Report - attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip

Report Overview

Visited public
2023-09-01 05:31:31
Tags
Submit Tags
URL
attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip
Finishing URL
attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip
IP / ASN
209.237.141.109
#36231 TEMPEST-HOSTING
Title
Attachment Warning!

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
hcaptcha.com	5458	2018-01-12	2018-04-03 05:49:29	2023-08-31 06:10:09	608 B	1.4 kB	104.16.168.131
js.hcaptcha.com	23463	2018-01-12	2021-07-30 13:51:37	2023-08-31 06:10:07	383 B	326 kB	104.16.168.131
attachments.f95zone.to	278445	unknown	2019-03-18 10:01:26	2023-08-31 04:59:31	977 B	16 kB	209.237.141.109
f95zone.to	82094	unknown	2019-03-18 10:00:35	2023-08-31 18:50:01	1.7 kB	39 kB	190.115.31.182
newassets.hcaptcha.com	11055	2018-01-12	2021-03-22 11:55:22	2023-08-31 06:10:09	2.5 kB	1.2 MB	104.16.168.131

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-01 05:31:02	medium	Client IP	Internal IP	ET DNS Query for .to TLD
2023-09-01 05:31:02	medium	Client IP	Internal IP	ET DNS Query for .to TLD
2023-09-01 05:31:02	medium	Client IP	Internal IP	ET DNS Query for .to TLD
2023-09-01 05:31:02	medium	Client IP	Internal IP	ET DNS Query for .to TLD
2023-09-01 05:31:02	medium	Client IP	Internal IP	ET DNS Query for .to TLD

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	newassets.hcaptcha.com/captcha/v1/19148ad/hcaptcha.js	ScriptElement	325 kB	2023-08-27	2024-08-21
Pretty URL newassets.hcaptcha.com/captcha/v1/19148ad/hcaptcha.js IP 104.16.168.131 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-27 04:03 Last Seen2024-08-21 07:59 Times Seen1005 Hash 2b05481062f33bd264d5393896c697d5 ff9bf10c95f546c780228a26d5521925ece49eb1 9d5a464b1b4bb3e30ea40b7662d86d354a7edcac616b09c78a8e4655edd85222 Loading...

	newassets.hcaptcha.com/c/6f48ffb/hsw.js	ScriptElement	581 kB	2023-08-25	2023-09-11
Pretty URL newassets.hcaptcha.com/c/6f48ffb/hsw.js IP 104.16.168.131 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-25 11:45 Last Seen2023-09-11 07:01 Times Seen484 Hash decfec72ea568f718c9ec5c986c38e43 c41fe233b75092e919030b5ed009c768199c22f0 3a922a083e81fa3fcff143e14a1b978edc4c0beba5056a183b935b4b409aef96 Loading...

	f95zone.to/assets/vendor/jquery-3.2.1.min.js	ScriptElement	87 kB	2023-03-07	2025-07-12
Pretty URL f95zone.to/assets/vendor/jquery-3.2.1.min.js IP 190.115.31.182 ASN #262254 DDOS-GUARD CORP. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06 Last Seen2025-07-12 18:46 Times Seen1456 Hash 473957cfb255a781b42cb2af51d54a3b 67bdacbd077ee59f411109fd119ee9f58db15a5f 75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35 Loading...

	f95zone.to/assets/SamF95/AttachmentLock/main.js?v=1	ScriptElement	1.8 kB	2023-03-10	2024-08-21
Pretty URL f95zone.to/assets/SamF95/AttachmentLock/main.js?v=1 IP 190.115.31.182 ASN #262254 DDOS-GUARD CORP. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 07:08 Last Seen2024-08-21 09:40 Times Seen43 Hash e3582a8a873266ebfe5d5173f6ef4bc7 b7468ce385886ff911832a264fd97e9afb9fff09 e305b601744f5f684c412278657edcea4f446d6a666649ef9f50800496af9c6e Loading...

