hygtf.arrowpipelines.com/i.php?l1Z9d0G3U1Bvihpi/OXDKiDphDv/vDDivKh
69.197.189.237 0 B URL hygtf.arrowpipelines.com/i.php?l1Z9d0G3U1Bvihpi/OXDKiDphDv/vDDivKh
IP 69.197.189.237:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /i.php?l1Z9d0G3U1Bvihpi/OXDKiDphDv/vDDivKh HTTP/1.1
Host: hygtf.arrowpipelines.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sun, 15 Oct 2023 23:59:33 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Location: http://208.110.82.50/like.php?l1Z9d0G3U1Bvihpi-OXDKiDphDv-vDDivKh==8c7m6z1qqlgn9n5f9j5oz3lh@tsztrzyuzsBy@
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
208.110.82.50/like.php?l1Z9d0G3U1Bvihpi-OXDKiDphDv-vDDivKh==8c7m6z1qqlgn9n5f9j5oz3lh@tsztrzyuzsBy@
208.110.82.50 0 B URL 208.110.82.50/like.php?l1Z9d0G3U1Bvihpi-OXDKiDphDv-vDDivKh==8c7m6z1qqlgn9n5f9j5oz3lh@tsztrzyuzsBy@
IP 208.110.82.50:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /like.php?l1Z9d0G3U1Bvihpi-OXDKiDphDv-vDDivKh==8c7m6z1qqlgn9n5f9j5oz3lh@tsztrzyuzsBy@ HTTP/1.1
Host: 208.110.82.50
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sun, 15 Oct 2023 23:59:33 GMT
Server: Apache/2.4.6 (CentOS) PHP/5.4.16
X-Powered-By: PHP/5.4.16
Location: http://lagoonwest.com/ac8ab600cf67da3b1fb4847a6ac482c23/?sid1=2-170250630412096015200000001779862846545639&sid2=&sid3=&sid4=
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
lagoonwest.com/ac8ab600cf67da3b1fb4847a6ac482c23/?sid1=2-170250630412096015200000001779862846545639&sid2=&sid3=&sid4=
23.229.58.100 6.6 kB URL lagoonwest.com/ac8ab600cf67da3b1fb4847a6ac482c23/?sid1=2-170250630412096015200000001779862846545639&sid2=&sid3=&sid4=
IP 23.229.58.100:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash 6b2dc29a8022b574d21916e88a9aef9d
74ab2814dbe4793a5a06ea7206bc0493e89e3882
369034e1eeb502973211678a5dfa11eef28a9d84d1eb38ace93f5dd30777300b
GET /ac8ab600cf67da3b1fb4847a6ac482c23/?sid1=2-170250630412096015200000001779862846545639&sid2=&sid3=&sid4= HTTP/1.1
Host: lagoonwest.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Sun, 15 Oct 2023 23:59:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.33
Set-Cookie: clkcheck4740=fd108382bf9645bc9a4b46ea16bb4736_203854; expires=Tue, 14-Nov-2023 23:59:34 GMT; Max-Age=2592000; path=/; SameSite=Lax
www.googletagmanager.com/gtm.js?id=GTM-MB79N3N
142.250.74.168 60 kB URL www.googletagmanager.com/gtm.js?id=GTM-MB79N3N
IP 142.250.74.168:0
File type ASCII text, with very long lines (2952)
Hash 2d57e85dae94b2d529e44153c2b5e76a
0e7ffec0a17b399ea537170b7b39822584560730
335d06aa7fdbe34e830bd9ec0dd6ebe85a3446e35fac5f722320d2efa3f0ee2c
GET /gtm.js?id=GTM-MB79N3N HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lagoonwest.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 15 Oct 2023 23:59:35 GMT
expires: Sun, 15 Oct 2023 23:59:35 GMT
cache-control: private, max-age=900
last-modified: Sun, 15 Oct 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 60549
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
lagoonwest.com/fp.php
23.229.58.100 0 B IP 23.229.58.100:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /fp.php HTTP/1.1
Host: lagoonwest.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 761
