619cb6d8eda119933ab6f22f665
SHA1 17940f067d229c2381ec5bbd9885ee447512c11a
SHA256 98ae8c30617e1716711aefebf79e5d256cca7899c718497d31a3372a465cbc69
Certificate Info
Issuer Google Trust Services
Subject *.google-analytics.com
Fingerprint B7:82:F3:C7:93:B0:60:B0:83:49:F8:74:0D:49:78:23:65:0B:37:01
Validity Mon, 31 Mar 2025 08:54:29 GMT - Mon, 23 Jun 2025 08:54:28 GMT
GET /gtag/js?id=G-88PKPGCEBF HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 18 Apr 2025 23:35:10 GMT
expires: Fri, 18 Apr 2025 23:35:10 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
server: Google Tag Manager
content-length: 143399
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js
142.250.74.138200 OK 84 kB URL
ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js
IP / ASN
142.250.74.138
#15169 GOOGLE
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (32180)
First Seen 2023-03-07
Last Seen 2025-08-02
Times Seen 8318
Size 84 kB (84320 bytes)
MD5 32015dd42e9582a80a84736f5d9a44d7
SHA1 41b4bfbaa96be6d1440db6e78004ade1c134e276
SHA256 8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
Certificate Info
Issuer Google Trust Services
Subject upload.video.google.com
Fingerprint 06:13:4C:49:F4:23:BB:58:C3:31:41:0E:F9:E0:C5:EF:74:A9:0C:67
Validity Mon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 29707
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Apr 2025 01:37:52 GMT
expires: Sat, 18 Apr 2026 01:37:52 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 79038
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET pastebin.pl/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
188.114.97.1200 OK 8.4 kB URL
pastebin.pl/cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js?
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (8374), with no line terminators
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 8.4 kB (8374 bytes)
MD5 e26dd52dc3baec8bedea14dd0d9e8d69
SHA1 14817d90ec5ff63f625663b2d295b29004704d97
SHA256 93fe717b19b0c22bc2fb8c3bb9d34bf3523ff8046db8868c18af794fc3aac5e8
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/44e6f86df4dc/main.js? HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag; cf_clearance=ouvLQLGQsb5u8xYU5VL9YGYUMiMEHOkU1YyHG1ov1cM-1745019311-1.2.1.1-Kelei_YeYoM1bcvJiEV3x5E8Q6RCsmr9KksqtF7en1eDAYy7btn0wweIKBflMx_Mb58AoIuvY0w33xXq6wQWKLYv_R6ezEygTpaFw8iERsHzEPq4mRaLe._UrDRbg0jdl0zF8LJccfz.EnMyQER9Tbu7jctFv6iMBwsfbWUk0xtiSvMJCvIw7kk2zizFFnvbcIQ6CdGH2.1JocXtSSim0fukX51EgeYkXawuxj.LbC.Bhrd5Kk7GCLn75YShEbtYYR9Ln67pUElHebC5uznU1a4EgTO6TioY0iVLR5M_7_TppTwGPeApCON61VEfHGmG55PlEF7gQfbpIpLw5fPrBBeUNd_RwvnYg2qHcSlVnKs; _ga_88PKPGCEBF=GS1.1.1745019312.1.0.1745019312.0.0.0; _ga=GA1.1.129820670.1745019312
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:13 GMT
content-type: application/javascript; charset=UTF-8
content-encoding: br
cf-ray: 9327fa33b9a7569c-OSL
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cnERFZv93t6KYpjeyeEhIb218FPjAHGQ97EZ3wU9GKzfiZ%2FiHiisrRlHR05BDqc6O8myEpeDCiljCF4542TAaZhOpK7hD6V43lovyQqx6AZ%2Bqmp912%2BPcZfH7XEVmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2725&min_rtt=622&rtt_var=1886&sent=424&recv=283&lost=0&retrans=0&sent_bytes=231016&recv_bytes=31753&delivery_rate=4150&cwnd=96000&unsent_bytes=0&cid=444475b039203699&ts=4466&x=1", cfExtPri, cfHdrFlush;dur=0
GET vaimucuvikuwu.net/?rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&request_ab2=0&zoneid=9152062&js_build=iclick-v1.1126.0&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=-1&wgl=llvmpipe&js_build=iclick-v1.1126.0&navlng=en-US&vsbl=true&pnt=0&pnrc=0&wasm=-1&bs=dfa9f392-985d-4d95-8525-d784293b9cac&userId=0081af4b6fa14d5ee944ee76f4f3ca2c&m=link