HTTP Transactions (13)

	URL	IP	Response	Size
	GET attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip	209.237.141.109	200 OK	694 B
URL User Request GET HTTP/1.1 attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip IP 209.237.141.109:443 ASN #36231 TEMPEST-HOSTING Certificate IssuerLet's Encrypt Subjectattachments.f95zone.com FingerprintE3:39:C3:F5:1D:AF:D5:D8:DE:F9:E5:74:F2:59:62:2B:95:DA:AA:C6 ValidityTue, 08 Aug 2023 05:07:45 GMT - Mon, 06 Nov 2023 05:07:44 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators Size 694 B (694 bytes) Hash 62385c87e10996e8b9e5cf0f789781df 781079206b6871b4713d53ef3c16407522c1b855 96f4f82960e1e91f662e85e53560c71dc1c9f05d4a4bb4b85e9bcf0f2697ae9f HTTP Headers GET /2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip HTTP/1.1 Host: attachments.f95zone.to User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Sep 2023 05:31:13 GMT Content-Type: text/html Content-Length: 694 Last-Modified: Mon, 01 Aug 2022 14:05:00 GMT Connection: keep-alive Expires: Sat, 31 Aug 2024 05:31:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=15768000 Accept-Ranges: bytes`

	GET f95zone.to/assets/SamF95/AttachmentLock/main.css?v=1	190.115.31.182	200 OK	3.5 kB
URL GET HTTP/2 f95zone.to/assets/SamF95/AttachmentLock/main.css?v=1 IP 190.115.31.182:443 ASN #262254 DDOS-GUARD CORP. Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerLet's Encrypt Subjectf95zone.to Fingerprint2D:23:B2:88:2D:1C:1E:12:08:DF:DE:E6:18:54:4B:0E:14:99:C7:F0 ValiditySun, 27 Aug 2023 00:41:19 GMT - Sat, 25 Nov 2023 00:41:18 GMT File type ASCII text, with very long lines (15665) Size 3.5 kB (3504 bytes) Hash 727f8ab89f55850cca1a85e293ca3a7b d430ebc26cffa888284780a5d46f0db64296d298 f92301859d393f11829ab78f5d5b0cc325f94eb970db5798bd2d36f3eec5f8bd HTTP Headers `GET /assets/SamF95/AttachmentLock/main.css?v=1 HTTP/1.1 Host: f95zone.to User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: ddos-guard content-security-policy: upgrade-insecure-requests; set-cookie: __ddg1_=taYJZeRYrNTAqaIBOPc9; Domain=.f95zone.to; HttpOnly; Path=/; Expires=Sat, 31-Aug-2024 05:31:13 GMT date: Fri, 25 Aug 2023 14:44:14 GMT content-type: text/css last-modified: Sat, 04 Jun 2022 22:39:42 GMT vary: Accept-Encoding etag: W/"629bdf2e-3d32" expires: Sat, 24 Aug 2024 14:44:14 GMT cache-control: max-age=31536000 strict-transport-security: max-age=15768000 content-encoding: gzip age: 571619 content-length: 3504 ddg-cache-status: HIT,HIT X-Firefox-Spdy: h2

	GET f95zone.to/assets/SamF95/AttachmentLock/main.js?v=1	190.115.31.182	200 OK	848 B
URL GET HTTP/2 f95zone.to/assets/SamF95/AttachmentLock/main.js?v=1 IP 190.115.31.182:443 ASN #262254 DDOS-GUARD CORP. Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerLet's Encrypt Subjectf95zone.to Fingerprint2D:23:B2:88:2D:1C:1E:12:08:DF:DE:E6:18:54:4B:0E:14:99:C7:F0 ValiditySun, 27 Aug 2023 00:41:19 GMT - Sat, 25 Nov 2023 00:41:18 GMT File type HTML document, ASCII text, with very long lines (569) Size 848 B (848 bytes) Hash e3582a8a873266ebfe5d5173f6ef4bc7 b7468ce385886ff911832a264fd97e9afb9fff09 e305b601744f5f684c412278657edcea4f446d6a666649ef9f50800496af9c6e HTTP Headers `GET /assets/SamF95/AttachmentLock/main.js?v=1 HTTP/1.1 Host: f95zone.to User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: ddos-guard content-security-policy: upgrade-insecure-requests; set-cookie: __ddg1_=CZRpYHaxaaiblocbJkRz; Domain=.f95zone.to; HttpOnly; Path=/; Expires=Sat, 31-Aug-2024 05:31:13 GMT date: Wed, 30 Aug 2023 11:01:46 GMT content-type: application/javascript; charset=utf-8 last-modified: Sun, 05 Jun 2022 14:57:38 GMT etag: W/"629cc462-6e5" expires: Thu, 29 Aug 2024 11:01:46 GMT cache-control: max-age=31536000 strict-transport-security: max-age=15768000 accept-ranges: bytes content-encoding: br vary: Accept-Encoding age: 152967 content-length: 848 ddg-cache-status: HIT,HIT X-Firefox-Spdy: h2

