ocsp.pki.goog/gts1c3
471 B IP
Hash 3ea4ddbe81ebe72502d97210fd4bf6f6
60cda813e0f056eff029c744562d9c8e4ee2663f
050317cfdea8969d131d8a216040279dfbe35bd0a864b14bbc5c7aaea50a71ac
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash aa2a52bc41a5e23195d52340c4469568
37309d52f7e6a663971fd76cceab4d49a58b2339
dee191d39095702156a7fa38bc253850528670acfffac98f5f4beb689cca65d0
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=G-BL9163LYG1
200 OK 92 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=G-BL9163LYG1
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint00:ED:16:68:8D:DB:14:8B:43:01:81:CA:83:9A:AE:5B:24:AB:11:18
ValidityMon, 04 Sep 2023 08:17:06 GMT - Mon, 27 Nov 2023 08:17:05 GMT
File type ASCII text, with very long lines (4179)
Hash 50d6e2682539284eb8423edf48bd0699
e45c4be047e9888056e5edf946e3b9330ef7ad2d
357108706cb26618e4f7f137c8c4489678f383e06d2ee348b37551937ba44edc
GET /gtag/js?id=G-BL9163LYG1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 30 Sep 2023 02:30:07 GMT
expires: Sat, 30 Sep 2023 02:30:07 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 91818
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
static.depositfiles.com/images/no.png
200 OK 3.1 kB URL GET HTTP/2 static.depositfiles.com/images/no.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced\012- data
Hash 1724ae7b4437c460dafe40dfe9f96d41
8dc80d5b802f180254a8ee1bf1edf0b843205f1e
9b95b8f24b2b0808d611f4fd9bf5f3c548b352ae6100ab7b298b99a86905db79
GET /images/no.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db0-c4a"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 3146
X-Firefox-Spdy: h2
static.depositfiles.com/images/speed_small.gif
200 OK 24 kB URL GET HTTP/2 static.depositfiles.com/images/speed_small.gif
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type GIF image data, version 89a, 200 x 200\012- data
Hash 5cbc96bbb7230dd17ed38b5dd6e3271c
6ee1f0b9e29ac3e824cccd6e5135d51c8d3aaea1
01edcbb65e514def555b1e999d3a72f118f67e572f628293b91893b3758c6991
GET /images/speed_small.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db0-5dac"
expires: Thu, 05 Oct 2023 02:30:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 23980
X-Firefox-Spdy: h2
static.depositfiles.com/js/download_utils.js
200 OK 13 kB URL GET HTTP/2 static.depositfiles.com/js/download_utils.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type ASCII text, with very long lines (2250)
Hash 90a706006bc709cdc974ff3e0e01b34f
89585d2c7cac44c9c03c118bbb38aefba1d8a1e4
16f1515b9938fc7de086c504fe214484d97e237647a5d7fa2cb742a93f00c1ea
GET /js/download_utils.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db1-3447"
expires: Sat, 30 Sep 2023 02:35:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:01 GMT
server: nginx
content-length: 13383
X-Firefox-Spdy: h2
static.depositfiles.com/js/gold_offer.js
200 OK 9.9 kB URL GET HTTP/2 static.depositfiles.com/js/gold_offer.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type HTML document text\012- HTML document, ASCII text
Hash 041bdbbe3ac15bc57b14933e164b55f8
790f921426d0b602424fb3077ca900af94b5ad9e
a86d8d81e5c254822628c578c40d2d62956ab3060632d1884b5080093365b97b
GET /js/gold_offer.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db1-269f"
expires: Sat, 30 Sep 2023 02:35:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:01 GMT
server: nginx
content-length: 9887
X-Firefox-Spdy: h2
static.depositfiles.com/js/jquery.validate.js
200 OK 38 kB URL GET HTTP/2 static.depositfiles.com/js/jquery.validate.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type Unicode text, UTF-8 text, with very long lines (1238)
Hash d5231b6378847ebdb55f64c77d5a234f
eed97aa0b2aa9486b6f6831ed8a85dc729ad6b9c
95434a8a2568a6481a1fbcf5808a75dd58e77348ed6d70b4f7aeda8842e8f0c7
GET /js/jquery.validate.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db1-957d"
expires: Sat, 30 Sep 2023 02:35:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:01 GMT
server: nginx
content-length: 38269
X-Firefox-Spdy: h2
static.depositfiles.com/js/function.js
200 OK 35 kB URL GET HTTP/2 static.depositfiles.com/js/function.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type ASCII text, with very long lines (4240)
Hash a5779d2f560cd50376dbba372b0fd15b
07b08e35b9254288c1372e37577db8b9e4da01b4
51d26403861d61a7842bc73f518d4a4351a7027c40c9f0347f61421226950b84
GET /js/function.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db1-8863"
expires: Sat, 30 Sep 2023 02:35:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:01 GMT
server: nginx
content-length: 34915
X-Firefox-Spdy: h2
static.depositfiles.com/images/yes.png
200 OK 3.3 kB URL GET HTTP/2 static.depositfiles.com/images/yes.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced\012- data
Hash 3055b8489aeb385fb40b27f0bf0a5ae7
4cfbe45a0ba393ab8ad535cc04af30debef0a1ab
b325d6cb153b02050e59230e2abfb01e05f4bda708ad54bd8f6d9693fa9c2dac
GET /images/yes.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db1-ccb"
last-modified: Thu, 28 Sep 2023 09:56:01 GMT
server: nginx
content-length: 3275
X-Firefox-Spdy: h2
static.depositfiles.com/images/speed_small_gold.gif
200 OK 14 kB URL GET HTTP/2 static.depositfiles.com/images/speed_small_gold.gif
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type GIF image data, version 89a, 200 x 200\012- data
Hash c5f8f0e9ecd16637e267912376c24bed
324567a641d318ecfafe6374dfba86ccb2f90dd7
13678b229b6c4224bcb9578a2f29bc3686958f4bea73af7645eb39af4246e6a9
GET /images/speed_small_gold.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db0-389c"
expires: Thu, 05 Oct 2023 02:30:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 14492
X-Firefox-Spdy: h2
static.depositfiles.com/js/base2.js
200 OK 399 kB URL GET HTTP/2 static.depositfiles.com/js/base2.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type Unicode text, UTF-8 text, with very long lines (65481)
Size 399 kB (398927 bytes)
Hash 2fcae8126c3fd9a626370a701f0bd887
f3496fb7bbe122a9774d7dcfcd68da03a24dc285
d29ab86f64b4fcfbc45b9ef806c147f1e42e37e37d44a559147232288063badc
GET /js/base2.js HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=300
content-type: application/javascript
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: "65154db1-6164f"
expires: Sat, 30 Sep 2023 02:35:07 GMT
last-modified: Thu, 28 Sep 2023 09:56:01 GMT
server: nginx
content-length: 398927
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
472 B IP
Hash b5a91d039fd5e950f37d1d2124f05de7
bc1b73065c7f0ad1e64187c07a5098f473736875
a937479af4b3ada653e802aabf4532eab5ead96f92d5703b7aa98e396ae8cfda
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
471 B IP
Hash aa2a52bc41a5e23195d52340c4469568
37309d52f7e6a663971fd76cceab4d49a58b2339
dee191d39095702156a7fa38bc253850528670acfffac98f5f4beb689cca65d0
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
audienceravagephotocopy.com/22/4a/d4/224ad4a14b4b15c1726ff705ec672ea6.js
200 OK 13 kB URL GET HTTP/1.1 audienceravagephotocopy.com/22/4a/d4/224ad4a14b4b15c1726ff705ec672ea6.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectaudienceravagephotocopy.com
Fingerprint5F:C9:60:70:B1:E5:B8:DC:A5:5F:EC:E4:34:C1:1A:C5:94:FA:0B:2E
ValidityTue, 05 Sep 2023 00:49:44 GMT - Mon, 04 Dec 2023 00:49:43 GMT
File type ASCII text, with very long lines (37171), with no line terminators
Hash 242bb82bd6eb629a4125ace6c5af44ca
5a9a44e203e577d0884e6db73bcddcf08f0a808c
1c871a03a0fe5ab9fa8cd90ac1b25c12d1328892f3fb47b8741df7a5d83945e6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /22/4a/d4/224ad4a14b4b15c1726ff705ec672ea6.js HTTP/1.1
Host: audienceravagephotocopy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:08 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2a01f698748197bb03fdbd10de1720de
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
static.depositfiles.com/images/logo.png
200 OK 3.6 kB URL GET HTTP/2 static.depositfiles.com/images/logo.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 176 x 43, 8-bit/color RGBA, non-interlaced\012- data
Hash c41fdd84b04e45a91cb17cfdeccb1b38
fec7fffe104c7e169aeb159032078c4b71ff2cdc
7f89eb8ab03684f4db282ca30eb231b1e254bca10c7b511950df5e0eab0a68a0
GET /images/logo.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-e27"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 3623