139.45.197.106200 OK 2.3 kB URL
vaimucuvikuwu.net/?rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&request_ab2=0&zoneid=9152062&js_build=iclick-v1.1126.0&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=-1&wgl=llvmpipe&js_build=iclick-v1.1126.0&navlng=en-US&vsbl=true&pnt=0&pnrc=0&wasm=-1&bs=dfa9f392-985d-4d95-8525-d784293b9cac&userId=0081af4b6fa14d5ee944ee76f4f3ca2c&m=link
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 2.3 kB (2271 bytes)
MD5 3fac1a995a5a4a0b585b3142239000bb
SHA1 c3eb47a3f664215a32541e63dc7ba1decd86929f
SHA256 c9c9b400cc1757e0ad8d0a52a1af4587b1bfcf791a62711f2f89da4a17a8134b
Certificate Info
Issuer Let's Encrypt
Subject vaimucuvikuwu.net
Fingerprint D3:62:57:7B:C7:80:EE:E5:F0:43:DA:8B:49:0F:B6:B3:1F:28:67:B9
Validity Sat, 22 Feb 2025 05:33:33 GMT - Fri, 23 May 2025 05:33:32 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /?rb=JGLGjFYKsJD0N9KRqUzIyNXUXVJ-0b1LTq7308JUcyTklwFD_3YQnHgdujgyIdIPBD8Zgqe2eYpNxUpSkOm3quJNPn-Oapwp1WilSB_K6k_zbMWSbqzEML7r0mSP5BXmFKWgFycotP4R5RAE6ioD8vJSOa1nthrO0X_Gxp5dKXRvRVqyhueUNXg2i8LtOpJ2VUtA3rMvZxvRetXC55C0d5OhI9iPG2ELyaRXd3OrQ46eP-KkZ0rFJOEA23IKhlg6w1PVLN_yK0DZepG2x0XkrIlYryHC6Ok7&request_ab2=0&zoneid=9152062&js_build=iclick-v1.1126.0&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=-1&wgl=llvmpipe&js_build=iclick-v1.1126.0&navlng=en-US&vsbl=true&pnt=0&pnrc=0&wasm=-1&bs=dfa9f392-985d-4d95-8525-d784293b9cac&userId=0081af4b6fa14d5ee944ee76f4f3ca2c&m=link HTTP/1.1
Host: vaimucuvikuwu.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: application/json
x-trace-id: 380e5f9ac572c03c7d3928c3c5f8f4f3
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c; expires=Sat, 18 Apr 2026 23:35:14 GMT; path=/; secure; SameSite=None
oaidts=1745019314; expires=Sat, 18 Apr 2026 23:35:14 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Fri, 25 Apr 2025 23:35:14 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
GET glempirteechacm.com/500/9152065?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.106200 OK 1.3 kB URL
glempirteechacm.com/500/9152065?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.106
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 1.3 kB (1310 bytes)
MD5 31b30e573b535357cda4e5ded22d2495
SHA1 a2c659a5f46f97f2fb91553e6f411b70d2112805
SHA256 f37fe4e5081bb4d92de8b6037c08f81cf93c44a6bdc0d557ceb59ade402a84e8
Certificate Info
Issuer Let's Encrypt
Subject glempirteechacm.com
Fingerprint 47:3C:FC:98:8A:83:9E:A9:49:A6:8B:54:A1:B6:33:B6:48:94:29:B7
Validity Sat, 22 Feb 2025 05:41:31 GMT - Fri, 23 May 2025 05:41:30 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /500/9152065?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=glempirteechacm.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: glempirteechacm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Cookie: OAID=0301af60cea645a4f656d366577b821a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:16 GMT
content-type: application/javascript
x-trace-id: 5b3f6281e3704fc88393fdeabbcf9c0a
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
vary: Origin
access-control-allow-origin: https://pastebin.pl
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0081af4b6fa14d5ee944ee76f4f3ca2c; expires=Sat, 18 Apr 2026 23:35:16 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
