Report - bunkr.si/d/Fakes-FFtHJJUF.zip

Report Overview

Visited public
2024-05-09 00:19:45
Tags
URL
bunkr.si/d/Fakes-FFtHJJUF.zip
Finishing URL
bunkr.si/d/Fakes-FFtHJJUF.zip
IP / ASN
172.67.198.103
#13335 CLOUDFLARENET
Title
Fakes-FFtHJJUF.zip | Bunkr

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
fonts.bunny.net	unknown	1999-11-22	2022-03-21 08:38:02	2024-05-08 19:32:54	1.4 kB	40 kB	194.242.11.186
bestadsforyou.com	unknown	2024-05-03	2020-09-07 02:09:48	2023-09-27 03:18:48	1.9 kB	440 kB	212.117.190.203
3zap7emt4.com	unknown	unknown	No data	No data	1.2 kB	49 kB	212.117.190.201
static.bunkr.ru	unknown	2022-08-25	2022-12-21 18:18:10	2024-05-04 07:37:45	432 B	5.3 kB	194.242.11.186
bunkr.si	unknown	2023-10-13	2024-01-25 17:06:27	2024-04-18 07:21:42	3.0 kB	528 kB	104.21.76.180
ha.vindexmesode.com	unknown	2024-04-12	2024-05-04 07:37:43	2024-05-04 07:37:44	410 B	1.5 kB	23.109.170.60
core-apps.b-cdn.net	unknown	2016-04-25	2024-02-13 19:52:44	2024-05-04 07:37:43	866 B	2.8 kB	138.199.36.8
stats.bunkr.ru	unknown	2022-08-25	2023-09-15 15:51:42	2024-05-04 07:37:45	493 B	7.7 kB	186.2.163.65
cdn.cloudfrale.com	55750	2019-02-04	2019-02-06 17:01:05	2024-05-08 11:07:05	503 B	330 kB	45.133.44.20
bunkr.sk	unknown	2023-04-07	2023-04-08 08:12:16	2024-05-04 07:37:44	865 B	2.9 kB	172.67.148.56

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-08	medium	vindexmesode.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	bunkr.si/d/Fakes-FFtHJJUF.zip	ScriptElement	12 kB	2024-04-29	2024-08-20
Pretty URL bunkr.si/d/Fakes-FFtHJJUF.zip IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-29 18:22 Last Seen2024-08-20 01:57 Times Seen192 Hash 43c40db1b9e225bd171b14864ec4f37a 21d0ec01435da2fa226b63d0602969ed410586e8 3a0370d648947c374a206c21f3a2207cdac0bea15253541033e61b6c29d66d4a Loading...

	bunkr.sk/build/asdajklsdashjdasjk.js	ScriptElement	1.9 kB	2023-03-29	2024-10-23
Pretty URL bunkr.sk/build/asdajklsdashjdasjk.js IP 172.67.148.56 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-29 23:14 Last Seen2024-10-23 02:38 Times Seen1225 Hash 04b167ddf20d05b150c6d588ef2083c7 cf7092520fa2a72b0fcc15ebd47e3dce3e481e8a e462dc4caca4b1590bb1f01a2a97b9940bf6d933b13320ba0bb2114d692db16e Loading...

	bestadsforyou.com/aas/r45d/vki/2021505/b58b1c0e.js	ScriptElement	106 kB	2024-05-06	2024-08-20
Pretty URL bestadsforyou.com/aas/r45d/vki/2021505/b58b1c0e.js IP 212.117.190.203 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-06 16:05 Last Seen2024-08-20 00:23 Times Seen27 Hash 8645c18701dff4fd8ec637dd356c3601 c0c151a08eb933c46e69e75ce1358c47047f22ba 7ac37f2a21397633f19f4b10941cb219c148b403e16f2904c46e27a7d3eca0ad Loading...

	bestadsforyou.com/get/2021505?zoneid=2021505&jp=_clxtddfxh8p33pwcuw0274&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1&uf=0	ScriptElement	2.9 kB	2024-08-19	2024-08-19
Pretty URL bestadsforyou.com/get/2021505?zoneid=2021505&jp=_clxtddfxh8p33pwcuw0274&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1&uf=0 IP 212.117.190.203 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-08-19 23:44 Last Seen2024-08-19 23:44 Times Seen1 Hash 626dbde5faa1d8f8954c289d814fb7db 4e5c8d4b1187952858ff7a8bbd7883e46e343db9 c0c9cb452a1eb86ebb77c1a8f180c5b3d2f6bc55be0b9593d5c4b7fa6d55fc00 Loading...

	bunkr.si/d/Fakes-FFtHJJUF.zip	ScriptElement	530 B	2024-03-01	2025-01-04
Pretty URL bunkr.si/d/Fakes-FFtHJJUF.zip IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-01 23:57 Last Seen2025-01-04 15:31 Times Seen601 Hash e35eb2bf082d7150bb7c9617a7a243ee 6e214cf81a60cb9eb2f5177d0c785ea307d3fe7b cfe98ba406beb84b47e7cd8601c9e2c1e169f211f55d216a6259ef0b4dc9b01d Loading...