X-Firefox-Spdy: h2
static.depositfiles.com/images/sprite.png
200 OK 37 kB URL GET HTTP/2 static.depositfiles.com/images/sprite.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 102 x 630, 8-bit/color RGBA, non-interlaced\012- data
Hash 2333675d7e431d5313c6dbb5230a14cd
93c4032e5b8b85793a9cda7167804445d950dd96
b287134a60667ce8e2c3fa1603e3a8f2ffa59c64e746d026d1a13ef19f3f38a0
GET /images/sprite.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-8fc2"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 36802
X-Firefox-Spdy: h2
static.depositfiles.com/images/member_menu_bg.gif
200 OK 78 B URL GET HTTP/2 static.depositfiles.com/images/member_menu_bg.gif
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type GIF image data, version 89a, 1 x 48\012- data
Hash 20a24b56dcedf6a71a71ebec771e1f7d
d7bed493d5d4eeaed5dbbf7d30d45107840790a0
6f57f29224d8e9e51ed0839e329055426fba7dcd97ef31e93ed495f93a6063df
GET /images/member_menu_bg.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-4e"
expires: Thu, 05 Oct 2023 02:30:08 GMT
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 78
X-Firefox-Spdy: h2
static.depositfiles.com/images/sprite64.png
200 OK 29 kB URL GET HTTP/2 static.depositfiles.com/images/sprite64.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 64 x 1088, 8-bit/color RGBA, non-interlaced\012- data
Hash e50649ecf6a2094c25da755ea0ea7bd1
e1c3e229a62f049442fa16cf43ec07f384b27362
a9ed59ab3bbcfdf66224664aeb14fa0f0e8f034d8472a58dadcf65cfff17685d
GET /images/sprite64.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-704b"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 28747
X-Firefox-Spdy: h2
static.depositfiles.com/images/upload_btn_bg.gif
200 OK 9.0 kB URL GET HTTP/2 static.depositfiles.com/images/upload_btn_bg.gif
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type GIF image data, version 89a, 209 x 75\012- data
Hash 6f312f0f4ff138758bae76420f6efd78
b40a28f162140fedff9ee5ce0d687868b1f73d17
c667d75c7f916bf8b140b0e1f7ab0c996f76d4642faed85bd9fef3c738f0912b
GET /images/upload_btn_bg.gif HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=432000
content-type: image/gif
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-2332"
expires: Thu, 05 Oct 2023 02:30:08 GMT
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 9010
X-Firefox-Spdy: h2
static.depositfiles.com/images/flags/lang24.png
200 OK 9.2 kB URL GET HTTP/2 static.depositfiles.com/images/flags/lang24.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 24 x 552, 8-bit/color RGBA, non-interlaced\012- data
Hash efdcd1ca23d564ddd811f41152a2b83c
0b5aa064e7f8f241363c55fa17eb448f42a5f8df
ce23be242e34c5b420f8ba0390aef20fa50ffc69f700091029616eff524e8f9b
GET /images/flags/lang24.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-23d4"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 9172
X-Firefox-Spdy: h2
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 40d0ea3edf81ca827f9b528e57c625b6
c01e00609f4bc6699927d7b1fb7bdb5c46d55515
a23f8a266939b23fbccae9a10fcd6b938e591b9bcb868a1d1e748d55ee18a563
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sat, 30 Sep 2023 02:30:08 GMT
Last-Modified: Sat, 30 Sep 2023 01:16:53 GMT
Server: ECAcc (ska/F6E3)
X-Cache: Miss from cloudfront
Via: 1.1 a2b4f68a89fc87406bff22c95fc07fba.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: q7yHG2tWgq0YjpbIEUKKj14G27IK8MhcuUc-JxHOtCjn8lCrovsPaA==
Age: 4395
professionalswebcheck.com/stats
200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 59d39a8ef3727ae4418f6945b2ac04c8
0abb7ebc73256bd09e4b6e5e7c14991042d638ae
95bfde3aa51f6412d2bd1eacf11eec4dbb8e3b99135a41d3bf1d9da28ec59ea1
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:08 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b:2:1; expires=Tue, 27 Sep 2033 02:30:08 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
static.depositfiles.com/images/sprite16.png
200 OK 28 kB URL GET HTTP/2 static.depositfiles.com/images/sprite16.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type PNG image data, 32 x 1072, 8-bit/color RGBA, non-interlaced\012- data
Hash 2e86fe2d2c2650c5f4663f0fc135ebc1
ba86e14a9abcff0581eda84a307594ef1288b982
604187f8828381a47ae70249f55f21c78c53ab1401d20a5f2230a0d6c9ae50d1
GET /images/sprite16.png HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://static.depositfiles.com/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
date: Sat, 30 Sep 2023 02:30:08 GMT
etag: "65154db0-6f55"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 28501
X-Firefox-Spdy: h2
loader.unblockia.com/c/dfiles.eu/config.json
200 OK 47 kB URL GET HTTP/2 loader.unblockia.com/c/dfiles.eu/config.json
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type ASCII text, with very long lines (46747), with no line terminators
Hash f365c1e4619a90bbadadacf55598fe90
1623c939b72aecd3831e1da35e4c0a5229383e91
23e2e4d868bb2652b97e9e13d36df1dfeeba338d4e9c4d1d737fba6b2b2b2d52
GET /c/dfiles.eu/config.json HTTP/1.1
Host: loader.unblockia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dfiles.eu/
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
content-length: 46747
last-modified: Fri, 09 Jun 2023 09:20:17 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: trENJHq0I9QxpCJnwtrkDFWJYsxIhjKV
accept-ranges: bytes
server: AmazonS3
date: Fri, 29 Sep 2023 07:42:54 GMT
etag: "f365c1e4619a90bbadadacf55598fe90"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 095562e8748e634f880ee3c4ada2b6d0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 8wbV0deedatReLLzFGJZYh7LXyF5AxVmPgunCK_Q1AsaDgpFmM2TFQ==
age: 67635
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2
js.capndr.com/advertising.js
200 OK 0 B URL GET HTTP/2 js.capndr.com/advertising.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectjs.capndr.com
Fingerprint6A:A0:24:1B:ED:51:D5:2A:39:50:AC:F1:8D:2B:A0:14:4C:58:7B:BC
ValidityWed, 23 Aug 2023 23:01:05 GMT - Tue, 21 Nov 2023 23:01:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /advertising.js HTTP/1.1
Host: js.capndr.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:08 GMT
content-type: application/javascript; charset=utf-8
content-length: 0
server: nginx/1.18.0
last-modified: Fri, 14 Jul 2023 08:23:25 GMT
etag: "64b105fd-0"
expires: Sat, 30 Sep 2023 02:35:08 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
accept-ranges: bytes
X-Firefox-Spdy: h2
adsbb.dfiles.eu//ad.php?z=58&c=NO&g=gateway
303 See Other 503 B URL GET HTTP/2 adsbb.dfiles.eu//ad.php?z=58&c=NO&g=gateway
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
Hash 74498f9389f61beb56eba3e882f8432a
7b26d5ffb48cc1941c7374d9c538286fb1aecd17
2818d1bf8245012328b9e28aaf5e2f0bc1ce5a240950bf41bbb210cf9be921fb
GET //ad.php?z=58&c=NO&g=gateway HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 303 See Other
content-type: text/html; charset=UTF-8
date: Sat, 30 Sep 2023 02:30:08 GMT
location: /upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
server: nginx
set-cookie: _nf58=1; expires=Sun, 01-Oct-2023 02:30:08 GMT; Max-Age=86400
x-powered-by: PHP/5.6.30-0+deb8u1
X-Firefox-Spdy: h2
friendshipmale.com/sfp.js
200 OK 28 kB URL GET HTTP/3 friendshipmale.com/sfp.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint08:6F:D8:CB:9E:0C:0A:98:2E:C5:CD:21:8E:0B:76:2B:50:6F:B6:37
ValiditySat, 18 Feb 2023 00:00:00 GMT - Sat, 17 Feb 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Hash 2d0450888479d4ddda305bd96206b240
5b4595aab1cd3f854718e05db9be0c65a12ab2f6
44de073e74ff24c6b1c0fe1f3ac5b33d793560e85ef24fb6ce89e76c2cf90af6
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:08 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 497182640bfe2989039cd3b75715c6d0
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sat, 30 Sep 2023 02:30:08 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YOJTIkYdvyCgUg4KP%2BcKy9zL8gY2c3nnU8P5G9402gFwgOialteIOZAYyW5wRC877ey2VnmsGa2Al1ygjEO3xt8GI1bYYOiLXLj2%2FHwhUyJz5V6nnEk%2B0nywZqq2xm7MQo1cZ9A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80e90ace9a21459a-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ordinarilyinstead.com/c2/2d/c5/c22dc50dc2bbe4422c7f68d26ab95eb9.js