POST fleraprt.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=ffeea9d8-af73-4354-8d67-87ef692059d0
139.45.195.252200 OK 0 B URL
fleraprt.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=ffeea9d8-af73-4354-8d67-87ef692059d0
IP / ASN
139.45.195.252
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Sectigo Limited
Subject fleraprt.com
Fingerprint 23:5D:23:03:7B:8D:47:5A:E9:9C:E7:E0:5C:7E:E6:4F:A2:DC:B6:D0
Validity Wed, 11 Dec 2024 00:00:00 GMT - Sun, 11 Jan 2026 23:59:59 GMT
POST /async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=ffeea9d8-af73-4354-8d67-87ef692059d0 HTTP/1.1
Host: fleraprt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1155
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Fri, 18 Apr 2025 23:35:18 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: https://pastebin.pl
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
GET kulroakonsu.net/88/tag.min.js
139.45.197.243200 OK 106 kB URL
kulroakonsu.net/88/tag.min.js
IP / ASN
139.45.197.243
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65494)
First Seen 2025-04-15
Last Seen 2025-04-20
Times Seen 8
Size 106 kB (106484 bytes)
MD5 71f97790b5dd1b96bd4d95db7b6432d9
SHA1 1c471990ddbcda715a39539b00269aea4e0929cb
SHA256 01a0e3734cfb34fa200efc64103e289fa171cf83223074962b25ea49f1211c32
Certificate Info
Issuer Let's Encrypt
Subject kulroakonsu.net
Fingerprint 24:95:E8:21:67:7A:E5:FB:7D:61:CD:AD:2B:DD:D1:2B:38:AD:36:A1
Validity Sat, 12 Apr 2025 05:13:08 GMT - Fri, 11 Jul 2025 05:13:07 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /88/tag.min.js HTTP/1.1
Host: kulroakonsu.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: text/javascript; charset=utf-8
content-length: 39557
content-encoding: br
x-trace-id: d436c2808d9df7ba03e624ed789b76eb
accept-ranges: bytes
last-modified: Tue, 15 Apr 2025 13:21:22 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
timing-allow-origin: *
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
GET pastebin.pl/custom-images/flat_web_icon_set/color/Wordpress.png
188.114.97.1200 OK 4.0 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Wordpress.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2024-06-11
Last Seen 2025-07-23
Times Seen 16
Size 4.0 kB (3972 bytes)
MD5 fc8c39f29bc45297cebbef50763c5ac5
SHA1 cd2b70af0a1c3ec2a4acf83a6460bf9f53189902
SHA256 010bfbc6758a3fbed41c7a3aeadddb18d0df8b573cbf92a738c1f9a9e6c313f4
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Wordpress.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3972
cf-ray: 9327fa1bec4d5690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-f84"
expires: Sun, 18 May 2025 00:44:26 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 82243
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2ByMBQ518iCufXpIj0Oey%2BIP1TgaXgJ7fZbG4wvONZhhVE%2BRWUoyIdbnFzPxW75AaKUjVe0XEvni4CZWmt7X4sia%2BXcWF39ifTjybk58fqr7aEaDVVZV%2F2ZTi7xwxg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1779&min_rtt=440&rtt_var=2035&sent=87&recv=78&lost=0&retrans=0&sent_bytes=87393&recv_bytes=2450&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1553&x=0"
X-Firefox-Spdy: h2
GET roagrofoogrobo.com/400/9152063
139.45.197.107200 OK 136 kB URL
roagrofoogrobo.com/400/9152063
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 136 kB (135933 bytes)
MD5 af7e082e1fcfa396f3c6fc8e6d2a7167
SHA1 04d26b67160e894d45d229dfcc591e92f2104667
SHA256 f8a33cd7289b6cceb022b9634e929bef94b96d22d6fb7fe8d6eb27a8692e87d4