Origin: http://lagoonwest.com
DNT: 1
Connection: keep-alive
Referer: http://lagoonwest.com/ac8ab600cf67da3b1fb4847a6ac482c23/?sid1=2-170250630412096015200000001779862846545639&sid2=&sid3=&sid4=
Cookie: clkcheck4740=fd108382bf9645bc9a4b46ea16bb4736_203854
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Sun, 15 Oct 2023 23:59:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.33
www.googletagmanager.com/gtm.js?id=GTM-KQWFTZ7
142.250.74.168200 OK 45 kB URL GET HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-KQWFTZ7
IP 142.250.74.168:443
Requested by https://advertiserpages.com/notfound/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint54:FD:04:1B:2E:C7:46:95:DD:15:A3:A0:3F:CE:7F:03:02:53:36:8F
ValidityMon, 18 Sep 2023 08:19:25 GMT - Mon, 11 Dec 2023 08:19:24 GMT
File type ASCII text, with very long lines (2213)
Hash 3bf6e419495c4201e405ec3d3c99dfd7
70880a8cacf6767ffd2ef67f6ed25b9c9047cd67
2a2fdfa8eb80353e6917ad454d18587f3bc226b15739de44352801a4bda08eec
GET /gtm.js?id=GTM-KQWFTZ7 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://advertiserpages.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 15 Oct 2023 23:59:35 GMT
expires: Sun, 15 Oct 2023 23:59:35 GMT
cache-control: private, max-age=900
last-modified: Sun, 15 Oct 2023 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 44999
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.aimtell.com/trackpush/trackpush.min.js
104.18.32.59200 OK 14 kB URL GET HTTP/2 cdn.aimtell.com/trackpush/trackpush.min.js
IP 104.18.32.59:443
Requested by https://advertiserpages.com/notfound/
Certificate IssuerCloudflare, Inc.
Subjectaimtell.com
Fingerprint1C:CD:DA:C4:62:7E:59:6E:A3:E5:F3:89:A3:BD:88:CA:D9:F0:F7:3D
ValiditySat, 08 Apr 2023 00:00:00 GMT - Sun, 07 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (48688), with no line terminators
Hash e5c25420a95ac1de9edd61435836c3aa
20799aa2f5b58d211925c90f917ca8e4a25ceb61
08e9f17596573f12e053a5bdb4d9dfb09a45386322801eb7d47245791b25a3ca
GET /trackpush/trackpush.min.js HTTP/1.1
Host: cdn.aimtell.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://advertiserpages.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 15 Oct 2023 23:59:36 GMT
content-type: text/javascript
content-length: 13450
last-modified: Tue, 05 Sep 2023 17:55:08 GMT
etag: "702d020ca7ddd27e420979f979dc897e"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=86400
content-encoding: gzip
x-cache: Hit from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 2qpLmDAFSSKm5RPXkmiRQjDxG20bRI-ZeOoQUPLTeu5vp7uXBieOjg==
age: 38159
cf-cache-status: HIT
expires: Mon, 16 Oct 2023 23:59:36 GMT
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 816c0449f97f0b49-OSL
X-Firefox-Spdy: h2
signals.aimtell.com/pageview?id_site=26914&v=3.979&support=0&state=default&wl=0&ref=aHR0cHM6Ly9hZHZlcnRpc2VycGFnZXMuY29tL25vdGZvdW5kLw==
104.18.32.59200 OK 43 B URL POST HTTP/2 signals.aimtell.com/pageview?id_site=26914&v=3.979&support=0&state=default&wl=0&ref=aHR0cHM6Ly9hZHZlcnRpc2VycGFnZXMuY29tL25vdGZvdW5kLw==
IP 104.18.32.59:443
Requested by https://advertiserpages.com/notfound/
Certificate IssuerCloudflare, Inc.
