Report - lysyvan.com/deq.com/login.phpTemp

Report Overview

Visited public
2025-05-08 05:46:24
Tags
URL
lysyvan.com/deq.com/login.phpTemp
Finishing URL
lysyvan.com/deq.com/login.phpTemp
IP / ASN
104.21.16.1
#13335 CLOUDFLARENET
Title
Page Not Found

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
lysyvan.com	unknown	2011-08-15	2013-02-07	2025-05-02	3.9 kB	40 kB	104.21.96.1
static.cloudflareinsights.com	1294	2019-08-30	2019-09-24	2025-05-07	500 B	20 kB	104.16.79.73

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed
2025-05-08	medium	lysyvan.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	ScriptElement	8.4 kB	2025-05-08	2025-05-08
Pretty URL lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 104.21.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-08 05:46 Last Seen2025-05-08 05:46 Times Seen1 Hash c5265922920f30d8b76077717be89003 d46f77f4ca10473357c5cb30130f083e4dcbdea7 fd1df7c59f47c53c47e81715405fbb4227289d671a812aecf5c86393f96d8f45 Loading...

	lysyvan.com/deq.com/login.phpTemp	ScriptElement	921 B	2025-05-08	2025-05-08
Pretty URL lysyvan.com/deq.com/login.phpTemp IP 104.21.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-08 05:46 Last Seen2025-05-08 05:46 Times Seen1 Hash 4c3aa40dde0c6a4fc673ecc09f8d717d 5998303e31e4577bcf3b2d9fd6933b1d507f78db a40356434926dcc55c511f6887761a02edd5fabb589301f9b2b5da2c75c14683 Loading...

	about:blank	ScriptElement	236 B	2025-05-08	2025-05-08
Pretty URL about:blank IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-08 05:46 Last Seen2025-05-08 05:46 Times Seen1 Hash 2d051126217554bf373612aa1c07bf3d cbf574a3aee2a9ec879d3f374743e10e64154d77 04ae22f8ddf877efea6e4925b5301dd07b4acb04d5a6e8031ef0bb4862bf4d06 Loading...

	static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015	ScriptElement	20 kB	2024-06-07	2025-05-16
Pretty URL static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 IP 104.16.79.73 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-06-07 09:21 Last Seen2025-05-16 03:19 Times Seen50516 Hash ec18af6d41f6f278b6aed3bdabffa7bc 62c9e2cab76b888829f3c5335e91c320b22329ae 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f Loading...

HTTP Transactions (9)

URL IP Response Size

lysyvan.com/deq.com/login.phpTemp

104.21.96.1

301 Moved Permanently

4.3 kB

URL User Request GET
lysyvan.com/deq.com/login.phpTemp
IP
104.21.96.1:80
ASN
#13335 CLOUDFLARENET

File type

Size
4.3 kB (4319 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /deq.com/login.phpTemp HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Thu, 08 May 2025 05:45:52 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 08 May 2025 06:45:52 GMT
Location: https://lysyvan.com/deq.com/login.phpTemp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FfAGseLeVKfi4H93cuWuRqk%2BcwSEpWDZdi%2BhhTZnMAxGp9gAtIaNX7%2FQm2vCg%2FC4IEnYibUkIEoYrWtVV7fjKjPzhdHBdyC%2B2MjZI3DeYeyaFEyLo0L8duFb5tKx5w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 93c6a7482c97568a-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=756&min_rtt=756&rtt_var=378&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=417&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

lysyvan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?

104.21.96.1

200 OK

8.4 kB

URL GET
lysyvan.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/deq.com/login.phpTemp
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
JavaScript source, ASCII text, with very long lines (8392), with no line terminators
Size
8.4 kB (8392 bytes)
Hash
c5265922920f30d8b76077717be89003
d46f77f4ca10473357c5cb30130f083e4dcbdea7
fd1df7c59f47c53c47e81715405fbb4227289d671a812aecf5c86393f96d8f45

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js? HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 08 May 2025 05:45:53 GMT
content-type: application/javascript; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9vkr3civtyYS5ESwnwsS8TEvy3BQeJgObJYjoMFVP5UuuH2UVmUb%2F8V%2FRq96pEVlE7bPgdL0f8DtvsY%2BqM4KdlFGs%2BFVu0ROW%2BBtEo3%2BdJdjtjE6BCNNEZRaZH6oyg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
content-encoding: br
cf-ray: 93c6a74b4d76b4f3-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3079&min_rtt=721&rtt_var=1861&sent=155&recv=263&lost=0&retrans=0&sent_bytes=12276&recv_bytes=16438&delivery_rate=23057&cwnd=12000&unsent_bytes=0&cid=3d6e3a4ea0d57116&ts=678&x=16"

lysyvan.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.8853822745179051:1746681010:euf6FqCC_Xz1Dv37qO6rkPAioScW59KhfwXYpL7Tm1o/93c6a7485e680b55