200 OK 29 kB URL GET HTTP/1.1 ordinarilyinstead.com/c2/2d/c5/c22dc50dc2bbe4422c7f68d26ab95eb9.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators
Hash c17aa81be0e862fef1ecffffbc4ee654
e663c55f39c91fc1243e174c243ad221a011cab1
c8325d29a1c038cb772f59cdbe261926c03859fdc55420a19f3d464c4ef05fa6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /c2/2d/c5/c22dc50dc2bbe4422c7f68d26ab95eb9.js HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:08 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d21bdccd4c0f6c72e1eb91e42024aaba
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
adsbb.dfiles.eu/static/js/jquery-1.5.1.min.js
85 kB URL adsbb.dfiles.eu/static/js/jquery-1.5.1.min.js
IP
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
File type Unicode text, UTF-8 text, with very long lines (65168)
Hash b04a3bccd23ddeb7982143707a63ccf9
4a5dc1389aad050a44ee5e81408238a317ab3413
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
GET /static/js/jquery-1.5.1.min.js HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008; _nf58=1; _nf56=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: no-cache, private, no-cache, no-store, must-revalidate
content-type: application/javascript
date: Sat, 30 Sep 2023 02:30:09 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache
server: nginx
content-length: 85260
X-Firefox-Spdy: h2
adsbb.dfiles.eu/upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
200 OK 86 kB URL GET HTTP/2 adsbb.dfiles.eu/upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
File type gzip compressed data, max speed, from Unix\012- data
Hash 67a539f6831cee01c527547965037ce2
50eca58807aeab67d81e028e34379d6bfe33ab59
f8bf8694a836c9292a2edde42d98ac156f570e1ade19fcb82d338f1b70d31a80
GET /upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dfiles.eu/
DNT: 1
Connection: keep-alive
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008; _nf58=1; _nf56=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
content-type: text/html
date: Sat, 30 Sep 2023 02:30:08 GMT
last-modified: Sat, 30 Sep 2023 02:30:01 GMT
server: nginx
X-Firefox-Spdy: h2
professionalswebcheck.com/stats
200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 59d39a8ef3727ae4418f6945b2ac04c8
0abb7ebc73256bd09e4b6e5e7c14991042d638ae
95bfde3aa51f6412d2bd1eacf11eec4dbb8e3b99135a41d3bf1d9da28ec59ea1
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uid_id2=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b:2:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:09 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
adsbb.dfiles.eu/view.gif?c=2973&z=58&b=2775&u=6517882a09a168392396287734379
43 B URL adsbb.dfiles.eu/view.gif?c=2973&z=58&b=2775&u=6517882a09a168392396287734379
IP
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 6d22e4f2d2057c6e8d6fab098e76e80f
b80b11203d97fe01c5597ca3be70406ea48f5709
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
GET /view.gif?c=2973&z=58&b=2775&u=6517882a09a168392396287734379 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008; _nf58=1; _nf56=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: no-cache, private, no-cache, no-store, must-revalidate
content-type: image/gif
date: Sat, 30 Sep 2023 02:30:09 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache
server: nginx
content-length: 43
X-Firefox-Spdy: h2
adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
200 OK 3.7 kB URL GET HTTP/2 adsbb.dfiles.eu/upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5426), with CRLF, LF line terminators
Hash f82185b8b114dec0e85ea9adbd7f62ef
f5dd046807989a67d8f03798bc87addd8511166b
a163c8c94c4551466ebe1bcd8ff0baf86e6f1a699cede995c063db810657da2f
GET /upload/2303/ad2775297311915a.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dfiles.eu/
DNT: 1
Connection: keep-alive
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008; _nf58=1; _nf56=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
content-type: text/html
date: Sat, 30 Sep 2023 02:30:08 GMT
last-modified: Sat, 30 Sep 2023 02:30:02 GMT
server: nginx
X-Firefox-Spdy: h2
adsbb.dfiles.eu/view.gif?c=2685&z=56&b=2758&u=65178829f172a012032462826213175
43 B URL adsbb.dfiles.eu/view.gif?c=2685&z=56&b=2758&u=65178829f172a012032462826213175
IP
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 6d22e4f2d2057c6e8d6fab098e76e80f
b80b11203d97fe01c5597ca3be70406ea48f5709
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
GET /view.gif?c=2685&z=56&b=2758&u=65178829f172a012032462826213175 HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008; _nf58=1; _nf56=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cache-control: no-cache, private, no-cache, no-store, must-revalidate
content-type: image/gif
date: Sat, 30 Sep 2023 02:30:09 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache
server: nginx
content-length: 43
X-Firefox-Spdy: h2
static.depositfiles.com/images/favicon.ico
200 OK 318 B URL GET HTTP/2 static.depositfiles.com/images/favicon.ico
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
File type MS Windows icon resource - 1 icon, 16x16, 16 colors, 4 bits/pixel\012- data
Hash 0f0b975ee529197ec75780ebc2de5907
59688c6aafca5606e388ba9a44fc9dc25fc32cd3
28a0b52229f05b66354ca38b6b813d2281af3efb7e8b0a424ef8b4c68b9e583c
GET /images/favicon.ico HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/x-icon
date: Sat, 30 Sep 2023 02:30:09 GMT
etag: "65154db0-13e"
last-modified: Thu, 28 Sep 2023 09:56:00 GMT
server: nginx
content-length: 318
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 6dcd3c3d5548d4554f3752d4c7cfc1ce
d5f3b0ce477be975447455ccb5fdb558cadb68ee
3c96e23c59ccbece844260d41892ff0dc44fcc051a27107e10b53d7c3aeeddb9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.gstatic.com/recaptcha/releases/pxZcVU8Dk73FyvFvdCgp2MSG/recaptcha__en.js
200 OK 187 kB URL GET HTTP/2 www.gstatic.com/recaptcha/releases/pxZcVU8Dk73FyvFvdCgp2MSG/recaptcha__en.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type ASCII text, with very long lines (664)
Size 187 kB (187176 bytes)
Hash 50b2895773ea02bd03be4fe5230fad6f
a913962afbcfc933ed779165c6173e03077122e4
7b32785db8941f4503dfeb24b076e81c895483ae097c2354e058101d5282cae5
GET /recaptcha/releases/pxZcVU8Dk73FyvFvdCgp2MSG/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 187176
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 30 Sep 2023 00:43:28 GMT
expires: Sun, 29 Sep 2024 00:43:28 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 22 Sep 2023 04:03:44 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 6401
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
gorillasneer.com/pixel/purst?dl=0&th=0&sc=0&rs=2546&rd=2546&fd=784&bv=22.10.v.10&tmpl=136
200 OK 0 B URL GET HTTP/1.1 gorillasneer.com/pixel/purst?dl=0&th=0&sc=0&rs=2546&rd=2546&fd=784&bv=22.10.v.10&tmpl=136
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectgorillasneer.com
FingerprintAF:75:CF:26:FD:C9:28:1A:06:4B:83:FD:6D:FE:82:0F:20:33:34:3A
ValiditySat, 23 Sep 2023 00:44:48 GMT - Fri, 22 Dec 2023 00:44:47 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/purst?dl=0&th=0&sc=0&rs=2546&rd=2546&fd=784&bv=22.10.v.10&tmpl=136 HTTP/1.1
Host: gorillasneer.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:09 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
c.mgid.com/pv/?lu=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fn5u4t0er8%2FCStrike-16-CLASSIC.exe&cbuster=1696041009876713390703&pvid=18ae3ec02d2a319536b&implVersion=11&cxurl=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fn5u4t0er8%2FCStrike-16-CLASSIC.exe&site=437&i=1
43 B URL c.mgid.com/pv/?lu=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fn5u4t0er8%2FCStrike-16-CLASSIC.exe&cbuster=1696041009876713390703&pvid=18ae3ec02d2a319536b&implVersion=11&cxurl=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fn5u4t0er8%2FCStrike-16-CLASSIC.exe&site=437&i=1
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash 57f187c7a868faeac558007a8eb6cb2e
11ab10ab109fdb53d91d444ac781101f5a6360c6
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
GET /pv/?lu=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fn5u4t0er8%2FCStrike-16-CLASSIC.exe&cbuster=1696041009876713390703&pvid=18ae3ec02d2a319536b&implVersion=11&cxurl=https%3A%2F%2Fdfiles.eu%2Ffiles%2Fn5u4t0er8%2FCStrike-16-CLASSIC.exe&site=437&i=1 HTTP/1.1