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /400/9152063 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: application/javascript
x-trace-id: e576e891b42eb80e578ddc43e44058a1
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
set-cookie: OAID=0301af48ef3d4ca2e1157690ef2bfe7b; expires=Sat, 18 Apr 2026 23:35:11 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
POST pastebin.pl/cdn-cgi/challenge-platform/h/g/jsd/r/0.43680702459357185:1745017836:L95ZbuDcD98d0nE_enYjneFUK9At6JSz50qnlD52R9s/9327fa138ec25690
188.114.97.1200 OK 0 B URL
pastebin.pl/cdn-cgi/challenge-platform/h/g/jsd/r/0.43680702459357185:1745017836:L95ZbuDcD98d0nE_enYjneFUK9At6JSz50qnlD52R9s/9327fa138ec25690
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
POST /cdn-cgi/challenge-platform/h/g/jsd/r/0.43680702459357185:1745017836:L95ZbuDcD98d0nE_enYjneFUK9At6JSz50qnlD52R9s/9327fa138ec25690 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 12081
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag; cf_clearance=ouvLQLGQsb5u8xYU5VL9YGYUMiMEHOkU1YyHG1ov1cM-1745019311-1.2.1.1-Kelei_YeYoM1bcvJiEV3x5E8Q6RCsmr9KksqtF7en1eDAYy7btn0wweIKBflMx_Mb58AoIuvY0w33xXq6wQWKLYv_R6ezEygTpaFw8iERsHzEPq4mRaLe._UrDRbg0jdl0zF8LJccfz.EnMyQER9Tbu7jctFv6iMBwsfbWUk0xtiSvMJCvIw7kk2zizFFnvbcIQ6CdGH2.1JocXtSSim0fukX51EgeYkXawuxj.LbC.Bhrd5Kk7GCLn75YShEbtYYR9Ln67pUElHebC5uznU1a4EgTO6TioY0iVLR5M_7_TppTwGPeApCON61VEfHGmG55PlEF7gQfbpIpLw5fPrBBeUNd_RwvnYg2qHcSlVnKs; _ga_88PKPGCEBF=GS1.1.1745019312.1.0.1745019312.0.0.0; _ga=GA1.1.129820670.1745019312
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 18 Apr 2025 23:35:13 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
server: cloudflare
cf-ray: 9327fa366aea569c-OSL
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5o6jgwUxVS%2Fk10E6iK9vNK2VzKhXmxsfXx%2BfOrpBglqWdw2t37qZ2BJG8zSGFa9yDD8DcbYQM21tSWD9w67JpDWTGYkqe2aA1py%2F73L4yvyCGpp3F34opGt0DUlkeg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
set-cookie: cf_clearance=a4QbjVwfLi8vLGlrY2P.Hf1M39951U_xGSRHEpovtkQ-1745019313-1.2.1.1-fUknybFsqW9BllzyXsqCDn7CFn45ALztMX65tWM_Cq2KpCNbtwtTuW82isl9NWw8xl3QUKf4E1LB4.GOijnS0TrDt5MpFt96gryAQPa3YCHn9Vpc_BnDk7CAQdcgCGLd6LFUhpFdColHCMej.O06Q5xBDEHK7Mcs_T_c.8_IOxpmxuKEsO1G5yPv9IgYeb1HRjxMsB_sPSzg5fZuZ8ouL_xZ4YK.2B8Vv6_24MJTyY650PPBWmm_9XaY.J_hL5yWt_nWK.FI_6x1XfX9WUsqab5VWEdCRwAOt3t3EarOpkgdwYQUm_tfIct2OBMjgcFbi_rcpiZnnksF09gmriFhXxwB8m00lEpnrE1Hf5K0Yvk; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=pastebin.pl; Expires=Sat, 18 Apr 2026 23:35:13 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2590&min_rtt=622&rtt_var=1684&sent=439&recv=296&lost=0&retrans=1&sent_bytes=237131&recv_bytes=45826&delivery_rate=99624&cwnd=96000&unsent_bytes=0&cid=444475b039203699&ts=4899&x=1", cfExtPri, cfHdrFlush;dur=0
OPTIONS roagrofoogrobo.com/500/9152063?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
139.45.197.107200 OK 0 B URL
roagrofoogrobo.com/500/9152063?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1
IP / ASN
139.45.197.107
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject roagrofoogrobo.com
Fingerprint 99:7C:7C:79:0B:5C:A6:90:4C:92:EB:3F:97:F4:42:22:B9:55:7B:C4
Validity Sat, 22 Feb 2025 05:38:38 GMT - Fri, 23 May 2025 05:38:37 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /500/9152063?excludes=&oaid=0081af4b6fa14d5ee944ee76f4f3ca2c&var=&ymid=&js_build=8&sw_version=v1.605.0&dmn=roagrofoogrobo.com&fs=0&cf=0&sw=1280&sh=1024&sah=1024&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=1&pl=https%3A%2F%2Fpastebin.pl%2Fview%2Ff7aef741&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&tzofs=0&btz=UTC&bto=0&jsp=1 HTTP/1.1