Subjectaimtell.com
Fingerprint1C:CD:DA:C4:62:7E:59:6E:A3:E5:F3:89:A3:BD:88:CA:D9:F0:F7:3D
ValiditySat, 08 Apr 2023 00:00:00 GMT - Sun, 07 Apr 2024 23:59:59 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
POST /pageview?id_site=26914&v=3.979&support=0&state=default&wl=0&ref=aHR0cHM6Ly9hZHZlcnRpc2VycGFnZXMuY29tL25vdGZvdW5kLw== HTTP/1.1
Host: signals.aimtell.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://advertiserpages.com
DNT: 1
Connection: keep-alive
Referer: https://advertiserpages.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
TE: trailers
HTTP/2 200 OK
date: Sun, 15 Oct 2023 23:59:36 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: https://advertiserpages.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, *
access-control-allow-methods: GET,HEAD,OPTIONS
access-control-expose-headers: Aimtell-Hash-Exists, Aimtell-Traverse, Aimtell-Signal, Aimtell-Iso
aimtell-hash-exists: 0
aimtell-iso: NO
aimtell-signal: 0
aimtell-traverse: 0
vary: Accept-Encoding
server: cloudflare
cf-ray: 816c044ac99b0b49-OSL
X-Firefox-Spdy: h2
advertiserpages.com/notfound/
104.21.37.212200 OK 2.1 kB URL User Request GET HTTP/2 advertiserpages.com/notfound/
IP 104.21.37.212:443
Certificate IssuerLet's Encrypt
Subjectadvertiserpages.com
FingerprintD5:3F:26:56:85:EF:D3:1E:72:75:2B:9F:EA:1E:B2:2A:28:AB:AF:52
ValiditySat, 02 Sep 2023 09:13:44 GMT - Fri, 01 Dec 2023 09:13:43 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (2252), with no line terminators
Hash de26cc31735fc5928adfc8768f559105
0e03bde8bbecebd42d0cef8ab39183473d544c23
b7475efe31b5ced625e1d941a6db2df79666a870322fd496a6a4c4c943f4e00d
GET /notfound/ HTTP/1.1
Host: advertiserpages.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://lagoonwest.com/
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 15 Oct 2023 23:59:35 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CykHhGIfexmulRll7z3GFMYH6ivocwGIgwQD15COxOsUZpEMG34bHmElhhSttKg20a6%2BIE1gCGR%2FnLnaFBlOr%2BC1Xt%2F7i04Qiqc9TuWhwm3WoR0%2BNsq%2Fmf4SpIt9nBmKq6uhAZYU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 816c04466bc156ba-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
advertiserpages.com/favicon.ico
104.21.37.212404 Not Found 162 B URL GET HTTP/3 advertiserpages.com/favicon.ico
IP 104.21.37.212:443
Requested by https://advertiserpages.com/notfound/
Certificate IssuerLet's Encrypt
Subjectadvertiserpages.com
FingerprintD5:3F:26:56:85:EF:D3:1E:72:75:2B:9F:EA:1E:B2:2A:28:AB:AF:52
ValiditySat, 02 Sep 2023 09:13:44 GMT - Fri, 01 Dec 2023 09:13:43 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with no line terminators
Hash 42b7c03ebcddafdb2aa3078e3a9ceb69
57570cf4712b36bce96f68228e6c72137c2156dd
a225bf8186e767cfb73fec2ac55678c083a3c2abd042bc1cf85f820bced5ec9f
GET /favicon.ico HTTP/1.1
Host: advertiserpages.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://advertiserpages.com/notfound/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Sun, 15 Oct 2023 23:59:35 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
age: 3
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JXjipUNODmlvuRI%2FZOuU1OoYbgVJtYDJae50dpaDn3S7uPISowpgrB8M6a3mb227w7kn5%2B2AWxvv8r6ZnFt%2B67R0eXvyc4%2FbtTiPqnQagzKTL5MTec4Z8Itp5zM1NdmOob5T6959"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 816c0449883856c1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400