Host: c.mgid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adsbb.dfiles.eu/
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=0XYvqE0H42Z7SPdBppBUX2BZD0I3WkYI39H05Z9l7GU-1696041009-0-AWBLsMox605iIl0HHfq3kukJJm8CASXD0I7xnZh5gEvLoc2ugPLfnjva1jNlPXIAT8CmEEf08/YEjNpzcekienE=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 30 Sep 2023 02:30:09 GMT
content-type: image/gif
content-length: 43
cf-cache-status: DYNAMIC
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
cf-ray: 80e90ad5ea385684-OSL
alt-svc: h3=":443"; ma=86400
ocsp.pki.goog/gts1c3
471 B IP
Hash 6dcd3c3d5548d4554f3752d4c7cfc1ce
d5f3b0ce477be975447455ccb5fdb558cadb68ee
3c96e23c59ccbece844260d41892ff0dc44fcc051a27107e10b53d7c3aeeddb9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:09 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
professionalswebcheck.com/stats
200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 59d39a8ef3727ae4418f6945b2ac04c8
0abb7ebc73256bd09e4b6e5e7c14991042d638ae
95bfde3aa51f6412d2bd1eacf11eec4dbb8e3b99135a41d3bf1d9da28ec59ea1
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uid_id2=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b:2:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:09 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
professionalswebcheck.com/stats
200 OK 40 B URL GET HTTP/2 professionalswebcheck.com/stats
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subjectprofessionalswebcheck.com
Fingerprint75:E9:08:FD:96:58:C7:98:43:E8:21:27:A8:E9:B9:A4:55:28:F2:0C
ValidityWed, 30 Aug 2023 00:00:00 GMT - Fri, 27 Sep 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 59d39a8ef3727ae4418f6945b2ac04c8
0abb7ebc73256bd09e4b6e5e7c14991042d638ae
95bfde3aa51f6412d2bd1eacf11eec4dbb8e3b99135a41d3bf1d9da28ec59ea1
GET /stats HTTP/1.1
Host: professionalswebcheck.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uid_id2=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b:2:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:09 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://dfiles.eu
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
cdn.unblockia.com/autopromos/unicef2.jpg?unblockia=true
200 OK 37 kB URL GET HTTP/2 cdn.unblockia.com/autopromos/unicef2.jpg?unblockia=true
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 728x90, components 3\012- data
Hash 58fbb6ffe72ac0c1aa468de39ee18e13
d25230f1ef89aecc6048b0ceb09dd0af609ee7b6
e8ff7f3a8926e5b5497d2ab7a1bf47c5655e287a51045f11846f426ac6c7d180
GET /autopromos/unicef2.jpg?unblockia=true HTTP/1.1
Host: cdn.unblockia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 36773
last-modified: Tue, 12 Apr 2022 08:41:28 GMT
x-amz-version-id: xUurxjfnscsyJn430NFsrgfbabIFowSl
accept-ranges: bytes
server: AmazonS3
date: Fri, 29 Sep 2023 03:48:04 GMT
etag: "58fbb6ffe72ac0c1aa468de39ee18e13"
x-cache: Hit from cloudfront
via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 8bRz-3RzAR4CYH2hw9YSOgiA_3B5D3DOGBjLmVT7uL_hiejZiIRSWA==
age: 81773
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
ordinarilyinstead.com/ren.gif?sid=H4sIAAAAAAAC%2F1SSz2skRRTHq9ewB%2FWyriDCCnNTQSbdnZ5f7kE2rpFg3Ky7it6kuqp6Uqa6q6nqmp4ED8EFyXH8DzrfSTaoYVn%2FAEU63haEjKcczEHYP0CUPctMBkcfNO993%2FcdPu91fX3gLogPR8%2FXPtS7Uim63Gr6jTc%2BC4KbjQ2ZuWFj2G1%2F3o5uNszg7cDvNf03G%2B8Ltq2XQz%2Fw%2FcAPGmvSiEQPl4MgaPqQ%2BUkvaPb8ZhQ2g1aEofm%2Fts6DpR744IK8BMknz588iiBZjSx9fFvY7ULnb72XOkULbTDgx59k25kuM6SLMjEekux4Pg1tz9Z%2Bgs6OZsDQg38HYzkh3tM%2FEGfHc0rEg6NL0FhBZIj5CygHNYSqIWkNph9A8jMCMI47m8jSh3e0KenOpUun7oQsPfsLspyQpd9fRpY%2BWlVy2LivlSukziyGSQU5rCH7NXJ3imL3CmR5ClZ8Bcl%2FJcvPNpClh5tWaUhezZaXsoZMaigxArUe3PSTHlziweUeUn7e6LCo2%2BXdFqeCsTBOgm4SJVGPMj9h%2FkovhGNTvBGKfASmRmBmD7nZw7YcwbifYbcqWO7BFhPifbSHAa9QCoLSEpSUoJQEZUFQDqojrmxoq4dcWRcH8xzO80o11kX%2FgB7poi8ycpBfkGuzu%2Fzd1tgW540wjCiPaBDFURy0WNAJ20nS8VuCtTuhoG1YWUHaK7NVd%2BXZ9Ry5PHvxBmJ6CqtOweQ1UPcaaDnuhD7o1jjq%2BtjNHnORayuLRCphm0yn4LpCXiyh2PEO1AV5dcbx%2BtMbEOwJmQeYqZCbCl%2FIXwj6an98T5fk8J4uLflhMy9kKnfp9N%2FdL2ghrn73gdgpteHrt%2B3o21tsakzLk4%2BFLTZoxmXWt%2BT7Vcm5MGvaMEF%2BXLefivius1urzmQu37j77tp6mhthrdRZDSrPvmyDyQm5euto9iqv%2FxlBmhrGVUjdglTqGizfg80XPasJjFroOPdQumpswnjRVJJAiYWmcQX7Hx0v6gO7j77xQIsHyNIKA1NhoCpQNYJ1z42L3Dx557eVWSBW3jhWxjuMlVHfXJ7WyvOG6Ih2rxf5UYf7fhzxMAxagtGViPZoGCYdFHYiXtkP%2FgEAAP%2F%2FAQAA%2F%2F8PmNSwYgQAAA%3D%3D
200 OK 7 B URL GET HTTP/1.1 ordinarilyinstead.com/ren.gif?sid=H4sIAAAAAAAC%2F1SSz2skRRTHq9ewB%2FWyriDCCnNTQSbdnZ5f7kE2rpFg3Ky7it6kuqp6Uqa6q6nqmp4ED8EFyXH8DzrfSTaoYVn%2FAEU63haEjKcczEHYP0CUPctMBkcfNO993%2FcdPu91fX3gLogPR8%2FXPtS7Uim63Gr6jTc%2BC4KbjQ2ZuWFj2G1%2F3o5uNszg7cDvNf03G%2B8Ltq2XQz%2Fw%2FcAPGmvSiEQPl4MgaPqQ%2BUkvaPb8ZhQ2g1aEofm%2Fts6DpR744IK8BMknz588iiBZjSx9fFvY7ULnb72XOkULbTDgx59k25kuM6SLMjEekux4Pg1tz9Z%2Bgs6OZsDQg38HYzkh3tM%2FEGfHc0rEg6NL0FhBZIj5CygHNYSqIWkNph9A8jMCMI47m8jSh3e0KenOpUun7oQsPfsLspyQpd9fRpY%2BWlVy2LivlSukziyGSQU5rCH7NXJ3imL3CmR5ClZ8Bcl%2FJcvPNpClh5tWaUhezZaXsoZMaigxArUe3PSTHlziweUeUn7e6LCo2%2BXdFqeCsTBOgm4SJVGPMj9h%2FkovhGNTvBGKfASmRmBmD7nZw7YcwbifYbcqWO7BFhPifbSHAa9QCoLSEpSUoJQEZUFQDqojrmxoq4dcWRcH8xzO80o11kX%2FgB7poi8ycpBfkGuzu%2Fzd1tgW540wjCiPaBDFURy0WNAJ20nS8VuCtTuhoG1YWUHaK7NVd%2BXZ9Ry5PHvxBmJ6CqtOweQ1UPcaaDnuhD7o1jjq%2BtjNHnORayuLRCphm0yn4LpCXiyh2PEO1AV5dcbx%2BtMbEOwJmQeYqZCbCl%2FIXwj6an98T5fk8J4uLflhMy9kKnfp9N%2FdL2ghrn73gdgpteHrt%2B3o21tsakzLk4%2BFLTZoxmXWt%2BT7Vcm5MGvaMEF%2BXLefivius1urzmQu37j77tp6mhthrdRZDSrPvmyDyQm5euto9iqv%2FxlBmhrGVUjdglTqGizfg80XPasJjFroOPdQumpswnjRVJJAiYWmcQX7Hx0v6gO7j77xQIsHyNIKA1NhoCpQNYJ1z42L3Dx557eVWSBW3jhWxjuMlVHfXJ7WyvOG6Ih2rxf5UYf7fhzxMAxagtGViPZoGCYdFHYiXtkP%2FgEAAP%2F%2FAQAA%2F%2F8PmNSwYgQAAA%3D%3D
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
File type ASCII text, with no line terminators
Hash 132d6af1b46048b45cf86cdee7991d31
eb7007d03d59b65bc6da7e098c4d38fc6dfb6285
ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ren.gif?sid=H4sIAAAAAAAC%2F1SSz2skRRTHq9ewB%2FWyriDCCnNTQSbdnZ5f7kE2rpFg3Ky7it6kuqp6Uqa6q6nqmp4ED8EFyXH8DzrfSTaoYVn%2FAEU63haEjKcczEHYP0CUPctMBkcfNO993%2FcdPu91fX3gLogPR8%2FXPtS7Uim63Gr6jTc%2BC4KbjQ2ZuWFj2G1%2F3o5uNszg7cDvNf03G%2B8Ltq2XQz%2Fw%2FcAPGmvSiEQPl4MgaPqQ%2BUkvaPb8ZhQ2g1aEofm%2Fts6DpR744IK8BMknz588iiBZjSx9fFvY7ULnb72XOkULbTDgx59k25kuM6SLMjEekux4Pg1tz9Z%2Bgs6OZsDQg38HYzkh3tM%2FEGfHc0rEg6NL0FhBZIj5CygHNYSqIWkNph9A8jMCMI47m8jSh3e0KenOpUun7oQsPfsLspyQpd9fRpY%2BWlVy2LivlSukziyGSQU5rCH7NXJ3imL3CmR5ClZ8Bcl%2FJcvPNpClh5tWaUhezZaXsoZMaigxArUe3PSTHlziweUeUn7e6LCo2%2BXdFqeCsTBOgm4SJVGPMj9h%2FkovhGNTvBGKfASmRmBmD7nZw7YcwbifYbcqWO7BFhPifbSHAa9QCoLSEpSUoJQEZUFQDqojrmxoq4dcWRcH8xzO80o11kX%2FgB7poi8ycpBfkGuzu%2Fzd1tgW540wjCiPaBDFURy0WNAJ20nS8VuCtTuhoG1YWUHaK7NVd%2BXZ9Ry5PHvxBmJ6CqtOweQ1UPcaaDnuhD7o1jjq%2BtjNHnORayuLRCphm0yn4LpCXiyh2PEO1AV5dcbx%2BtMbEOwJmQeYqZCbCl%2FIXwj6an98T5fk8J4uLflhMy9kKnfp9N%2FdL2ghrn73gdgpteHrt%2B3o21tsakzLk4%2BFLTZoxmXWt%2BT7Vcm5MGvaMEF%2BXLefivius1urzmQu37j77tp6mhthrdRZDSrPvmyDyQm5euto9iqv%2FxlBmhrGVUjdglTqGizfg80XPasJjFroOPdQumpswnjRVJJAiYWmcQX7Hx0v6gO7j77xQIsHyNIKA1NhoCpQNYJ1z42L3Dx557eVWSBW3jhWxjuMlVHfXJ7WyvOG6Ih2rxf5UYf7fhzxMAxagtGViPZoGCYdFHYiXtkP%2FgEAAP%2F%2FAQAA%2F%2F8PmNSwYgQAAA%3D%3D HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:09 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e081525c0663c4d712c8da07a1b2f443
Strict-Transport-Security: max-age=0; includeSubdomains
cdn.unblockia.com/h.js
200 OK 40 kB IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 5420ccdbc119d2a9b28c0caee9ec2aba
e0074ab1c2eb4bc9cf573343ffd6f48f4f507d62
81e8932a606142b5354aa7cf8c9a30b428a0f131cb1015b70ee7f4faf1e9415d
GET /h.js HTTP/1.1
Host: cdn.unblockia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript
last-modified: Tue, 20 Jun 2023 10:06:46 GMT
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-content-sha256: 02f1ef29ead1d705cce351046cded37a79615ae12624547bfa0e8307765c8765
x-amz-version-id: m8vKRZ4OANVjVfMIKL3cKYiXKt6EM9QQ
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:987257285531:build/unblockia-loader-codebuild-project:4e52eb3f-761b-4c10-a85a-162fb4fa3980
x-amz-meta-codebuild-content-md5: fb4d4b7b1d35720e2d2481016ef4369b
server: AmazonS3
content-encoding: gzip
date: Fri, 29 Sep 2023 12:42:48 GMT
etag: W/"bc5af0220c4116294c4e9c72ae4e244c"
x-cache: Hit from cloudfront