	bunkr.si/d/Fakes-FFtHJJUF.zip	ScriptElement	974 B	2024-03-01	2025-01-04
Pretty URL bunkr.si/d/Fakes-FFtHJJUF.zip IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-01 23:57 Last Seen2025-01-04 15:31 Times Seen593 Hash c5666b9eb2fe52c48dac03d3fabfd56c d80e474a831fb5cc64bf316172342fe5787f9bee 5244a79dda19e1c3bd536f264ea1f306df9537676f40d28819cb244e8493de91 Loading...

	bunkr.si/build/app.291ea157.js	ScriptElement	3.1 kB	2023-03-13	2025-01-06
Pretty URL bunkr.si/build/app.291ea157.js IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 17:21 Last Seen2025-01-06 13:47 Times Seen1445 Hash 5c41d9cf3409695f2ff381e38f12fb95 a948d817c8b815d1e9a08bfeb9a1c07c9103a615 df0d317f430aac3ef6ed4c0a30eef09858699eef77a07649c33094e126fc0aeb Loading...

	3zap7emt4.com/lv/esnk/2021517/code.js	ScriptElement	116 kB	2024-05-03	2024-08-20
Pretty URL 3zap7emt4.com/lv/esnk/2021517/code.js IP 212.117.190.201 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-03 03:50 Last Seen2024-08-20 01:05 Times Seen44 Hash e9ef275e0826f7c4ae1d2cf9600a9c4b b4462cd70aef0b9a343c93027e7fe2ba78bb003d 3db5522744660a08a206d80f35e0d488c2ac9c6bac3d3fde1018d044f3904822 Loading...

	bunkr.si/d/Fakes-FFtHJJUF.zip	ScriptElement	118 B	2023-03-13	2024-10-18
Pretty URL bunkr.si/d/Fakes-FFtHJJUF.zip IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 17:21 Last Seen2024-10-18 01:46 Times Seen1388 Hash 5b56f956173922524d906bee2b8b9a56 e9c3897e5b8f0beadaa8892b0d00ccd82a5e23e9 c8e72cd7a3675799efc2b168895b388593219fb0e18813eee1d0ca4dd50c6175 Loading...

	core-apps.b-cdn.net/js/script.js	ScriptElement	1.3 kB	2023-05-22	2025-06-24
Pretty URL core-apps.b-cdn.net/js/script.js IP 138.199.36.8 ASN #60068 Datacamp Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-22 17:22 Last Seen2025-06-24 22:14 Times Seen5066 Hash abd4e2373b2e8c4dac2e80159641c5f1 e273656e58ca934d873204e68dd35670fde657ed 021f0fd27042b279a49e982215c6dc3c3ab84e95b35553a119dfdbd50af6be94 Loading...

	3zap7emt4.com/get/2021517?zoneid=2021517&jp=_cl186t4hhtse2vgzfdlv5f&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=2364208075789824&eclog=0&im=1&freq=0&uf=0	ScriptElement	4.2 kB	2024-08-19	2024-08-19
Pretty URL 3zap7emt4.com/get/2021517?zoneid=2021517&jp=_cl186t4hhtse2vgzfdlv5f&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=2364208075789824&eclog=0&im=1&freq=0&uf=0 IP 212.117.190.201 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-08-19 23:44 Last Seen2024-08-19 23:44 Times Seen1 Hash 4075b583249c0f017a6f87f06f19d086 c3fb6ed3bc4854daf5fe33a850582f45c1a3b043 2d8121a6a1267b803a9ef2b2bc9647bce091554b34ae0e39e571be94114eb118 Loading...

	bunkr.si/build/runtime.9a71ee5d.js	ScriptElement	1.4 kB	2023-05-08	2025-06-24
Pretty URL bunkr.si/build/runtime.9a71ee5d.js IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-08 12:47 Last Seen2025-06-24 19:16 Times Seen1453 Hash 1f667bac66ff97a3b30bf628c79b6e82 0f6fef8cca58b9e33e67e0d02b470ff3a45a0972 7ac8f192ba7190dcf6a08cdf8d8642cdfb86d1710478a51634bc1d88fdb1cd67 Loading...

	bunkr.si/build/370.a4405777.js	ScriptElement	458 kB	2023-05-08	2025-01-06
Pretty URL bunkr.si/build/370.a4405777.js IP 104.21.76.180 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-08 12:47 Last Seen2025-01-06 13:47 Times Seen1445 Hash 79ed4be5936705a7cf87602db7e144a2 2bc50d1e98bc9bcdde8829c1a95894b68f37cc9c 82845b94a737f10b85fe113ac6819b03e4dba508ee1a5f88cf3c53a42ad63167 Loading...

	ha.vindexmesode.com/fo8T0m73473LZ95rd/54083	ScriptElement	6 B	2023-03-07	2025-06-24
Pretty URL ha.vindexmesode.com/fo8T0m73473LZ95rd/54083 IP 23.109.170.60 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:31 Last Seen2025-06-24 23:27 Times Seen8674 Hash 4fc71bf68a1d477bd1523733e34d1e90 15119105cffbe108b6cf290146ab02c9aa8517ba 74c1971a5c7f3f1cfb81b7a0a8717cee5a45841844104566e00bbfca271943ce Loading...