	GET f95zone.to/assets/vendor/jquery-3.2.1.min.js	190.115.31.182	200 OK	30 kB
URL GET HTTP/2 f95zone.to/assets/vendor/jquery-3.2.1.min.js IP 190.115.31.182:443 ASN #262254 DDOS-GUARD CORP. Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerLet's Encrypt Subjectf95zone.to Fingerprint2D:23:B2:88:2D:1C:1E:12:08:DF:DE:E6:18:54:4B:0E:14:99:C7:F0 ValiditySun, 27 Aug 2023 00:41:19 GMT - Sat, 25 Nov 2023 00:41:18 GMT File type ASCII text, with very long lines (32058), with CRLF line terminators Size 30 kB (30188 bytes) Hash 473957cfb255a781b42cb2af51d54a3b 67bdacbd077ee59f411109fd119ee9f58db15a5f 75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35 HTTP Headers `GET /assets/vendor/jquery-3.2.1.min.js HTTP/1.1 Host: f95zone.to User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: ddos-guard content-security-policy: upgrade-insecure-requests; set-cookie: __ddg1_=BPsLDfNaw2y2PkSnGrOv; Domain=.f95zone.to; HttpOnly; Path=/; Expires=Sat, 31-Aug-2024 05:31:13 GMT date: Mon, 17 Oct 2022 11:06:42 GMT content-type: application/javascript; charset=utf-8 last-modified: Fri, 29 Mar 2019 18:01:09 GMT vary: Accept-Encoding etag: W/"5c9e5d65-15287" expires: Tue, 17 Oct 2023 11:06:42 GMT cache-control: max-age=31536000 strict-transport-security: max-age=15768000 content-encoding: gzip age: 27541473 ddg-cache-status: HIT,MISS content-length: 30188 X-Firefox-Spdy: h2

	GET attachments.f95zone.to/favicon.ico	209.237.141.109	200 OK	15 kB
URL GET HTTP/1.1 attachments.f95zone.to/favicon.ico IP 209.237.141.109:443 ASN #36231 TEMPEST-HOSTING Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerLet's Encrypt Subjectattachments.f95zone.com FingerprintE3:39:C3:F5:1D:AF:D5:D8:DE:F9:E5:74:F2:59:62:2B:95:DA:AA:C6 ValidityTue, 08 Aug 2023 05:07:45 GMT - Mon, 06 Nov 2023 05:07:44 GMT File type MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel\012- data Size 15 kB (15086 bytes) Hash e92b411ab49ef118447fe42d6639abff 11ab4d673ee1e79b3820a79a4719c3d4375d3c28 196f7bb69a3f788ecc99d865d2a0535d6498e6a6fed29060ee9cffcabaf6847c HTTP Headers `GET /favicon.ico HTTP/1.1 Host: attachments.f95zone.to User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Cookie: __ddg1_=BPsLDfNaw2y2PkSnGrOv Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Sep 2023 05:31:13 GMT Content-Type: image/x-icon Content-Length: 15086 Last-Modified: Mon, 06 Jun 2022 08:22:44 GMT Connection: keep-alive Expires: Sat, 31 Aug 2024 05:31:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=15768000 Accept-Ranges: bytes`