via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: jtu3_Sm6I8aYXqSLWTFzTyOxHC2Ypl6QyquOKNTwiVttlZlxcmG9PA==
age: 49641
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
cdn.unblockia.com/autopromos/unicef3.jpg?unblockia=true
200 OK 54 kB URL GET HTTP/2 cdn.unblockia.com/autopromos/unicef3.jpg?unblockia=true
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=2, software=Google], baseline, precision 8, 160x600, components 3\012- data
Hash 5dcf47442fc7fbb8d0263bbf4869537e
2c8232ac93448bbc06b5464f1839a5cdb2ed3e07
81804a1b2b20350ec009ba6429a4f58124c16ca30683af0af255544cd98c8fa6
GET /autopromos/unicef3.jpg?unblockia=true HTTP/1.1
Host: cdn.unblockia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 54292
last-modified: Tue, 12 Apr 2022 08:41:27 GMT
x-amz-version-id: iA22.ytP0i4dmuIhnc0eyNVgJlt2K4fl
accept-ranges: bytes
server: AmazonS3
date: Fri, 29 Sep 2023 05:30:23 GMT
etag: "5dcf47442fc7fbb8d0263bbf4869537e"
x-cache: Hit from cloudfront
via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: L9nETndXP1E-oXMA4nxXGPO-nDewkgJ8Y53CUR18NLpp7s6Gh76EzQ==
age: 75588
vary: Accept-Encoding, Origin
X-Firefox-Spdy: h2
jsc.mgid.com/d/e/depositfiles.com.7998.js
1.4 kB URL jsc.mgid.com/d/e/depositfiles.com.7998.js
IP
File type C source, ASCII text, with very long lines (3857), with no line terminators
Hash 3011117cdaca0ccd5a72b3612cebaeef
bd9f5d7888828657743f738707833bff7e6e0782
435e541f851645c56437e18a7fda4017942535a2bdca3e6d8b8092a60df30fbf
GET /d/e/depositfiles.com.7998.js HTTP/1.1
Host: jsc.mgid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adsbb.dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:09 GMT
content-type: text/javascript
cf-bgj: minify
cf-polished: origSize=3858
etag: W/"0617d72984071ceed5889ef6107260d1"
last-modified: Tue, 26 Sep 2023 13:42:27 GMT
x-amz-id-2: qBffnF5AyvvWQo0eLhjEslRqnngECmUzPykkD0UBD2sX92OamrTvUAtnSYQZ6zQkTNL5dSKOxtM=
x-amz-request-id: 69MEDDV1RPJ8CXC8
x-amz-server-side-encryption: AES256
x-amz-version-id: 0XS1UV9i2F7tM2KMIo7IY1reeCGRhQgo
cf-cache-status: HIT
age: 3321
expires: Sat, 30 Sep 2023 05:30:09 GMT
cache-control: public, max-age=10800
set-cookie: __cf_bm=0XYvqE0H42Z7SPdBppBUX2BZD0I3WkYI39H05Z9l7GU-1696041009-0-AWBLsMox605iIl0HHfq3kukJJm8CASXD0I7xnZh5gEvLoc2ugPLfnjva1jNlPXIAT8CmEEf08/YEjNpzcekienE=; path=/; expires=Sat, 30-Sep-23 03:00:09 GMT; domain=.mgid.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
server: cloudflare
cf-ray: 80e90ad27cc7b505-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Findex.html&l=1098&fd=188
200 OK 0 B URL GET HTTP/1.1 ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Findex.html&l=1098&fd=188
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Findex.html&l=1098&fd=188 HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:10 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
b239c2088d.ff8467d480.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI1MzYwMDExMzUxNDYwOTYwMDAwIiwidGltZXpvbmUiOjAsInZlciI6IjMuODAuMCIsInRhZ19pZCI6NDY0NDUsInNjcmVlbl9yZXNvbHV0aW9uIjoiMTI4MHgxMDI0IiwiYWRibG9jayI6MCwidGltZXpvbmVfb2xzb24iOiJVVEMiLCJ1dG1fc291cmNlIjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwibW0iOjAsImluaXRfc3RhcnRfbGF0ZW5jeSI6MS41NCwiaXNfdjIiOjAsImlzX3YyX2VtcHR5IjowLCJ1c2VyX2tleXdvcmRzIjoiRGVwb3NpdEZpbGVzJTJDRGVwb3NpdEZpbGVzJTJDcHJvdmlkZXMlMkN5b3UlMkN3aXRoJTJDYSUyQ2xlZ2l0aW1hdGUlMkN0ZWNobmljYWwlMkNzb2x1dGlvbiUyQ3doaWNoJTJDZW5hYmxlcyUyQ3lvdSUyQ3RvJTJDdXBsb2FkJTJDc3RvcmUlMkNhY2Nlc3MlMkNhbmQlMkNkb3dubG9hZCUyQ3RleHQlMkNzb2Z0d2FyZSUyQyUyQ3NjcmlwdHMlMkNpbWFnZXMlMkNzb3VuZHMlMkN2aWRlb3MlMkNhbmltYXRpb25zJTJDYW5kJTJDYW55JTJDb3RoZXIlMkNtYXRlcmlhbHMlMkNpbiUyQ2Zvcm0lMkNvZiUyQ29uZSUyQ29yJTJDc2V2ZXJhbCUyQ2VsZWN0cm9uaWMlMkNmaWxlcy4ifQ==
200 OK 0 B URL GET HTTP/2 b239c2088d.ff8467d480.com/in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI1MzYwMDExMzUxNDYwOTYwMDAwIiwidGltZXpvbmUiOjAsInZlciI6IjMuODAuMCIsInRhZ19pZCI6NDY0NDUsInNjcmVlbl9yZXNvbHV0aW9uIjoiMTI4MHgxMDI0IiwiYWRibG9jayI6MCwidGltZXpvbmVfb2xzb24iOiJVVEMiLCJ1dG1fc291cmNlIjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwibW0iOjAsImluaXRfc3RhcnRfbGF0ZW5jeSI6MS41NCwiaXNfdjIiOjAsImlzX3YyX2VtcHR5IjowLCJ1c2VyX2tleXdvcmRzIjoiRGVwb3NpdEZpbGVzJTJDRGVwb3NpdEZpbGVzJTJDcHJvdmlkZXMlMkN5b3UlMkN3aXRoJTJDYSUyQ2xlZ2l0aW1hdGUlMkN0ZWNobmljYWwlMkNzb2x1dGlvbiUyQ3doaWNoJTJDZW5hYmxlcyUyQ3lvdSUyQ3RvJTJDdXBsb2FkJTJDc3RvcmUlMkNhY2Nlc3MlMkNhbmQlMkNkb3dubG9hZCUyQ3RleHQlMkNzb2Z0d2FyZSUyQyUyQ3NjcmlwdHMlMkNpbWFnZXMlMkNzb3VuZHMlMkN2aWRlb3MlMkNhbmltYXRpb25zJTJDYW5kJTJDYW55JTJDb3RoZXIlMkNtYXRlcmlhbHMlMkNpbiUyQ2Zvcm0lMkNvZiUyQ29uZSUyQ29yJTJDc2V2ZXJhbCUyQ2VsZWN0cm9uaWMlMkNmaWxlcy4ifQ==
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectb239c2088d.ff8467d480.com
Fingerprint11:9C:4F:7C:0C:85:72:58:30:0F:DE:43:A5:AC:C5:A6:2F:3B:D3:C2
ValidityWed, 27 Sep 2023 02:50:21 GMT - Tue, 26 Dec 2023 02:50:20 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/track?data=eyJ3bCI6MCwic3ViaWQiOjAsInVzZXJfaWQiOiI1MzYwMDExMzUxNDYwOTYwMDAwIiwidGltZXpvbmUiOjAsInZlciI6IjMuODAuMCIsInRhZ19pZCI6NDY0NDUsInNjcmVlbl9yZXNvbHV0aW9uIjoiMTI4MHgxMDI0IiwiYWRibG9jayI6MCwidGltZXpvbmVfb2xzb24iOiJVVEMiLCJ1dG1fc291cmNlIjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwibW0iOjAsImluaXRfc3RhcnRfbGF0ZW5jeSI6MS41NCwiaXNfdjIiOjAsImlzX3YyX2VtcHR5IjowLCJ1c2VyX2tleXdvcmRzIjoiRGVwb3NpdEZpbGVzJTJDRGVwb3NpdEZpbGVzJTJDcHJvdmlkZXMlMkN5b3UlMkN3aXRoJTJDYSUyQ2xlZ2l0aW1hdGUlMkN0ZWNobmljYWwlMkNzb2x1dGlvbiUyQ3doaWNoJTJDZW5hYmxlcyUyQ3lvdSUyQ3RvJTJDdXBsb2FkJTJDc3RvcmUlMkNhY2Nlc3MlMkNhbmQlMkNkb3dubG9hZCUyQ3RleHQlMkNzb2Z0d2FyZSUyQyUyQ3NjcmlwdHMlMkNpbWFnZXMlMkNzb3VuZHMlMkN2aWRlb3MlMkNhbmltYXRpb25zJTJDYW5kJTJDYW55JTJDb3RoZXIlMkNtYXRlcmlhbHMlMkNpbiUyQ2Zvcm0lMkNvZiUyQ29uZSUyQ29yJTJDc2V2ZXJhbCUyQ2VsZWN0cm9uaWMlMkNmaWxlcy4ifQ== HTTP/1.1
Host: b239c2088d.ff8467d480.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-length: 0
server: nginx/1.18.0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 2f5c1a550568515b4da35e0c1b383f07
955de84ec0266592b0057401e7a75d3d39d97563
b5119237346dc0d4c0865cb03a3da64ff1020e184bb97ae8f781a05273cb01cc
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/img/close.png
200 OK 4.0 kB URL GET HTTP/3 cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/img/close.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
File type PNG image data, 500 x 500, 8-bit gray+alpha, non-interlaced\012- data
Hash 23e9690b0e7ac26868363a6248f44467
d7ad0eae64e0c1e65b12eda0aa9d2b91996dd64f
f362c67320d739ccf3bea21f857b9620075bd20ceacda8c51261b9612fe28395
GET /sb/notifications/binary/iqoption/msngr_1/us/1/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: image/png
content-length: 4022
last-modified: Wed, 23 Sep 2020 13:29:27 GMT
etag: "5f6b4db7-fb6"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 882426
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BB84wPDx04b0hy6keYmsV8sDYjEjzp6vUxfcw8VEx9m8TBC8CUzB2%2FNTc2zMLR3ULOGIa62WonGb9OWs6dA5LXP%2FkWADVxD9rebtH82au1s6sE5q4k4mEUQjG5LicuiUT4AM%2F%2BiqESdL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80e90adc480448af-LHR
alt-svc: h3=":443"; ma=86400
cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/img/icon-green.png
200 OK 14 kB URL GET HTTP/3 cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/img/icon-green.png
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
File type PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Hash e3e9c923d1aed798097c20110bb95828
76d6be356529adaf6670b9dea02fd1e7a393011d
72424503e0a71d269a3d5fa335e6c336bd195678d1bbcbdc421a31b035c7868b
GET /sb/notifications/binary/iqoption/msngr_1/us/1/img/icon-green.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: image/png
content-length: 13952
last-modified: Wed, 23 Sep 2020 13:29:27 GMT
etag: "5f6b4db7-3680"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 18534094
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W2Z055oaseO0XSxMc0zjLGSd5mzpxQjZU55FkFaqDy8JXFhwiN5b850TyIwYXUiacxYT10x64p6dNCKO1%2BKjq1hB8%2F%2B5bU4STG0gUQfTfJ4Iazqu3XJZYcY5rXmNocC%2FxlsS9RZYl3Uw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80e90adc480648af-LHR
alt-svc: h3=":443"; ma=86400
ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fcss%2Fanimate.css&l=79245&fd=231