HTTP Transactions (23)

URL IP Response Size

GET bunkr.si/build/runtime.9a71ee5d.js

104.21.76.180

200 OK

1.3 kB

URL GET HTTP/3
bunkr.si/build/runtime.9a71ee5d.js
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type
JavaScript source, ASCII text, with very long lines (1405), with no line terminators
Size
1.3 kB (1276 bytes)
Hash
1f667bac66ff97a3b30bf628c79b6e82
0f6fef8cca58b9e33e67e0d02b470ff3a45a0972
7ac8f192ba7190dcf6a08cdf8d8642cdfb86d1710478a51634bc1d88fdb1cd67

HTTP Headers

GET /build/runtime.9a71ee5d.js HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/d/Fakes-FFtHJJUF.zip
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
last-modified: Sun, 25 Feb 2024 03:19:51 GMT
vary: Accept-Encoding
etag: W/"65dab1d7-57d"
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 2548
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fg%2BTmrbAr9ZBYVLRYKA2mhbsP6G%2BYNldwkZWdQ7LYi%2F8EGv4o%2BbxDHp9%2F6t9Ck74L3CPgJV3QgTznNOmJ%2BJA7Qr%2BiWcY3Qx5xNOlwjT54p8ajWv%2Fgk2BvEZf4w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84721cb3b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET fonts.bunny.net/rubik/files/rubik-latin-700-normal.woff2

194.242.11.186

200 OK

18 kB

URL GET HTTP/2
fonts.bunny.net/rubik/files/rubik-latin-700-normal.woff2
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerLet's Encrypt
Subjectfonts.bunny.net
FingerprintCB:89:86:8E:6D:0A:E5:60:AF:D4:50:FD:A4:62:99:B4:6C:13:A7:1F
ValidityTue, 09 Apr 2024 10:09:28 GMT - Mon, 08 Jul 2024 10:09:27 GMT

File type
Web Open Font Format (Version 2), TrueType, length 18324, version 1.0
Size
18 kB (18324 bytes)
Hash
286d2a8ef294d191f39b9c8cfaa1d2fd
5ce722761250fbccd6f3dedbdee4f7556cefc576
68b1a58930568f827748c48162e8c1a9d3305f6e3567286604151820f21dd010

HTTP Headers

GET /rubik/files/rubik-latin-700-normal.woff2 HTTP/1.1
Host: fonts.bunny.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://bunkr.si
DNT: 1
Connection: keep-alive
Referer: https://fonts.bunny.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: font/woff2
content-length: 18324
server: BunnyCDN-NO1-830
cdn-pullzone: 781720
cdn-uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
cdn-requestcountrycode: NO
access-control-allow-origin: *
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=2592000
etag: "64a64286-4794"
last-modified: Thu, 06 Jul 2023 04:26:46 GMT
cdn-storageserver: SE-582
cdn-fileserver: 344
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 04/30/2024 17:49:35
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: dd7261f3fcef9bfea6b034ec150ab814
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET fonts.bunny.net/css?family=rubik:400,700

194.242.11.186

200 OK

1.1 kB

URL GET HTTP/2
fonts.bunny.net/css?family=rubik:400,700
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerLet's Encrypt
Subjectfonts.bunny.net
FingerprintCB:89:86:8E:6D:0A:E5:60:AF:D4:50:FD:A4:62:99:B4:6C:13:A7:1F
ValidityTue, 09 Apr 2024 10:09:28 GMT - Mon, 08 Jul 2024 10:09:27 GMT

File type
ASCII text
Size
1.1 kB (1072 bytes)
Hash
f7aa928435bc7e44a73049721426810c
5c9e845a545addf1e63c7469574f080dc5cb7a3d
eb7c7f00a30548036a7323921ee7ac4de4e8e0b244cd84c07ae7da6ea35bba07

HTTP Headers

GET /css?family=rubik:400,700 HTTP/1.1
Host: fonts.bunny.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
server: BunnyCDN-NO1-830
cdn-pullzone: 781720
cdn-uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
cdn-requestcountrycode: NO
access-control-allow-origin: *
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=2592000
last-modified: Tue, 23 Apr 2024 18:47:36 GMT
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 04/23/2024 18:47:36
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 387a0b3cdd72974e712137dc811ad2ee
cdn-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2

GET bunkr.si/build/app.26f3607a.css

104.21.76.180

200 OK

30 kB

URL GET HTTP/3
bunkr.si/build/app.26f3607a.css
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type
ASCII text, with very long lines (65472)
Size
30 kB (29972 bytes)
Hash
4b302a3816687daf7f82abd20c9b15e9
247cab2f4f48cefda9e6d535fd113747a2537235
810bb9972bbb8daab52bee77d27c074055067af69bc3d542f56fcc7d36c8a271

HTTP Headers

GET /build/app.26f3607a.css HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/d/Fakes-FFtHJJUF.zip
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/css
last-modified: Sun, 25 Feb 2024 03:19:51 GMT
vary: Accept-Encoding
etag: W/"65dab1d7-106b0"
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 7149
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XrwogjqcPBcKeww3Z0xlKgdchPESC3L9AX8ILHbSJUAKQueq4z6%2Fu67MEbHT2031s0lrLfiUVc9DtnKUV21Fc6p%2B2ul2YdfLT4nx7ysBiotMbboE5umn0IFe8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84721cb1b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET bunkr.sk/build/asdajklsdashjdasjk.js