	GET f95zone.to/sam/attachment_lock.php?cmd=info&id=1499698&file=Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip&_=1693546262824	190.115.31.182	200 OK	1.9 kB
URL GET HTTP/2 f95zone.to/sam/attachment_lock.php?cmd=info&id=1499698&file=Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip&_=1693546262824 IP 190.115.31.182:443 ASN #262254 DDOS-GUARD CORP. Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerLet's Encrypt Subjectf95zone.to Fingerprint2D:23:B2:88:2D:1C:1E:12:08:DF:DE:E6:18:54:4B:0E:14:99:C7:F0 ValiditySun, 27 Aug 2023 00:41:19 GMT - Sat, 25 Nov 2023 00:41:18 GMT File type troff or preprocessor input, ASCII text, with very long lines (1992), with no line terminators Size 1.9 kB (1859 bytes) Hash 9572ba08496d7aaa81e74703d66add83 5a5ea4d57643ab030753395d8cc1447365836b2a 1f3dc975653fc56bca41108e408b99e98d4a3a8e003a690c3edcaa53ff92aa04 HTTP Headers GET /sam/attachment_lock.php?cmd=info&id=1499698&file=Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip&_=1693546262824 HTTP/1.1 Host: f95zone.to User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: https://attachments.f95zone.to DNT: 1 Connection: keep-alive Cookie: __ddg1_=BPsLDfNaw2y2PkSnGrOv Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK server: ddos-guard content-security-policy: upgrade-insecure-requests; date: Fri, 01 Sep 2023 05:31:13 GMT content-type: application/json; charset=utf-8 vary: Accept-Encoding expires: Sun, 01 Jan 2014 00:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache access-control-allow-origin: https://attachments.f95zone.to access-control-allow-credentials: true strict-transport-security: max-age=15768000 content-encoding: gzip X-Firefox-Spdy: h2

	GET newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html	104.16.168.131	200 OK	1.7 kB
URL GET HTTP/3 newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1768), with no line terminators Size 1.7 kB (1725 bytes) Hash 3be9c1a612c518776da0344c9288092f 2f211523141f6554501f5d978b50cfeb8b8bdd51 fe6157e604b1176d374ebaca251d5b68629df29044c2406e0949a1116f8346ec HTTP Headers GET /captcha/v1/19148ad/static/hcaptcha.html HTTP/1.1 Host: newassets.hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: iframe Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/3 200 OK date: Fri, 01 Sep 2023 05:31:14 GMT content-type: text/html cf-ray: 7ffb20364e3db515-OSL cf-cache-status: HIT access-control-allow-origin: * age: 16197 cache-control: max-age=1209600 last-modified: Sun, 27 Aug 2023 01:46:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront) cross-origin-embedder-policy: credentialless cross-origin-resource-policy: cross-origin x-amz-cf-id: yyvNQPT5dO-ckkLAwsmcisQkNu7KNhjlzJnecqiFmhjiOwC_IamddQ== x-amz-cf-pop: OSL50-P1 x-amz-server-side-encryption: AES256 x-amz-version-id: l.ClyYLy53AwLH7lXI29IzygZco3RDj4 x-cache: Hit from cloudfront x-content-type-options: nosniff vary: Accept-Encoding server: cloudflare content-encoding: br alt-svc: h3=":443"; ma=86400

	GET newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html	104.16.168.131	200 OK	1.7 kB
URL GET HTTP/3 newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1768), with no line terminators Size 1.7 kB (1725 bytes) Hash 3be9c1a612c518776da0344c9288092f 2f211523141f6554501f5d978b50cfeb8b8bdd51 fe6157e604b1176d374ebaca251d5b68629df29044c2406e0949a1116f8346ec HTTP Headers GET /captcha/v1/19148ad/static/hcaptcha.html HTTP/1.1 Host: newassets.hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: iframe Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/3 200 OK date: Fri, 01 Sep 2023 05:31:14 GMT content-type: text/html cf-ray: 7ffb20364e3bb515-OSL cf-cache-status: HIT access-control-allow-origin: * age: 16197 cache-control: max-age=1209600 last-modified: Sun, 27 Aug 2023 01:46:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront) cross-origin-embedder-policy: credentialless cross-origin-resource-policy: cross-origin x-amz-cf-id: yyvNQPT5dO-ckkLAwsmcisQkNu7KNhjlzJnecqiFmhjiOwC_IamddQ== x-amz-cf-pop: OSL50-P1 x-amz-server-side-encryption: AES256 x-amz-version-id: l.ClyYLy53AwLH7lXI29IzygZco3RDj4 x-cache: Hit from cloudfront x-content-type-options: nosniff vary: Accept-Encoding server: cloudflare content-encoding: br alt-svc: h3=":443"; ma=86400