200 OK 0 B URL GET HTTP/1.1 ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fcss%2Fanimate.css&l=79245&fd=231
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fcss%2Fanimate.css&l=79245&fd=231 HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:10 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
js.wpshsdk.com/npc/sdk/push.m.js?v=1
200 OK 15 kB URL GET HTTP/2 js.wpshsdk.com/npc/sdk/push.m.js?v=1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectjs.wpshsdk.com
Fingerprint65:A6:AD:10:F9:8F:FC:5C:ED:AC:21:F7:79:45:53:D9:14:3B:97:BF
ValidityFri, 22 Sep 2023 23:02:34 GMT - Thu, 21 Dec 2023 23:02:33 GMT
File type Unicode text, UTF-8 text, with very long lines (34293), with no line terminators
Hash 4062f537b647ce1165ecf1dbf276cb90
90d0855f9382c1351471f5533afa40fca5ac2488
334da8b0da17494c1012f72d1c43b7f197b9b851606d186b34429fbb70a1ca15
GET /npc/sdk/push.m.js?v=1 HTTP/1.1
Host: js.wpshsdk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Thu, 28 Sep 2023 13:41:07 GMT
etag: W/"65158273-8776"
content-encoding: gzip
expires: Sat, 30 Sep 2023 02:35:10 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash 2f5c1a550568515b4da35e0c1b383f07
955de84ec0266592b0057401e7a75d3d39d97563
b5119237346dc0d4c0865cb03a3da64ff1020e184bb97ae8f781a05273cb01cc
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 30 Sep 2023 02:30:10 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fcss%2Fstyle.css&l=4204&fd=251
200 OK 0 B URL GET HTTP/1.1 ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fcss%2Fstyle.css&l=4204&fd=251
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fcss%2Fstyle.css&l=4204&fd=251 HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:10 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 28 Sep 2023 04:50:55 GMT
expires: Fri, 27 Sep 2024 04:50:55 GMT
cache-control: public, max-age=31536000
age: 164355
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/css/animate.css
200 OK 21 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/css/animate.css
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
Hash 80047eaa13ebd50c50e8a9753621e430
9c503e07d130572a0eaf51f7c02cbd4cf6213fe3
3f831a59615f8d5d40b4340b2836f91438c876f8dbce75f78e38360d6fe0f429
GET /sb/notifications/binary/iqoption/msngr_1/us/1/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: text/css
last-modified: Wed, 23 Sep 2020 13:29:26 GMT
etag: W/"5f6b4db6-1358d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 60416
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qXcVWQBoHjMz8VRy92qGmeZYNl1gfk7RjQD9%2Bh%2FuU9vC7LtK7gg3DtjbS6IWD6u6GBh6q54EZJ1Tmb8IZPFMxg425ei7zTrrzx3LoOWJLc4j625SKOqlmHUgd8RpLTUQ%2Bx%2BTx99o8ov5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80e90adaabd3240f-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
200 OK 701 B URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintBE:40:3A:A6:DE:CC:A7:8B:75:43:68:F2:F9:56:63:71:49:61:06:49
ValidityMon, 04 Sep 2023 08:23:18 GMT - Mon, 27 Nov 2023 08:23:17 GMT
File type gzip compressed data, max compression\012- data
Hash 22380e1a2a53c82d46b0f02c0864e606
533ef8469b24020c3f44dd6f598f0d546ec349bf
d0c362cbc5f3c5fdcdcabab4cdb48a5fa5368086836188c36e30d9e1a2d5aa5d
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 30 Sep 2023 02:30:10 GMT
date: Sat, 30 Sep 2023 02:30:10 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ordinarilyinstead.com/pixel/sbs?c=1
200 OK 0 B URL GET HTTP/1.1 ordinarilyinstead.com/pixel/sbs?c=1
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbs?c=1 HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 30 Sep 2023 02:30:11 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
fp.metricswpsh.com/fp?tag_id=46445
204 No Content 0 B URL OPTIONS HTTP/1.1 fp.metricswpsh.com/fp?tag_id=46445
IP
ASN #24940 Hetzner Online GmbH
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectnotification.tubecup.net
Fingerprint09:1A:28:B6:ED:D8:3C:74:9A:C7:2C:25:55:18:EF:75:D1:DC:8D:13
ValidityTue, 12 Sep 2023 02:45:40 GMT - Mon, 11 Dec 2023 02:45:39 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /fp?tag_id=46445 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://dfiles.eu/
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx/1.20.1
Date: Sat, 30 Sep 2023 02:30:11 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
Access-Control-Allow-Origin: https://dfiles.eu
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
fp.metricswpsh.com/fp?tag_id=46445
204 No Content 58 B URL OPTIONS HTTP/1.1 fp.metricswpsh.com/fp?tag_id=46445
IP
ASN #24940 Hetzner Online GmbH
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectnotification.tubecup.net
Fingerprint09:1A:28:B6:ED:D8:3C:74:9A:C7:2C:25:55:18:EF:75:D1:DC:8D:13
ValidityTue, 12 Sep 2023 02:45:40 GMT - Mon, 11 Dec 2023 02:45:39 GMT
File type JSON data\012- , ASCII text
Hash 853a8b6897413696f6fb4b9a3556f079
24c7e87ff027c2597e21a0ba52791811a14ed396
e60ca237a39b830ed13a4544224ff16f2bbcf4630d3e94696f0687663719a85e
POST /fp?tag_id=46445 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 23168
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Sat, 30 Sep 2023 02:30:11 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://dfiles.eu
Set-Cookie: id=16663652765708145956; Expires=Sun, 29 Sep 2024 02:30:11 GMT; Secure; SameSite=None
Vary: Origin
unseenreport.com/pxf.gif?uuid=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=224ad4a14b4b15c1726ff705ec672ea6&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=224ad4a14b4b15c1726ff705ec672ea6&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
FingerprintBE:8C:78:D1:BA:58:B8:88:10:09:32:1D:31:7A:D9:4A:09:BF:6C:7A
ValiditySat, 23 Sep 2023 07:33:12 GMT - Fri, 22 Dec 2023 07:33:11 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=224ad4a14b4b15c1726ff705ec672ea6&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 30 Sep 2023 02:30:11 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c9a616a34ac931e8762af2bb488e388e
Strict-Transport-Security: max-age=0; includeSubdomains
unseenreport.com/pxf.gif?uuid=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=c22dc50dc2bbe4422c7f68d26ab95eb9&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2
200 OK 1 B URL GET HTTP/1.1 unseenreport.com/pxf.gif?uuid=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=c22dc50dc2bbe4422c7f68d26ab95eb9&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subject*.unseenreport.com
FingerprintBE:8C:78:D1:BA:58:B8:88:10:09:32:1D:31:7A:D9:4A:09:BF:6C:7A
ValiditySat, 23 Sep 2023 07:33:12 GMT - Fri, 22 Dec 2023 07:33:11 GMT
File type very short file (no magic)
Hash 93b885adfe0da089cdf634904fd59f71
5ba93c9db0cff93f52b521d7420e43f6eda2784f
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pxf.gif?uuid=fbcd94b3-78f3-4b0c-ab5d-f4d0b640ee5b&eb=a996fe56ed028c08f89591a4a8a9c431&te=4cb725660c43031e3b06c75892d96c5a&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A109.0)%20Gecko%2F20100101%20Firefox%2F111.0&dev=e&res=14.2079&b_frame=0&pk=c22dc50dc2bbe4422c7f68d26ab95eb9&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 30 Sep 2023 02:30:11 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5e96377f49be92e79975bbce65d6d201
Strict-Transport-Security: max-age=0; includeSubdomains
na.nawpush.com/tags/46445?version_name=a
200 OK 579 B URL GET HTTP/2 na.nawpush.com/tags/46445?version_name=a
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectna.nawpush.com
FingerprintBF:F8:18:90:BF:06:11:78:06:0C:10:B7:B5:E5:E6:D4:91:ED:0C:03
ValidityWed, 02 Aug 2023 23:02:35 GMT - Tue, 31 Oct 2023 23:02:34 GMT
File type troff or preprocessor input, ASCII text, with very long lines (656), with no line terminators
Hash 0243e0da104f07016e8f1413e1d042e1
906fd35bb0c7a85263803208deb3aa8c7b5a0bca
882adada4bd64aaff6ee6f3841d37293a55ed32a307d801ab8fe89c673a99d65
GET /tags/46445?version_name=a HTTP/1.1
Host: na.nawpush.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:08 GMT
content-type: application/json
content-length: 579
server: nginx/1.18.0
cache-control: max-age=300, public
x-proxy-cache: EXPIRED
access-control-allow-origin: *
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint3D:35:56:30:C0:0F:0C:7F:20:BA:7D:A8:48:DB:24:1B:15:F5:48:27
ValidityMon, 04 Sep 2023 08:23:09 GMT - Mon, 27 Nov 2023 08:23:08 GMT