172.67.148.56

301 Moved Permanently

1.5 kB

URL GET HTTP/2
bunkr.sk/build/asdajklsdashjdasjk.js
IP
172.67.148.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.sk
Fingerprint3F:38:25:40:00:68:62:98:61:AF:86:E0:70:29:4E:E5:04:C9:C6:6B
ValidityThu, 28 Mar 2024 09:11:53 GMT - Wed, 26 Jun 2024 09:11:52 GMT

File type
data
Size
1.5 kB (1485 bytes)
Hash
6d18dd9f40b74f541b205665ae75f216
7a6fe674022f37af342ca60ed373f931430e2692
71ee593035d64ca114c065930d06b0a544d1c6cb8c76717f68c28d8445f9f51e

HTTP Headers

GET /build/asdajklsdashjdasjk.js HTTP/1.1
Host: bunkr.sk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/html
location: https://bunkr.si/build/asdajklsdashjdasjk.js
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 886
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2SxGb10vhMvR5No%2BVQkzQrqMSVlzocCbewCGpJP9Gg4Yh5Cvw4M7NahLw0MY6O4Cv4rAtA%2FcAwo6D74pQ5vQClUJ5rVBKwQ6Kgg4D2svDu0mkzgHh67AnwNliA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880d84728e8eb4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET ha.vindexmesode.com/fo8T0m73473LZ95rd/54083

23.109.170.60

200 OK

26 B

URL GET HTTP/1.1
ha.vindexmesode.com/fo8T0m73473LZ95rd/54083
IP
23.109.170.60:443
ASN
#7979 SERVERS-COM

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerLet's Encrypt
Subjectha.vindexmesode.com
FingerprintAF:C9:80:35:4B:15:BA:16:14:6F:6B:52:60:F1:B0:34:0F:34:B6:AC
ValidityFri, 12 Apr 2024 12:34:04 GMT - Thu, 11 Jul 2024 12:34:03 GMT

File type
ASCII text, with no line terminators
Size
26 B (26 bytes)
Hash
4fc71bf68a1d477bd1523733e34d1e90
15119105cffbe108b6cf290146ab02c9aa8517ba
74c1971a5c7f3f1cfb81b7a0a8717cee5a45841844104566e00bbfca271943ce

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fo8T0m73473LZ95rd/54083 HTTP/1.1
Host: ha.vindexmesode.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 09 May 2024 00:19:20 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://bunkr.si
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Fri, 10-May-2024 00:19:20 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Fri, 10-May-2024 00:19:20 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

POST core-apps.b-cdn.net/api/event

138.199.36.8

202 Accepted

2 B

URL POST HTTP/2
core-apps.b-cdn.net/api/event
IP
138.199.36.8:443
ASN
#60068 Datacamp Limited

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
2 B (2 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

HTTP Headers

POST /api/event HTTP/1.1
Host: core-apps.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
Content-Type: text/plain
Content-Length: 87
Origin: https://bunkr.si
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 202 Accepted
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/plain; charset=utf-8
content-length: 2
server: BunnyCDN-DE1-1048
cdn-pullzone: 2007452
cdn-uid: 371ad0f1-44d3-4f43-8cec-b0300cebb244
cdn-requestcountrycode: NO
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: must-revalidate, max-age=0, private
x-request-id: F82qAmh3dUf939VvcryC
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 202
cdn-cachedat: 05/09/2024 00:19:20
cdn-edgestorageid: 1048
cdn-requestid: 96c4076f4fd10a2f6c01d2cf5969ba59
X-Firefox-Spdy: h2

POST bestadsforyou.com/solid.gif?z=2021505&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1

212.117.190.203

200 OK

43 B

URL POST HTTP/2
bestadsforyou.com/solid.gif?z=2021505&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1
IP
212.117.190.203:443
ASN
#7979 SERVERS-COM

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerBuypass AS-983163327
Subject
Fingerprint6C:D7:81:E1:5D:48:3A:CC:D2:9F:5B:D9:02:3A:E8:93:2F:2A:D8:71
ValidityFri, 03 May 2024 14:26:01 GMT - Tue, 29 Oct 2024 22:59:00 GMT

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
28e463819a210071de3b45ebe7633613
6dccd571828ec0912629119cf7eabfea9f33ddbc
44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84

HTTP Headers

POST /solid.gif?z=2021505&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1 HTTP/1.1
Host: bestadsforyou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
Origin: https://bunkr.si
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: nginx
date: Thu, 09 May 2024 00:19:20 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
set-cookie: CHCK=1; Path=/; Expires=Thu, 12 Jun 2025 00:19:20 GMT; Secure; SameSite=None
UID=240508191961d6638692ee46a28220dae936; Path=/; Expires=Thu, 12 Jun 2025 00:19:20 GMT; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

GET 3zap7emt4.com/lv/esnk/2021517/code.js

212.117.190.201

200 OK

43 kB

URL GET HTTP/2
3zap7emt4.com/lv/esnk/2021517/code.js
IP
212.117.190.201:443
ASN
#7979 SERVERS-COM

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerBuypass AS-983163327
Subject
FingerprintF1:31:08:20:74:C6:E0:AF:E3:02:39:DF:F1:5F:7B:F9:C2:4B:73:9E
ValidityWed, 01 May 2024 14:42:29 GMT - Sun, 27 Oct 2024 22:59:00 GMT