104.21.96.1

200 OK

0 B

URL POST
lysyvan.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.8853822745179051:1746681010:euf6FqCC_Xz1Dv37qO6rkPAioScW59KhfwXYpL7Tm1o/93c6a7485e680b55
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/deq.com/login.phpTemp
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.8853822745179051:1746681010:euf6FqCC_Xz1Dv37qO6rkPAioScW59KhfwXYpL7Tm1o/93c6a7485e680b55 HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 12090
Origin: https://lysyvan.com
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/deq.com/login.phpTemp
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 08 May 2025 05:45:53 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yjtqU34dW1o00gKd%2FI4uSFfZ%2BkIhS9kGHpWPYEtRFQidQrPMApnOZJhv3Xbotx2I4NWawKsKaS1dggD1jxe7C0J6joRfftWmTGesqVwkXz5139Yv6O35ZTAqcm4ftg%3D%3D"}],"group":"cf-nel","max_age":604800}
set-cookie: cf_clearance=vS0V4sQBTjSkHMwfu2j5lKurHyRLAvzzd2ry4Le.pi0-1746683153-1.2.1.1-clFbUegTqRacmCnEg0zp8VUDFXaQupLSyNhSeAZsT64muGZukUix1_.wiuYmA_TWHWTB5cZ.poOdTb9XKFfIFO6deIjkBnPhRwXSdZe7vZ7khNdyCf2HR7lWyQjCGqxrH8YhhPPcxsKmjnHSddGbqU45yGO96W2rvJ8PK5srsk9AOqfJQODg5D8rscvu9R914BWTXG9pb3fuA1f18U_g0udE.rPyiLigWCxD3HOkdHwM1bRBllFxatDG.cVDvtZbGm.ei3YuWCQJQtNLYmYmz398XNtM75SQ0hf0iYbvVp31_qYcCbMe3Y93fL3tfPBlrDDRtRb82xpJQnHhYaxVvM1ZIlFdrvCxCDBgqvOaisQ; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=lysyvan.com; Expires=Fri, 08 May 2026 05:45:53 GMT
cf-ray: 93c6a74c4d8fb4f3-OSL
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2853&min_rtt=721&rtt_var=1847&sent=165&recv=274&lost=0&retrans=0&sent_bytes=17091&recv_bytes=29339&delivery_rate=395526&cwnd=12000&unsent_bytes=0&cid=3d6e3a4ea0d57116&ts=842&x=16"

lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.96.1

302 Found

8.4 kB

URL GET
lysyvan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/deq.com/login.phpTemp
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type

Size
8.4 kB (8392 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 302 Found
date: Thu, 08 May 2025 05:45:53 GMT
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i0DUfjuLOHFD00KLqIAK00nvaUvzjtlHasTdehoWLGrBa%2B1YWpTy8Web1pf7VcK7h8FSGkIh77%2ByzSIeP80A1FuKBwrLU8DQ2VbFCx4skXYdlSLYrHRDbrTkj3cI2A%3D%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
cf-ray: 93c6a74b0d6db4f3-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3222&min_rtt=721&rtt_var=2100&sent=153&recv=261&lost=0&retrans=0&sent_bytes=11555&recv_bytes=16129&delivery_rate=2507&cwnd=12000&unsent_bytes=0&cid=3d6e3a4ea0d57116&ts=655&x=16"

lysyvan.com/cdn-cgi/rum?

104.21.96.1

204 No Content

0 B

URL POST
lysyvan.com/cdn-cgi/rum?
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/deq.com/login.phpTemp
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/rum? HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
content-type: application/json
Content-Length: 1348
Origin: https://lysyvan.com
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/deq.com/login.phpTemp
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 204 No Content
date: Thu, 08 May 2025 05:45:53 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://lysyvan.com
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 93c6a74b1d71b4f3-OSL
x-frame-options: DENY

lysyvan.com/deq.com/login.phpTemp

104.21.96.1

404 Not Found

4.3 kB

URL User Request GET
lysyvan.com/deq.com/login.phpTemp
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
HTML document, ASCII text, with very long lines (1421)
Size
4.3 kB (4319 bytes)
Hash
af73853fef1d28bcba763326b80076d9
f5e00927a48c5f703f0faaa87b09a7dfd2b7443e
21f63775831bc1f067ce57f798a3f3afd4c845626eda8ba12cc214342664c30d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /deq.com/login.phpTemp HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Thu, 08 May 2025 05:45:52 GMT
content-type: text/html; charset=utf-8
cf-ray: 93c6a7458aa40b55-OSL
server: cloudflare
content-encoding: br
vary: Accept-Encoding
last-modified: Mon, 10 Mar 2025 09:59:17 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IL%2F6Ajoj%2BhzKVqZ%2BhIFdLC5%2FB9Cjd3VPYLDiY4jfw4Y%2FBE5Z1MIi11Mjavfr4dOiQs7LLjv35iLhIOXWuKwLKhfCiji%2BkeCvCUCDYbkFP0kyu%2FQr%2BYUAOT7v6QoZZg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="DYNAMIC", cfL4;desc="?proto=TCP&rtt=5925&min_rtt=455&rtt_var=10666&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3274&recv_bytes=1262&delivery_rate=3328735&cwnd=254&unsent_bytes=0&cid=efc50ed4ddecbdf0&ts=258&x=0"
X-Firefox-Spdy: h2