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 29 Sep 2023 10:05:24 GMT
expires: Sat, 28 Sep 2024 10:05:24 GMT
cache-control: public, max-age=31536000
age: 59086
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/js/script.js
200 OK 386 B URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/js/script.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
File type ASCII text, with very long lines (399), with no line terminators
Hash 022602a468da44628060800173771da2
9be813fbfebbcb2aa46d8c6b8abec68b3d16c89c
6742c376e658c34d09b2dc5772bd798e3cd52bb265758bac5bce184f8ee7b5cc
GET /sb/notifications/binary/iqoption/msngr_1/us/1/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: application/javascript
last-modified: Wed, 23 Sep 2020 13:29:29 GMT
etag: W/"5f6b4db9-182"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1332709
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7oonkPHBEeWUFvWG8ilTbW2wAU8QhOyz0gruubcGZOHJoa8CcFhph9Y29acFVVTupW8MRgysCrUSbsjO4wz5enrKjyRSo6UivJeH7GEPHwKz1P2Oz%2Fm019MCGm7aMXgdxG4gAxNFdczK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80e90adacbe0240f-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
200 OK 21 kB URL User Request GET HTTP/2 dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
IP
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /files/n5u4t0er8/CStrike-16-CLASSIC.exe HTTP/1.1
Host: dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 30 Sep 2023 02:30:06 GMT
server: nginx
set-cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; path=/; domain=.dfiles.eu
last_file=n5u4t0er8; path=/; domain=.dfiles.eu
lang_current=en; expires=Sun, 29-Sep-2024 02:30:06 GMT; Max-Age=31536000; path=/; domain=.dfiles.eu; secure
x-frame-options: SAMEORIGIN
X-Firefox-Spdy: h2
cdn.barscreative1.com/sb/notifications/binary/iqoption/msngr_1/us/1/index.html
200 OK 1.1 kB URL GET HTTP/2 cdn.barscreative1.com/sb/notifications/binary/iqoption/msngr_1/us/1/index.html
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectcdn.barscreative1.com
FingerprintCB:0F:87:85:B0:83:8B:5C:86:E5:81:91:9D:F5:ED:C4:A2:B6:B1:BE
ValidityTue, 12 Sep 2023 01:01:21 GMT - Mon, 11 Dec 2023 01:01:20 GMT
File type HTML document text\012- HTML document, ASCII text, with very long lines (1163), with no line terminators
Hash 334ccfcec9fe42e45b0c223d950116f9
3f83d83031b249dfa05eb3df5a4c5a6e12d41516
1351e0a24b7a11c81c57587b69f89a43513b6aeec7520fba1d9e36ee090b7698
GET /sb/notifications/binary/iqoption/msngr_1/us/1/index.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Wed, 23 Sep 2020 13:29:25 GMT
etag: W/"5f6b4db5-44a"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Sat, 30 Sep 2023 03:30:10 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
adsbb.dfiles.eu//ad.php?z=56&c=NO
303 See Other 1.5 kB URL GET HTTP/2 adsbb.dfiles.eu//ad.php?z=56&c=NO
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdfiles.eu
Fingerprint73:8B:6E:11:8B:1A:0A:62:8B:36:6D:0E:47:AE:11:64:99:18:9A:3D
ValidityWed, 06 Sep 2023 05:19:12 GMT - Tue, 05 Dec 2023 05:19:11 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET //ad.php?z=56&c=NO HTTP/1.1
Host: adsbb.dfiles.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: uprand=42dd733329d8cd1d4a1c8fdb3ae248fb; last_file=n5u4t0er8; lang_current=en; _ga_BL9163LYG1=GS1.1.1696041008.1.0.1696041008.0.0.0; _ga=GA1.1.5144208.1696041008
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 303 See Other
content-type: text/html; charset=UTF-8
date: Sat, 30 Sep 2023 02:30:08 GMT
location: /upload/2112/ad27582685f5c72c.htm?canp=adv_73b411c406ca38ecadcf742fe6ade752
server: nginx
set-cookie: _nf56=1; expires=Sun, 01-Oct-2023 02:30:08 GMT; Max-Age=86400
x-powered-by: PHP/5.6.30-0+deb8u1
X-Firefox-Spdy: h2
js.wpadmngr.com/static/adManager.js
200 OK 1.4 kB URL GET HTTP/2 js.wpadmngr.com/static/adManager.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectjs.wpadmngr.com
Fingerprint04:CF:08:FC:86:05:83:D6:A9:F6:8F:DE:01:9D:01:44:61:5C:93:92
ValidityWed, 13 Sep 2023 02:02:43 GMT - Tue, 12 Dec 2023 02:02:42 GMT
File type ASCII text, with very long lines (1569), with no line terminators
Hash 887ab462d1f059c59612063112e4257b
2bbb4be64c73a46d0513aaf380cbf221b9bacd93
fac07a3cc5ea967ee6fe38ac26787a12c1cb26d5f101038fbca9ed8bc425e1a7
GET /static/adManager.js HTTP/1.1
Host: js.wpadmngr.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:07 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Thu, 14 Sep 2023 10:06:58 GMT
etag: W/"6502db42-598"
content-encoding: gzip
expires: Sat, 30 Sep 2023 02:35:07 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
ordinarilyinstead.com/sbar.json?key=224ad4a14b4b15c1726ff705ec672ea6
200 OK 5.4 kB URL GET HTTP/1.1 ordinarilyinstead.com/sbar.json?key=224ad4a14b4b15c1726ff705ec672ea6
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
File type ASCII text, with very long lines (5487), with no line terminators
Hash fe31dec2a39cf67cfc6338d7d176ebbb
a7acab3606503d5a104832aca5baa2ba0c8ee14e
162c52dd00c91b35fa6a73e66384274aba2eb5ebc1fadd038f200ca0195f9719
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sbar.json?key=224ad4a14b4b15c1726ff705ec672ea6 HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 30 Sep 2023 02:30:09 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://dfiles.eu
Access-Control-Allow-Origin: https://dfiles.eu
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=16004719; expires=Sun, 01 Oct 2023 02:30:09 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 01 Oct 2023 02:30:09 GMT; secure; SameSite=None
uncs=1; expires=Sun, 01 Oct 2023 02:30:09 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sun, 01 Oct 2023 02:30:09 GMT; secure; SameSite=None
uncs29=1; expires=Sun, 01 Oct 2023 02:30:09 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0c79a7fd3413baf3816bcfafb7018a20
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
storage.multstorage.com/log/count.html
200 OK 882 B URL GET HTTP/2 storage.multstorage.com/log/count.html
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectmultstorage.com
Fingerprint60:31:41:79:08:9C:90:BC:C9:A7:23:38:B0:34:0A:5D:AB:42:00:F7
ValidityFri, 22 Sep 2023 10:43:32 GMT - Thu, 21 Dec 2023 10:43:31 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (919), with no line terminators
Hash 053b1fe641da8057571d40ebaf1624ab
09b2648b7d08c84621298f0b939cea5170a65022
6606334874a3edb8295831f41d3684433e4553ffe0a72e58c90926e00f39c6a4
GET /log/count.html HTTP/1.1
Host: storage.multstorage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: text/html
last-modified: Mon, 18 Sep 2023 14:39:06 GMT
vary: Accept-Encoding
x-request-id: f5abc5cd02e4eb51dbd35468f9002cb7
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pwhS7CpvV%2B2gJpMeUXaxhm3JHKQn7z2cpLPujGVuvl4kr01AMGQKaKKHnWFLWLM4lxqZ7AC%2BDgPQ0VhQIqcMiEf1bC%2BHmbZVJBNp8f1I6xe0IXemJEm%2BAqPT9uTfO9doUJCRuskcKjyBlA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80e90ada3dbb7330-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
t.unblockia.com/?sid=140&o=3&b=2&p=1&t=1
200 OK 0 B URL POST HTTP/2 t.unblockia.com/?sid=140&o=3&b=2&p=1&t=1
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerAmazon
Subject*.unblockia.com
FingerprintF2:6F:03:00:E3:4A:B1:87:3C:4D:28:BB:E6:CE:8F:F1:2A:6E:1B:5D
ValidityTue, 21 Feb 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /?sid=140&o=3&b=2&p=1&t=1 HTTP/1.1
Host: t.unblockia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
content-type: application/json
content-length: 0
server: nginx/1.20.0
date: Sat, 30 Sep 2023 02:30:10 GMT
x-cache: Miss from cloudfront
via: 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 0Mgf6ozZkn3kg7GBoS75ccoF9yPuJ2QLl-RHwDmpfyQk8fZ4Wq3j_Q==
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2
www.google.com/recaptcha/api.js
200 OK 850 B URL GET HTTP/2 www.google.com/recaptcha/api.js
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintD2:77:FE:08:C6:61:6A:42:5C:1F:85:13:DA:23:B2:B8:46:20:45:88
ValidityMon, 04 Sep 2023 08:23:29 GMT - Mon, 27 Nov 2023 08:23:28 GMT
File type ASCII text, with very long lines (850), with no line terminators
Hash 4f9728d943ca29c2ea5685a544f9d88e
1d2650e9d27327e9ff4291bed9bd46e9b793266b
cf0c1c5141bdcfa9ee52ae70d3fd620333363b543cb459ea85d943b307fd7c8c