File type
JavaScript source, ASCII text, with very long lines (65107)
Size
43 kB (43141 bytes)
Hash
e9ef275e0826f7c4ae1d2cf9600a9c4b
b4462cd70aef0b9a343c93027e7fe2ba78bb003d
3db5522744660a08a206d80f35e0d488c2ac9c6bac3d3fde1018d044f3904822

HTTP Headers

GET /lv/esnk/2021517/code.js HTTP/1.1
Host: 3zap7emt4.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
last-modified: Thu, 25 Apr 2024 17:06:20 GMT
vary: Accept-Encoding
etag: W/"662a8d8c-1c437"
x-js-ab2: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2

GET bestadsforyou.com/get/2021505?zoneid=2021505&jp=_clxtddfxh8p33pwcuw0274&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1&uf=0

212.117.190.203

200 OK

331 kB

URL GET HTTP/2
bestadsforyou.com/get/2021505?zoneid=2021505&jp=_clxtddfxh8p33pwcuw0274&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1&uf=0
IP
212.117.190.203:443
ASN
#7979 SERVERS-COM

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerBuypass AS-983163327
Subject
Fingerprint6C:D7:81:E1:5D:48:3A:CC:D2:9F:5B:D9:02:3A:E8:93:2F:2A:D8:71
ValidityFri, 03 May 2024 14:26:01 GMT - Tue, 29 Oct 2024 22:59:00 GMT

File type
gzip compressed data, from Unix
Size
331 kB (331078 bytes)
Hash
19e8235144fbeb10c9003f057fdcc488
7a145f47b8f51004164665cbd628e956ad439d69
42cc9aae7c2a3ddbbdb9f3e9ed54bc4c229c5784c944380d256c20a21edb9c2b

HTTP Headers

GET /get/2021505?zoneid=2021505&jp=_clxtddfxh8p33pwcuw0274&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=4053057936088576&eclog=0&im=1&uf=0 HTTP/1.1
Host: bestadsforyou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: CHCK=1; Path=/; Expires=Thu, 12 Jun 2025 00:19:20 GMT; Secure; SameSite=None
UID=2405081919730b38d1e82b4694b208601583; Path=/; Expires=Thu, 12 Jun 2025 00:19:20 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

OPTIONS stats.bunkr.ru/api/file/stats/13517416

186.2.163.65

204 No Content

7.1 kB

URL OPTIONS HTTP/2
stats.bunkr.ru/api/file/stats/13517416
IP
186.2.163.65:443
ASN
#59692 IQWeb FZ-LLC

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerLet's Encrypt
Subjectstats.bunkr.ru
Fingerprint60:CB:8D:0A:AF:2D:28:81:E2:28:8E:11:5B:5A:11:34:F5:7D:E8:9F
ValidityTue, 07 May 2024 09:55:24 GMT - Mon, 05 Aug 2024 09:55:23 GMT

File type
gzip compressed data, from Unix
Size
7.1 kB (7090 bytes)
Hash
b573fde16b2d707fa243a57f6f1d548f
52b645c0353922f59bab484c2ddf79e84c4c8083
a6022ed7339fe71020d41dde272b524b11492b132e50530bcfab373cb02bd2e4

HTTP Headers

POST /api/file/stats/13517416 HTTP/1.1
Host: stats.bunkr.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
Content-Type: application/json
Origin: https://bunkr.si
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: ddos-guard
content-security-policy: upgrade-insecure-requests;
set-cookie: __ddg1_=nDnnpoKpc58D57bBb11m; Domain=.bunkr.ru; HttpOnly; Path=/; Expires=Fri, 09-May-2025 00:19:20 GMT
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-powered-by: Express
access-control-allow-origin: *
etag: W/"46-ynK4ioS/rkG7jn/LpbTVXZB8gSA"
x-sec: RU-01-X914
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
X-Firefox-Spdy: h2

GET bunkr.si/images/logo.svg

104.21.76.180

200 OK

4.7 kB

URL GET HTTP/3
bunkr.si/images/logo.svg
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type
SVG Scalable Vector Graphics image
Size
4.7 kB (4663 bytes)
Hash
780a813233e05d875573a6086f0f8efb
4b84ccd6c015962cbcb78d5a8865b7b711de44fc
e38b499c4b9ad0b430ab7d5df119b4d99bb26c6e66fc733101506ab5b0d4a650

HTTP Headers

GET /images/logo.svg HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/d/Fakes-FFtHJJUF.zip
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: image/svg+xml
last-modified: Sun, 26 Mar 2023 04:20:31 GMT
vary: Accept-Encoding
etag: W/"641fc80f-1237"
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 6722
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qo2Dq72SJHg7%2Fc%2FFoyf3pj1TVn%2FjP%2FE1dCJT9tJerLqzMyK0bRsZwjFe20K8jPIxJnv0KrdNFJSUHnSJq%2FboxyALKLzfzMbQcrIQkC6oJxZLH%2BxdfusJP4xrLA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84722cbab4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