Host: roagrofoogrobo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:17 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://pastebin.pl
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-allow-credentials: true
access-control-max-age: 600
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
GET pastebin.pl/view/f7aef741
188.114.97.1200 OK 429 kB URL
pastebin.pl/view/f7aef741
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Resource Info
File type HTML document, ASCII text, with CRLF, LF line terminators
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 429 kB (429223 bytes)
MD5 5b9459cbde47417ea1c627134d0a8f57
SHA1 7d813e117a9e85721fe4deef082f00dd0ed37f31
SHA256 30e054a4a2988a779c6f38dfa6133fb67fbe5eda7f7cac919653ec90f14379da
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /view/f7aef741 HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:08 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9327fa138ec25690-OSL
server: cloudflare
content-encoding: br
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qr8RULXPMWhwO%2FYouVliMdAZSsKMZySQpGOJomrgriUDq616xLFlPIS6abKBUuW%2BRO5C6kcg83ISTulPjU87%2FN9UgiO8aKeeRcC6khE27IUsMv1dembJFwn4yY%2FOWA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
set-cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag; Path=/
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5964&min_rtt=441&rtt_var=11087&sent=6&recv=11&lost=0&retrans=0&sent_bytes=2989&recv_bytes=1256&delivery_rate=4739770&cwnd=253&unsent_bytes=0&cid=4a148f17117161e4&ts=869&x=0"
X-Firefox-Spdy: h2
GET pastebin.pl/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
188.114.97.1200 OK 12 kB URL
pastebin.pl/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JavaScript source, ASCII text, with very long lines (12331)
First Seen 2023-03-07
Last Seen 2025-08-02
Times Seen 43341
Size 12 kB (12332 bytes)
MD5 88a769d2fe35899fd45a332a0a032cc0
SHA1 514c6c1d8475d17e412849a4c90159517d0fa10a
SHA256 ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: application/javascript
last-modified: Fri, 18 Apr 2025 14:27:47 GMT
content-encoding: gzip
cache-control: max-age=172800, public
etag: W/"68026163-302c"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uMVpPgjZ3tYmb2zd3Dtops4WJ1yvQZuRMykksAF8sfgDXK%2FI4XJYv64BkNMBMj8XwoMthkTvGPGYX3A2oj2kInDPUYeb0YERuRLIzcWleoccZXozi1P5EV9Jwz%2BKBw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 9327fa1c1c6e5690-OSL
x-frame-options: DENY
expires: Sun, 20 Apr 2025 23:35:09 GMT
X-Firefox-Spdy: h2
GET my.rtmark.net/gid.js?userId=0081af4b6fa14d5ee944ee76f4f3ca2c
172.64.146.234200 OK 65 B URL
my.rtmark.net/gid.js?userId=0081af4b6fa14d5ee944ee76f4f3ca2c
IP / ASN
172.64.146.234
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 65 B (65 bytes)
MD5 414908680d94808c21c6f480861a1f46
SHA1 f06703640f5e46b20a7e65ce3b945b7b2098de03
SHA256 d315234ac2b73a2e52f5eb2c4d26fb047d28dfe4f804480fee61a1682509dbfb
Certificate Info
Issuer Google Trust Services
Subject my.rtmark.net
Fingerprint 03:52:6A:BD:35:83:43:81:AF:25:BB:A3:26:97:D1:78:25:73:A4:C9
Validity Tue, 04 Mar 2025 10:39:32 GMT - Mon, 02 Jun 2025 11:39:29 GMT
GET /gid.js?userId=0081af4b6fa14d5ee944ee76f4f3ca2c HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:11 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://pastebin.pl
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=0081af4b6fa14d5ee944ee76f4f3ca2c; expires=Sat, 18 Apr 2026 23:35:11 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 9327fa28086b5689-OSL