lysyvan.com/deq.com/login.phpTemp

104.21.96.1

404 Not Found

4.3 kB

URL User Request GET
lysyvan.com/deq.com/login.phpTemp
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
HTML document, ASCII text, with very long lines (1421)
Size
4.3 kB (4319 bytes)
Hash
1350741d4d6c3b3538dd1bcadbe032da
49383ff64c78ca9d68095b9e0a59e3cd476f8434
b5e4b472f6e349cc29734f20c861c3ee64aa0df82606c7f4e9bff2795762729f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /deq.com/login.phpTemp HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Thu, 08 May 2025 05:45:52 GMT
content-type: text/html; charset=utf-8
cf-ray: 93c6a7485e680b55-OSL
server: cloudflare
content-encoding: br
vary: Accept-Encoding
last-modified: Mon, 10 Mar 2025 09:59:17 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QaOEAhixUwiD9GAbRFJfQb7cYv1NoFV42CMi%2F0OpZtOxglFh1E%2BHhvHk2D4E4f%2BWW7B6WAOYf310vYOzMcut9s901bsmsRLkjr9B5nSJ%2FLa3EIJ6qHD5W%2ByXpPd1mA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="DYNAMIC", cfL4;desc="?proto=TCP&rtt=3243&min_rtt=378&rtt_var=5574&sent=14&recv=17&lost=0&retrans=0&sent_bytes=6120&recv_bytes=1344&delivery_rate=9770580&cwnd=257&unsent_bytes=0&cid=efc50ed4ddecbdf0&ts=691&x=0"
X-Firefox-Spdy: h2

static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

104.16.79.73

200 OK

20 kB

URL GET
static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
IP
104.16.79.73:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/deq.com/login.phpTemp
Certificate
IssuerGoogle Trust Services
Subjectcloudflareinsights.com
FingerprintEA:C7:0D:68:3A:45:CB:AD:C5:33:41:B6:DF:F1:60:64:E1:0F:52:6A
ValiditySun, 27 Apr 2025 18:18:02 GMT - Sat, 26 Jul 2025 19:17:55 GMT

File type
JavaScript source, ASCII text, with very long lines (19948), with no line terminators
Size
20 kB (19948 bytes)
Hash
ec18af6d41f6f278b6aed3bdabffa7bc
62c9e2cab76b888829f3c5335e91c320b22329ae
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

HTTP Headers

GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://lysyvan.com
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 08 May 2025 05:45:53 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.6.1"
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 93c6a74a8cb7b511-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

lysyvan.com/favicon.ico

104.21.96.1

404 Not Found

2.9 kB

URL GET
lysyvan.com/favicon.ico
IP
104.21.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lysyvan.com/deq.com/login.phpTemp
Certificate
IssuerGoogle Trust Services
Subjectlysyvan.com
Fingerprint4C:F2:3C:EA:CB:A8:9D:AE:5A:1C:3E:75:BB:78:AF:EA:B5:E3:96:D1
ValidityMon, 10 Mar 2025 10:16:08 GMT - Sun, 08 Jun 2025 11:14:38 GMT

File type
HTML document, ASCII text, with very long lines (634)
Size
2.9 kB (2898 bytes)
Hash
f01ba522c3539135df33250082846848
af31de06cf3d07cf83f104af8755b0cc5222ffc6
2e8deb28946a6b41ccb927eaa43bbaa78ea82cef39a40638f2e5afa8e90e73ca

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lysyvan.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lysyvan.com/deq.com/login.phpTemp
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Thu, 08 May 2025 05:45:53 GMT
content-type: text/html; charset=utf-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UAlUBXzpPKbNlxMbeTrAb5tIxy4Wd7PWf2UEAfz0fTxwP9u2QHpLiwFvb8R2AHjeTKyO6J188dXu43ctArHndkkLPUTnVrBV0lEplDGPPH0OO4OYPdlDHYsiLz5WOA%3D%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
last-modified: Mon, 10 Mar 2025 09:59:17 GMT
cache-control: max-age=14400
cf-cache-status: HIT
content-encoding: br
cf-ray: 93c6a74afd6cb4f3-OSL
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2638&min_rtt=721&rtt_var=1815&sent=166&recv=275&lost=0&retrans=0&sent_bytes=18095&recv_bytes=29384&delivery_rate=29117&cwnd=12000&unsent_bytes=0&cid=3d6e3a4ea0d57116&ts=865&x=16"

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL POST

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL POST