POST bunkr.sk/api/last_visit

172.67.148.56

301 Moved Permanently

0 B

URL POST HTTP/3
bunkr.sk/api/last_visit
IP
172.67.148.56:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.sk
Fingerprint3F:38:25:40:00:68:62:98:61:AF:86:E0:70:29:4E:E5:04:C9:C6:6B
ValidityThu, 28 Mar 2024 09:11:53 GMT - Wed, 26 Jun 2024 09:11:52 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /api/last_visit HTTP/1.1
Host: bunkr.sk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
Content-Type: text/plain
Content-Length: 127
Origin: https://bunkr.si
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 301 Moved Permanently
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/html
location: https://bunkr.si/api/last_visit
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GSy6hFzEMEap1oDZsI7ScyuXEGG%2FUG7xl5wWmIS4%2FLadvPYoiQY5mxscisOaH2sLowTvSoZWG06q6f6B2rIcyjMUTzz0qKddIxLovvx2GxzPq0O6Kkbrr7zQYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84749b9c1c12-OSL
alt-svc: h3=":443"; ma=86400

GET bunkr.si/d/Fakes-FFtHJJUF.zip

104.21.76.180

200 OK

24 kB

URL User Request GET HTTP/2
bunkr.si/d/Fakes-FFtHJJUF.zip
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type
HTML document, ASCII text, with very long lines (12261)
Size
24 kB (23581 bytes)
Hash
001ab73dcdffecfd6e4aad70e19e22d5
14985c5e26a636a2b15dc9b3e83c2e094fb235c2
e985e39994caec8910c07412d9a0266da43ae69b0af0770ac2d14b7b47d2bf46

HTTP Headers

GET /d/Fakes-FFtHJJUF.zip HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 09 May 2024 00:19:19 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=14400, must-revalidate, s-maxage=3600
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
x-front-cache: HIT
x-front-cache-status: BYPASS
expires: Thursday, 09-May-2024 00:19:19 GMT plus 1 hour
cf-cache-status: MISS
last-modified: Thu, 09 May 2024 00:19:19 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W5cvPb1bzkvkzl3E2XQ1IEkVhpPD6Hqt78boTi09U2Z4bgrKKFwCmTFaMsY3472sukjII4ElcDmTV0%2Fz0T39q7FS579mZxYWs1zseXdfRXqikhmB4TIpEyE6yQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84706858b51b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET bunkr.si/build/app.291ea157.js

104.21.76.180

200 OK

3.1 kB

URL GET HTTP/3
bunkr.si/build/app.291ea157.js
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type
JavaScript source, ASCII text, with very long lines (3195), with no line terminators
Size
3.1 kB (3131 bytes)
Hash
bc53ccd69b2b9b06d749a523287a6c8b
f0f3bac490f734feb8f6ce96acfcbe875ac60e16
b69c4095a28a94a112b6d520ee8ae17b1869085b827924473a42afe9db9bd950

HTTP Headers

GET /build/app.291ea157.js HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/d/Fakes-FFtHJJUF.zip
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
last-modified: Sun, 25 Feb 2024 03:19:51 GMT
vary: Accept-Encoding
etag: W/"65dab1d7-c3b"
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 5553
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bpr6EAszHSP903P1D6zrH%2BLTkhvzfCvrallqtAR5YjJlMpMV1lHr6BwafvAYXDZkp07%2BX8c193zU9YWUwUud6DUAT%2BuZyFZyoUZSlgJQNgkuUvCpFv9%2BVrV%2F1w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84722cb9b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET bestadsforyou.com/aas/r45d/vki/2021505/b58b1c0e.js

212.117.190.203

200 OK

106 kB

URL GET HTTP/2
bestadsforyou.com/aas/r45d/vki/2021505/b58b1c0e.js
IP
212.117.190.203:443
ASN
#7979 SERVERS-COM

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerBuypass AS-983163327
Subject
Fingerprint6C:D7:81:E1:5D:48:3A:CC:D2:9F:5B:D9:02:3A:E8:93:2F:2A:D8:71
ValidityFri, 03 May 2024 14:26:01 GMT - Tue, 29 Oct 2024 22:59:00 GMT

File type
JavaScript source, ASCII text, with very long lines (65106)
Size
106 kB (106464 bytes)
Hash
8645c18701dff4fd8ec637dd356c3601
c0c151a08eb933c46e69e75ce1358c47047f22ba
7ac37f2a21397633f19f4b10941cb219c148b403e16f2904c46e27a7d3eca0ad

HTTP Headers

GET /aas/r45d/vki/2021505/b58b1c0e.js HTTP/1.1
Host: bestadsforyou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
last-modified: Thu, 25 Apr 2024 17:06:20 GMT
vary: Accept-Encoding
etag: W/"662a8d8c-1a022"
x-js-ab2: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2

GET bunkr.si/build/370.a4405777.js

104.21.76.180

200 OK

458 kB

URL GET HTTP/3
bunkr.si/build/370.a4405777.js
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type

Size
458 kB (457528 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /build/370.a4405777.js HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/d/Fakes-FFtHJJUF.zip
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
last-modified: Sun, 25 Feb 2024 03:19:51 GMT
vary: Accept-Encoding
etag: W/"65dab1d7-6fb38"
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 6722
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ZilqP7IhAcRNm%2FExPvmhzKPj9XlGR9wlaVHUh3JtrpqNQoaT7xN8pkiTQXGyO%2FScAzx9C94VZBnSyRZjAgAsEK%2BVkM%2B4G8KoZvtqOg98kyNc6ZJVfD8RwEjGw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d84722cb7b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET cdn.cloudfrale.com/bn/b7c/ab3/a54/b7cab3a5435f14781949ee4473960540e35690f6.mp4

45.133.44.20

206 Partial Content

330 kB

URL GET HTTP/2
cdn.cloudfrale.com/bn/b7c/ab3/a54/b7cab3a5435f14781949ee4473960540e35690f6.mp4
IP
45.133.44.20:443
ASN
#39572 DataWeb Global Group B.V.

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerBuypass AS-983163327
Subject
Fingerprint5F:02:E3:5B:0C:B7:FA:C1:27:2A:35:DA:29:17:01:A8:47:B5:F3:A8
ValidityWed, 10 Jan 2024 08:59:56 GMT - Sun, 07 Jul 2024 21:59:00 GMT

File type
ISO Media, MP4 v2 [ISO 14496-14]
Size
330 kB (329525 bytes)
Hash
7e77144a14e32644ed5e15f0f9fb030f
b7cab3a5435f14781949ee4473960540e35690f6
9915a8f845c921ea7c24aabcf3674f8aa0818a7800108cc1fa4d178f21a8bd5b

HTTP Headers

GET /bn/b7c/ab3/a54/b7cab3a5435f14781949ee4473960540e35690f6.mp4 HTTP/1.1
Host: cdn.cloudfrale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 206 Partial Content
date: Thu, 09 May 2024 00:19:20 GMT
content-type: video/mp4
content-length: 329525
server: nginx/1.24.0
etag: 7e77144a14e32644ed5e15f0f9fb030f
last-modified: Sun, 05 Nov 2023 16:10:26 GMT
x-timestamp: 1699200625.34816
x-trans-id: tx789a914849f64c26ade59-0065ca5f72
x-openstack-request-id: tx789a914849f64c26ade59-0065ca5f72
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
expires: Sat, 11 May 2024 00:19:20 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
access-control-allow-origin: *
content-range: bytes 0-329524/329525
X-Firefox-Spdy: h2

GET 3zap7emt4.com/get/2021517?zoneid=2021517&jp=_cl186t4hhtse2vgzfdlv5f&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=2364208075789824&eclog=0&im=1&freq=0&uf=0

212.117.190.201

200 OK

4.2 kB

URL GET HTTP/2
3zap7emt4.com/get/2021517?zoneid=2021517&jp=_cl186t4hhtse2vgzfdlv5f&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=2364208075789824&eclog=0&im=1&freq=0&uf=0
IP
212.117.190.201:443
ASN
#7979 SERVERS-COM

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerBuypass AS-983163327
Subject
FingerprintF1:31:08:20:74:C6:E0:AF:E3:02:39:DF:F1:5F:7B:F9:C2:4B:73:9E
ValidityWed, 01 May 2024 14:42:29 GMT - Sun, 27 Oct 2024 22:59:00 GMT

File type
ASCII text, with very long lines (4238), with no line terminators
Size
4.2 kB (4162 bytes)
Hash
d38a2f4ed597d1ef15eda8ffcba1b975
9c79d34f13a2b846dae95fe5dc13202968a2df21
cb0573be08dc502103e03fae966decd85395d539c990955e3a66c2ffbc774476

HTTP Headers

GET /get/2021517?zoneid=2021517&jp=_cl186t4hhtse2vgzfdlv5f&nojs=0&abvar=0&febuild=1.0.233&t=0&wcks=1&wgl=0&cnvs=1&os=0&tz=UTC&ss=1&ls=1&bb=0&cti=0&plu=PDF%20Viewer::Chrome%20PDF%20Viewer::Chromium%20PDF%20Viewer::Microsoft%20Edge%20PDF%20Viewer::WebKit%20built-in%20PDF&lang=en-US&pf=Linux%20x86_64&cd=24&ix=0&x=1280&y=1024&md=0&afid=2364208075789824&eclog=0&im=1&freq=0&uf=0 HTTP/1.1
Host: 3zap7emt4.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 09 May 2024 00:19:20 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-route-id: config
set-cookie: CHCK=1; Path=/; Expires=Thu, 12 Jun 2025 00:19:20 GMT; Secure; SameSite=None
UID=2405081919dfc0d84eb3b644b7ba129145a1; Path=/; Expires=Thu, 12 Jun 2025 00:19:20 GMT; Secure; SameSite=None
content-encoding: gzip
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

GET bunkr.si/build/asdajklsdashjdasjk.js

104.21.76.180

200 OK

1.9 kB

URL GET HTTP/3
bunkr.si/build/asdajklsdashjdasjk.js
IP
104.21.76.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerGoogle Trust Services LLC
Subjectbunkr.si
FingerprintA5:F0:3C:9A:3E:A6:D6:CB:13:07:D6:A4:84:B8:5D:BD:C1:5D:14:08
ValiditySun, 24 Mar 2024 17:48:40 GMT - Sat, 22 Jun 2024 17:48:39 GMT

File type
ASCII text, with very long lines (1957), with no line terminators
Size
1.9 kB (1875 bytes)
Hash
8361acf4c4cdbc5e4a0692200d6cc2f0
7c8669e9177edd4b1a8de77247e22182e653199f
f982d4aa68ce3532bf755eaa1840ea68c407015e98a20aa23cbd89a7663026ae

HTTP Headers

GET /build/asdajklsdashjdasjk.js HTTP/1.1
Host: bunkr.si
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
last-modified: Sun, 05 May 2024 05:50:48 GMT
vary: Accept-Encoding
etag: W/"66371e38-753"
x-rate-limit-enabled: True
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cache-control: max-age=14400
cf-cache-status: HIT
age: 2395
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5sDhWXZxwnlFjaTFX8KBAd6ikiMTOiIlVXGMCcqPEkh9MV%2BOaHQrmtjSJPDWakiuIfeo6CHDyud8hDWGZoqDMbz%2BWmxFo8e9JkOHwm3ramOWDikr%2F0yIvclJDg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880d8472cd10b4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET core-apps.b-cdn.net/js/script.js

138.199.36.8

200 OK

1.3 kB

URL GET HTTP/2
core-apps.b-cdn.net/js/script.js
IP
138.199.36.8:443
ASN
#60068 Datacamp Limited

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
ASCII text, with very long lines (1384), with no line terminators
Size
1.3 kB (1346 bytes)
Hash
16cfd1982a40489c41a52add24d36b85
344f1896d895c5d0a7c4caecafcf1942603cd026
72073aacecd145e525b16c4c845c07bff5798e813eeed702dff748a18b6186ce

HTTP Headers

GET /js/script.js HTTP/1.1
Host: core-apps.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: application/javascript
server: BunnyCDN-DE1-1048
cdn-pullzone: 2007452
cdn-uid: 371ad0f1-44d3-4f43-8cec-b0300cebb244
cdn-requestcountrycode: NO
vary: Accept-Encoding, Accept-Encoding
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=86400
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 05/08/2024 18:21:43
cdn-edgestorageid: 863
cdn-status: 200
cdn-requestid: 8d1f24a0c53ae70f0ec04d4187a9c618
cdn-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2

GET fonts.bunny.net/rubik/files/rubik-latin-400-normal.woff2

194.242.11.186

200 OK

18 kB

URL GET HTTP/2
fonts.bunny.net/rubik/files/rubik-latin-400-normal.woff2
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerLet's Encrypt
Subjectfonts.bunny.net
FingerprintCB:89:86:8E:6D:0A:E5:60:AF:D4:50:FD:A4:62:99:B4:6C:13:A7:1F
ValidityTue, 09 Apr 2024 10:09:28 GMT - Mon, 08 Jul 2024 10:09:27 GMT

File type
Web Open Font Format (Version 2), TrueType, length 18128, version 1.0
Size
18 kB (18128 bytes)
Hash
717055430c80fee2dadb646e2b9800fe
9118698612991a83bfda0dfafdd1b9aba2c9adcb
67a6e7a3b413d838d3c53b06f53a567671f9477bd703ecdebbc5dcffb587b963

HTTP Headers

GET /rubik/files/rubik-latin-400-normal.woff2 HTTP/1.1
Host: fonts.bunny.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://bunkr.si
DNT: 1
Connection: keep-alive
Referer: https://fonts.bunny.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: font/woff2
content-length: 18128
server: BunnyCDN-NO1-830
cdn-pullzone: 781720
cdn-uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
cdn-requestcountrycode: NO
access-control-allow-origin: *
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=2592000
etag: "64a6428a-46d0"
last-modified: Thu, 06 Jul 2023 04:26:50 GMT
cdn-storageserver: SE-344
cdn-fileserver: 318
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/24/2024 18:47:34
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 35a64cebd7bde50a6a42f20819d3ee15
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET static.bunkr.ru/img/logo_bunkr-9Kl5M1Y.svg

194.242.11.186

200 OK

4.7 kB

URL GET HTTP/2
static.bunkr.ru/img/logo_bunkr-9Kl5M1Y.svg
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://bunkr.si/d/Fakes-FFtHJJUF.zip
Certificate
IssuerLet's Encrypt
Subjectstatic.bunkr.ru
Fingerprint75:B7:5A:06:B2:25:01:7B:9F:78:3D:C1:63:58:C4:85:30:53:48:35
ValiditySat, 20 Apr 2024 09:11:19 GMT - Fri, 19 Jul 2024 09:11:18 GMT

File type
SVG Scalable Vector Graphics image
Size
4.7 kB (4663 bytes)
Hash
780a813233e05d875573a6086f0f8efb
4b84ccd6c015962cbcb78d5a8865b7b711de44fc
e38b499c4b9ad0b430ab7d5df119b4d99bb26c6e66fc733101506ab5b0d4a650

HTTP Headers

GET /img/logo_bunkr-9Kl5M1Y.svg HTTP/1.1
Host: static.bunkr.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bunkr.si/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 09 May 2024 00:19:20 GMT
content-type: image/svg+xml
vary: Accept-Encoding
server: BunnyCDN-NO1-830
cdn-pullzone: 709401
cdn-uid: 371ad0f1-44d3-4f43-8cec-b0300cebb244
cdn-requestcountrycode: NO
cache-control: public, max-age=31919000
last-modified: Thu, 17 Feb 2022 21:35:05 GMT
cdn-cachedat: 11/29/2023 22:49:23
cdn-storageserver: DE-168
cdn-fileserver: 249
cdn-proxyver: 1.04
cdn-requestpullcode: 206
cdn-requestpullsuccess: True
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: f6110490494b8ca4b65dd6ef8df382d9
cdn-cache: HIT
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by