	GET newassets.hcaptcha.com/captcha/v1/19148ad/hcaptcha.js	104.16.168.131	200 OK	325 kB
URL GET HTTP/3 newassets.hcaptcha.com/captcha/v1/19148ad/hcaptcha.js IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html#frame=challenge&id=0pa4rewb39j&host=attachments.f95zone.to&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=b09475c1-5458-474c-8816-e35680876ab8&theme=dark&origin=https%3A%2F%2Fattachments.f95zone.to Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type Size 325 kB (324741 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /captcha/v1/19148ad/hcaptcha.js HTTP/1.1 Host: newassets.hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html Sec-Fetch-Dest: script Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/3 200 OK date: Fri, 01 Sep 2023 05:31:14 GMT content-type: application/javascript cf-ray: 7ffb20376ea4b515-OSL cf-cache-status: HIT access-control-allow-origin: * age: 256751 cache-control: max-age=1209600 etag: W/"9694a02ee9585e51c058b8e4ba0c520e" last-modified: Sun, 27 Aug 2023 01:46:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront) cross-origin-resource-policy: cross-origin x-amz-cf-id: 1n5EPTZzrC6yCT1JygrPTDh0mYgKGdjcH-BdrFXkfG_JX0OLc10WZQ== x-amz-cf-pop: OSL50-P1 x-amz-server-side-encryption: AES256 x-amz-version-id: 7y9TA.8w2RssRr3fYvHAmkSWfoBFlRkD x-cache: Hit from cloudfront x-content-type-options: nosniff vary: Accept-Encoding server: cloudflare content-encoding: br alt-svc: h3=":443"; ma=86400

	GET newassets.hcaptcha.com/captcha/v1/19148ad/hcaptcha.js	104.16.168.131	200 OK	325 kB
URL GET HTTP/3 newassets.hcaptcha.com/captcha/v1/19148ad/hcaptcha.js IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html#frame=checkbox&id=0pa4rewb39j&host=attachments.f95zone.to&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=b09475c1-5458-474c-8816-e35680876ab8&theme=dark&origin=https%3A%2F%2Fattachments.f95zone.to Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type Size 325 kB (324741 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /captcha/v1/19148ad/hcaptcha.js HTTP/1.1 Host: newassets.hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html Sec-Fetch-Dest: script Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/3 200 OK date: Fri, 01 Sep 2023 05:31:14 GMT content-type: application/javascript cf-ray: 7ffb20376ea6b515-OSL cf-cache-status: HIT access-control-allow-origin: * age: 256751 cache-control: max-age=1209600 etag: W/"9694a02ee9585e51c058b8e4ba0c520e" last-modified: Sun, 27 Aug 2023 01:46:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront) cross-origin-resource-policy: cross-origin x-amz-cf-id: 1n5EPTZzrC6yCT1JygrPTDh0mYgKGdjcH-BdrFXkfG_JX0OLc10WZQ== x-amz-cf-pop: OSL50-P1 x-amz-server-side-encryption: AES256 x-amz-version-id: 7y9TA.8w2RssRr3fYvHAmkSWfoBFlRkD x-cache: Hit from cloudfront x-content-type-options: nosniff vary: Accept-Encoding server: cloudflare content-encoding: br alt-svc: h3=":443"; ma=86400

	POST hcaptcha.com/checksiteconfig?v=19148ad&host=attachments.f95zone.to&sitekey=b09475c1-5458-474c-8816-e35680876ab8&sc=1&swa=1&spst=0	104.16.168.131	200 OK	682 B
URL POST HTTP/3 hcaptcha.com/checksiteconfig?v=19148ad&host=attachments.f95zone.to&sitekey=b09475c1-5458-474c-8816-e35680876ab8&sc=1&swa=1&spst=0 IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html#frame=challenge&id=0pa4rewb39j&host=attachments.f95zone.to&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=b09475c1-5458-474c-8816-e35680876ab8&theme=dark&origin=https%3A%2F%2Fattachments.f95zone.to Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type troff or preprocessor input, ASCII text, with very long lines (696), with no line terminators Size 682 B (682 bytes) Hash 4ab5de9192d029d466704d741d75373b c7f1d7b5a2f4e5c97c81ce8dd2a6952778877d63 4d17fe0d612362383c9a4a53dd7c24f5f16365fb5466f01f687b5dc1cb0508d5 HTTP Headers POST /checksiteconfig?v=19148ad&host=attachments.f95zone.to&sitekey=b09475c1-5458-474c-8816-e35680876ab8&sc=1&swa=1&spst=0 HTTP/1.1 Host: hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: text/plain Origin: https://newassets.hcaptcha.com DNT: 1 Connection: keep-alive Referer: https://newassets.hcaptcha.com/ Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Pragma: no-cache Cache-Control: no-cache Content-Length: 0 HTTP/3 200 OK date: Fri, 01 Sep 2023 05:31:14 GMT content-type: application/json access-control-allow-origin: https://newassets.hcaptcha.com vary: Origin, Accept-Encoding access-control-allow-credentials: true access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path access-control-allow-methods: GET, HEAD, POST, OPTIONS cf-chl-bypass: 2 strict-transport-security: max-age=31536000; includeSubDomains; preload x-content-type-options: nosniff server: cloudflare cf-ray: 7ffb20396fbeb515-OSL content-encoding: br alt-svc: h3=":443"; ma=86400