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
OPTIONS grookilteepsou.net/event
139.45.197.122200 OK 0 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type N/A
First Seen 0001-01-01
Last Seen 2025-08-02
Times Seen 5607219
Size 0 B (0 bytes)
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
OPTIONS /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://pastebin.pl/
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid
access-control-max-age: 86400
X-Firefox-Spdy: h2
POST grookilteepsou.net/event
139.45.197.122200 OK 81 B URL
grookilteepsou.net/event
IP / ASN
139.45.197.122
#9002 RETN Limited
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type JSON text data
First Seen 2025-04-18
Last Seen 2025-04-18
Times Seen 1
Size 81 B (81 bytes)
MD5 d02b6d8a86ab28d61917f9f0d07d54e0
SHA1 50385b9ac1fcb1ac4e65559bcf3f123af7fa8c99
SHA256 ce8ead035b91f9a60108eab4097c28a30f0c2d6d661c0fe297463878729b0e0f
Certificate Info
Issuer Let's Encrypt
Subject grookilteepsou.net
Fingerprint 88:32:02:85:20:BA:DC:ED:9E:9D:73:5A:A2:BA:00:56:79:A1:7D:44
Validity Sat, 29 Mar 2025 05:35:06 GMT - Fri, 27 Jun 2025 05:35:05 GMT
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /event HTTP/1.1
Host: grookilteepsou.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pastebin.pl/
Content-Type: application/json
Content-Length: 360
Origin: https://pastebin.pl
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 18 Apr 2025 23:35:14 GMT
content-type: application/json; charset=utf-8
content-length: 81
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://pastebin.pl
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
GET pastebin.pl/custom-images/flat_web_icon_set/color/Google+.png
188.114.97.1200 OK 3.9 kB URL
pastebin.pl/custom-images/flat_web_icon_set/color/Google+.png
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Requested by https://pastebin.pl/view/f7aef741
Resource Info
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
First Seen 2023-09-21
Last Seen 2025-07-23
Times Seen 27
Size 3.9 kB (3869 bytes)
MD5 8f4a2ba46a7ed3853ef2e946e3b4ec02
SHA1 fe08b0b0ae99731e513abf4ce61b174c5986ab75
SHA256 1e7a8021a029a0b1b97d9df2c059ad4fe80ff8d9db9564c593bdde97df48f5ff
Certificate Info
Issuer Google Trust Services
Subject pastebin.pl
Fingerprint 8B:D2:B7:06:BB:97:D1:14:C6:8B:92:25:A9:E4:77:B0:F1:93:FC:8E
Validity Wed, 26 Mar 2025 04:01:34 GMT - Tue, 24 Jun 2025 04:59:08 GMT
GET /custom-images/flat_web_icon_set/color/Google+.png HTTP/1.1
Host: pastebin.pl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pastebin.pl/view/f7aef741
Cookie: PHPSESSID=a46at8n99jbm6aiq560epsnkag
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Apr 2025 23:35:09 GMT
content-type: image/png
content-length: 3869
cf-ray: 9327fa1b9c0f5690-OSL
server: cloudflare
last-modified: Wed, 14 Jul 2021 07:32:37 GMT
etag: "60ee9315-f1d"
expires: Tue, 29 Apr 2025 15:25:05 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: HIT
age: 1671004
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Aalj0KuphXuV56T7UM%2F6JmuVxfOXYGfp3%2BMaCY6DGXsKbOBQGERhiurqHpyWIllgonFccgWxQJkvCWHgpxWE1rKunn3kCCOy6cNSuwvK8CvMpkqccTksjsfdXZf9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=639&min_rtt=440&rtt_var=70&sent=65&recv=57&lost=0&retrans=0&sent_bytes=70144&recv_bytes=2080&delivery_rate=36769044&cwnd=257&unsent_bytes=0&cid=4a148f17117161e4&ts=1511&x=0"
X-Firefox-Spdy: h2