GET /recaptcha/api.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
expires: Sat, 30 Sep 2023 02:30:07 GMT
date: Sat, 30 Sep 2023 02:30:07 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
static.depositfiles.com/css/main.css
200 OK 194 kB URL GET HTTP/2 static.depositfiles.com/css/main.css
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectdepositfiles.com
Fingerprint89:8B:79:C9:43:28:6F:22:01:AC:10:16:D4:18:23:20:E4:DF:5A:DB
ValidityWed, 06 Sep 2023 05:19:39 GMT - Tue, 05 Dec 2023 05:19:38 GMT
Size 194 kB (194329 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /css/main.css HTTP/1.1
Host: static.depositfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: max-age=300
content-encoding: gzip
content-type: text/css
date: Sat, 30 Sep 2023 02:30:07 GMT
etag: W/"65154dac-2f719"
expires: Sat, 30 Sep 2023 02:35:07 GMT
last-modified: Thu, 28 Sep 2023 09:55:56 GMT
server: nginx
X-Firefox-Spdy: h2
cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/css/style.css
200 OK 4.2 kB URL GET HTTP/2 cdn.creative-bars1.com/sb/notifications/binary/iqoption/msngr_1/us/1/css/style.css
IP
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerGoogle Trust Services LLC
Subjectcreative-bars1.com
Fingerprint48:B7:50:3B:95:5B:52:CB:74:D5:D6:39:E2:DD:12:9D:05:51:D6:87
ValidityWed, 23 Aug 2023 16:10:20 GMT - Tue, 21 Nov 2023 16:10:19 GMT
File type ASCII text, with very long lines (4489), with no line terminators
Hash 17cb5372f92075171eee71dbaaf8a608
62388cb79aa48109ae34b593b5b1787f44e6c14e
6c352ccb566bd95566af19d5712db611d49db4ecb1b8037f5ebf5e11e7aeefc7
GET /sb/notifications/binary/iqoption/msngr_1/us/1/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dfiles.eu
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:10 GMT
content-type: text/css
last-modified: Fri, 27 Nov 2020 13:45:32 GMT
etag: W/"5fc102fc-106c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 1332709
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09tOeVQRdZ3eDqRZ8Kq9xCzD0j1qYzG%2B2xXisJo2wCU15YsNJEgjUj9QDtLrES5P%2FguzlCbts2%2FJM3EE6%2FIB7l7ADnwuLIAukejScdSwYy7sq4QtZNLRj5Ioy8D%2B24ehqZt3824ZAxVd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80e90adafc09240f-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
js.wpadmngr.com/static/adManager.m.js
200 OK 194 kB URL GET HTTP/2 js.wpadmngr.com/static/adManager.m.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectjs.wpadmngr.com
Fingerprint04:CF:08:FC:86:05:83:D6:A9:F6:8F:DE:01:9D:01:44:61:5C:93:92
ValidityWed, 13 Sep 2023 02:02:43 GMT - Tue, 12 Dec 2023 02:02:42 GMT
Size 194 kB (193626 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /static/adManager.m.js HTTP/1.1
Host: js.wpadmngr.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 30 Sep 2023 02:30:08 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0
last-modified: Fri, 29 Sep 2023 12:29:41 GMT
etag: W/"6516c335-2f45a"
content-encoding: gzip
expires: Sat, 30 Sep 2023 02:35:08 GMT
cache-control: max-age=300
x-proxy-cache: HIT
access-control-allow-origin: *
X-Firefox-Spdy: h2
ordinarilyinstead.com/impr.gif?sid=H4sIAAAAAAAC%2F1SSz2skRRTHq9ewB%2FWyriDCCnNTQSbdnZ4fcQ%2BycY0E42bdVfQm1VXVk2equ5qq7ulJ8BBckBzH%2F6DznWSDGpb1D1Bk4m1ByHjKwRyE%2FQNE2bPMJDj6oHnv%2B77v8Hmv6%2Bv98pz5KPnZ6odmh7Tmi62m33jjsyC42VinrBw0Bt325%2B3oZsP23w785ab%2FZuN9JbbMYugHvh%2F4QWOVrErMYDEIgqYPyo%2BXg%2Bay34zCZtCKMLD%2F16704LgH2T9nL4Hk5PnjRxFIjJGlj28rt1WY%2FK330lLzwlj05dEn2VZmqgzpvEyshyQ7upyGcaerP8FkhzNgmP6%2FgzFNmPf0D8TZ0SUl4v7hBWisoTLE8gVU%2FTGUHoP4GMI8AMlTBgiJOxvI0od3jK349oXLp%2B6ELTz7C1RN2MLvLyNLH61oGjTuG10WZDKHQVKDBmNQb4y8PEGxcwVUnUAUX4Hkr2zx2Tqy9GDDaQOS9Wx5ojEoGUOrIbjzUE4%2F8lAmHsrcQyrPGh0Rdbuy25JcCRHGSdBNoiRa5sJPhL%2B0HKIUU7whinwIoYcQdhe53cUWDWHLn%2BE2azjpwRUT5n20i76sUSmGyjFUnKEihqpgqPr1odQudPVDqV0ZB5c5vMxL9cgUvX1%2BaIqeyth%2Bfs6uze7yd9tgS501wjDiMuJBFEdx0BJBJ2wnScdvKdHuhIq34agGuSuzVXfo9HqOnE5fvIGYn8DpEwi6Bl6%2BBl6NOqEPvjmKuj52ssdS5cZRkZBWrilMCmlq5MUCim1vX5%2BzV2ccrz%2B9ASWesMuAsDVyW%2BML%2BoWhp%2FdG90zFDu6ZyrEfNvKCUtrh0393v%2BCFuvrdB2q7Mlau3XbDb2%2BJqTEtjz9WrljnmaSs59j3KySlsqvGCsV%2BXHOfqvhu6TZXSpuV%2Bfrdd1fX0twq58hkY3A6%2FbINQRN29dbh7FVe%2FzMC2TFsWSMt56RkxhD5Llw%2B7znDYPVcx7mHqqxHNoznTU0MWs01j2u4%2F%2Bh4Xu%2B7PfSsB148QJbW6NsafV2D6yFc%2BdyoyO2Td35bmgVi7Y1ibb2DWFv9zcVpHZ01hPAVD%2BJOoJRUrSUhorboxu1kKeqobku2ULiJemUv%2BAcAAP%2F%2FAQAA%2F%2F%2Fwv3ygYgQAAA%3D%3D
200 OK 0 B URL GET HTTP/1.1 ordinarilyinstead.com/impr.gif?sid=H4sIAAAAAAAC%2F1SSz2skRRTHq9ewB%2FWyriDCCnNTQSbdnZ4fcQ%2BycY0E42bdVfQm1VXVk2equ5qq7ulJ8BBckBzH%2F6DznWSDGpb1D1Bk4m1ByHjKwRyE%2FQNE2bPMJDj6oHnv%2B77v8Hmv6%2Bv98pz5KPnZ6odmh7Tmi62m33jjsyC42VinrBw0Bt325%2B3oZsP23w785ab%2FZuN9JbbMYugHvh%2F4QWOVrErMYDEIgqYPyo%2BXg%2Bay34zCZtCKMLD%2F16704LgH2T9nL4Hk5PnjRxFIjJGlj28rt1WY%2FK330lLzwlj05dEn2VZmqgzpvEyshyQ7upyGcaerP8FkhzNgmP6%2FgzFNmPf0D8TZ0SUl4v7hBWisoTLE8gVU%2FTGUHoP4GMI8AMlTBgiJOxvI0od3jK349oXLp%2B6ELTz7C1RN2MLvLyNLH61oGjTuG10WZDKHQVKDBmNQb4y8PEGxcwVUnUAUX4Hkr2zx2Tqy9GDDaQOS9Wx5ojEoGUOrIbjzUE4%2F8lAmHsrcQyrPGh0Rdbuy25JcCRHGSdBNoiRa5sJPhL%2B0HKIUU7whinwIoYcQdhe53cUWDWHLn%2BE2azjpwRUT5n20i76sUSmGyjFUnKEihqpgqPr1odQudPVDqV0ZB5c5vMxL9cgUvX1%2BaIqeyth%2Bfs6uze7yd9tgS501wjDiMuJBFEdx0BJBJ2wnScdvKdHuhIq34agGuSuzVXfo9HqOnE5fvIGYn8DpEwi6Bl6%2BBl6NOqEPvjmKuj52ssdS5cZRkZBWrilMCmlq5MUCim1vX5%2BzV2ccrz%2B9ASWesMuAsDVyW%2BML%2BoWhp%2FdG90zFDu6ZyrEfNvKCUtrh0393v%2BCFuvrdB2q7Mlau3XbDb2%2BJqTEtjz9WrljnmaSs59j3KySlsqvGCsV%2BXHOfqvhu6TZXSpuV%2Bfrdd1fX0twq58hkY3A6%2FbINQRN29dbh7FVe%2FzMC2TFsWSMt56RkxhD5Llw%2B7znDYPVcx7mHqqxHNoznTU0MWs01j2u4%2F%2Bh4Xu%2B7PfSsB148QJbW6NsafV2D6yFc%2BdyoyO2Td35bmgVi7Y1ibb2DWFv9zcVpHZ01hPAVD%2BJOoJRUrSUhorboxu1kKeqobku2ULiJemUv%2BAcAAP%2F%2FAQAA%2F%2F%2Fwv3ygYgQAAA%3D%3D
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /impr.gif?sid=H4sIAAAAAAAC%2F1SSz2skRRTHq9ewB%2FWyriDCCnNTQSbdnZ4fcQ%2BycY0E42bdVfQm1VXVk2equ5qq7ulJ8BBckBzH%2F6DznWSDGpb1D1Bk4m1ByHjKwRyE%2FQNE2bPMJDj6oHnv%2B77v8Hmv6%2Bv98pz5KPnZ6odmh7Tmi62m33jjsyC42VinrBw0Bt325%2B3oZsP23w785ab%2FZuN9JbbMYugHvh%2F4QWOVrErMYDEIgqYPyo%2BXg%2Bay34zCZtCKMLD%2F16704LgH2T9nL4Hk5PnjRxFIjJGlj28rt1WY%2FK330lLzwlj05dEn2VZmqgzpvEyshyQ7upyGcaerP8FkhzNgmP6%2FgzFNmPf0D8TZ0SUl4v7hBWisoTLE8gVU%2FTGUHoP4GMI8AMlTBgiJOxvI0od3jK349oXLp%2B6ELTz7C1RN2MLvLyNLH61oGjTuG10WZDKHQVKDBmNQb4y8PEGxcwVUnUAUX4Hkr2zx2Tqy9GDDaQOS9Wx5ojEoGUOrIbjzUE4%2F8lAmHsrcQyrPGh0Rdbuy25JcCRHGSdBNoiRa5sJPhL%2B0HKIUU7whinwIoYcQdhe53cUWDWHLn%2BE2azjpwRUT5n20i76sUSmGyjFUnKEihqpgqPr1odQudPVDqV0ZB5c5vMxL9cgUvX1%2BaIqeyth%2Bfs6uze7yd9tgS501wjDiMuJBFEdx0BJBJ2wnScdvKdHuhIq34agGuSuzVXfo9HqOnE5fvIGYn8DpEwi6Bl6%2BBl6NOqEPvjmKuj52ssdS5cZRkZBWrilMCmlq5MUCim1vX5%2BzV2ccrz%2B9ASWesMuAsDVyW%2BML%2BoWhp%2FdG90zFDu6ZyrEfNvKCUtrh0393v%2BCFuvrdB2q7Mlau3XbDb2%2BJqTEtjz9WrljnmaSs59j3KySlsqvGCsV%2BXHOfqvhu6TZXSpuV%2Bfrdd1fX0twq58hkY3A6%2FbINQRN29dbh7FVe%2FzMC2TFsWSMt56RkxhD5Llw%2B7znDYPVcx7mHqqxHNoznTU0MWs01j2u4%2F%2Bh4Xu%2B7PfSsB148QJbW6NsafV2D6yFc%2BdyoyO2Td35bmgVi7Y1ibb2DWFv9zcVpHZ01hPAVD%2BJOoJRUrSUhorboxu1kKeqobku2ULiJemUv%2BAcAAP%2F%2FAQAA%2F%2F%2Fwv3ygYgQAAA%3D%3D HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 30 Sep 2023 02:30:10 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f13571f1db7e9fd1141ec947144a48a9
Strict-Transport-Security: max-age=0; includeSubdomains
ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fjs%2Fscript.js&l=386&fd=247
200 OK 0 B URL GET HTTP/1.1 ordinarilyinstead.com/pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fjs%2Fscript.js&l=386&fd=247
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dfiles.eu/files/n5u4t0er8/CStrike-16-CLASSIC.exe
Certificate IssuerLet's Encrypt
Subjectordinarilyinstead.com
FingerprintB7:68:D7:83:99:21:11:21:F8:B5:F7:D3:95:E8:9C:9E:1F:81:1E:FC
ValidityWed, 27 Sep 2023 00:34:56 GMT - Tue, 26 Dec 2023 00:34:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /pixel/sbls?bv=22.33.5038&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fnotifications%2Fbinary%2Fiqoption%2Fmsngr_1%2Fus%2F1%2Fjs%2Fscript.js&l=386&fd=247 HTTP/1.1
Host: ordinarilyinstead.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dfiles.eu/
Cookie: u_pl=16004719; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 30 Sep 2023 02:30:10 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
91.226.124.106
142.250.74.131
104.19.133.76
157.90.84.242