	GET js.hcaptcha.com/1/api.js?render=explicit	104.16.168.131	200 OK	325 kB
URL GET HTTP/2 js.hcaptcha.com/1/api.js?render=explicit IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://attachments.f95zone.to/2021/10/1499698_Dohna.Dohna.v1.0-v1.01.Plus.7.Trainer-FLiNG.zip Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type Size 325 kB (324741 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /1/api.js?render=explicit HTTP/1.1 Host: js.hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK date: Fri, 01 Sep 2023 05:31:13 GMT content-type: application/javascript cf-ray: 7ffb20327b1b56a5-OSL cf-cache-status: HIT age: 0 cache-control: max-age=120 etag: W/"9694a02ee9585e51c058b8e4ba0c520e" last-modified: Sun, 27 Aug 2023 01:46:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 98794c1dec0d4e7b10ddf0faa094cf94.cloudfront.net (CloudFront) cross-origin-resource-policy: cross-origin x-amz-cf-id: 1Za9-PpW_3QZTBJYpmgZUdCk-RnPcZswxpowHyS9mACs2JvBKkxcDA== x-amz-cf-pop: OSL50-P1 x-amz-server-side-encryption: AES256 x-amz-version-id: 7y9TA.8w2RssRr3fYvHAmkSWfoBFlRkD x-cache: Hit from cloudfront x-content-type-options: nosniff vary: Accept-Encoding server: cloudflare content-encoding: br alt-svc: h3=":443"; ma=86400 X-Firefox-Spdy: h2

	GET newassets.hcaptcha.com/c/6f48ffb/hsw.js	104.16.168.131	200 OK	581 kB
URL GET HTTP/3 newassets.hcaptcha.com/c/6f48ffb/hsw.js IP 104.16.168.131:443 ASN #13335 CLOUDFLARENET Requested by https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html#frame=challenge&id=0pa4rewb39j&host=attachments.f95zone.to&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&pstissuer=https%3A%2F%2Fpst-issuer.hcaptcha.com&sitekey=b09475c1-5458-474c-8816-e35680876ab8&theme=dark&origin=https%3A%2F%2Fattachments.f95zone.to Certificate IssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintD9:E8:78:82:B2:9B:0F:1B:5F:0B:B7:EF:93:24:6D:07:2D:83:BA:24 ValiditySat, 15 Apr 2023 00:00:00 GMT - Sun, 14 Apr 2024 23:59:59 GMT File type Size 581 kB (581248 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /c/6f48ffb/hsw.js HTTP/1.1 Host: newassets.hcaptcha.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://newassets.hcaptcha.com/captcha/v1/19148ad/static/hcaptcha.html Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` HTTP/3 200 OK date: Fri, 01 Sep 2023 05:31:14 GMT content-type: application/javascript cf-ray: 7ffb2039bfe9b515-OSL cf-cache-status: HIT access-control-allow-origin: * age: 15983 cache-control: max-age=3024000 etag: W/"decfec72ea568f718c9ec5c986c38e43" last-modified: Thu, 24 Aug 2023 15:06:48 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 b2b04ca80b95df6bc86478a1bf96b7cc.cloudfront.net (CloudFront) cross-origin-resource-policy: cross-origin x-amz-cf-id: EPpD-4z4PC_SNn5iXliHUn5cuQWDz2dAnElezmd5FcWmVxInQkeqOg== x-amz-cf-pop: OSL50-P1 x-amz-server-side-encryption: AES256 x-amz-version-id: HZtuLao5UkkNspTf_iL2gOUWfmw0tBJZ x-cache: Hit from cloudfront x-content-type-options: nosniff vary: Accept-Encoding server: cloudflare content-encoding: br alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN