Domain > ancient-scene-d12c.i1ho1w.workers.dev

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2026-01-25	172.67.177.63 (ClassC)

HTTP/1.1 200 OKDate: Sun, 25 Jan 2026 21:45:49 GMTContent-Type: text/html;charsetUTF-8Content-Length: 2338Connection: keep-aliveVary: accept-encodingReport-To: {group:cf-nel,max_age:604800,endpoints:{url:https://a.nel.cloudflare.com/report/v4?sL6Ui7lCl3w9dgLoG%2B4w9%2BJ%2Fkt%2Bwq7Pje0fuTmX%2Bdc0taXF4Jc4t8bw0kPzH2vidSr%2FgjUy8saKOhfixJ%2FaIMRernsT%2FmuqF7YRAGTdTHVwUhfMB%2B1VVmJnDdPiegs6ETdCfa}}Nel: {report_to:cf-nel,success_fraction:0.0,max_age:604800}Server: cloudflareCF-RAY: 9c3af5b27f84efe2-PDXalt-svc: h3:443; ma86400

!DOCTYPE html>html langen>head>  meta charsetUTF-8>  meta nameviewport contentwidthdevice-width, initial-scale1.0>  title>TLS Config Refiner/title>  style>    body { font-family: Arial, sans-serif; margin: 20px; }    input, textarea { width: 100%; padding: 10px; margin: 10px 0; }    button { padding: 10px 20px; background-color: #007bff; color: white; border: none; cursor: pointer; }    button:hover { background-color: #0056b3; }    textarea { resize: vertical; min-height: 150px; }    .output-box { position: relative; }    .copy-btn { position: absolute; right: 10px; top: 10px; background: #007bff; color: white; padding: 5px; cursor: pointer; border: none; font-size: 12px; }  /style>/head>body>  h2>TLS Config Refiner/h2>  label forconfig>Enter your proxy config (Vmess, Vless, Trojan):/label>  textarea idconfig placeholdervmess://...>/textarea>    label forclean-ip>Clean IP Address:/label>  input typetext idclean-ip value162.159.195.189>  button idrefine-btn>Refine/button>    h3>Refined Config:/h3>  div classoutput-box>    textarea idrefined-config readonly>/textarea>    button classcopy-btn idcopy-btn>Copy/button>  /div>  script>    document.getElementById(refine-btn).addEventListener(click, async () > {      const config  document.getElementById(config).value.trim();      const cleanIp  document.getElementById(clean-ip).value.trim();      try {        const response  await fetch(window.location.href, {          method: POST,          body: new URLSearchParams({ config, cleanIp }),        });                const result  await response.json();        if (response.ok) {          document.getElementById(refined-config).value  result.refinedConfig;        } else {          document.getElementById(refined-config).value  result.error;        }      } catch (error) {        document.getElementById(refined-config).value  Error:  + error.message;      }    });    document.getElementById(copy-btn).addEventListener(click, () > {      const refinedConfig  document.getElementById(refined-config);      refinedConfig.select();      document.execCommand(copy);      alert(Config copied to clipboard);    });  /script>/body>/html>

Port 443

HTTP/1.1 200 OKDate: Sun, 25 Jan 2026 21:45:49 GMTContent-Type: text/html;charsetUTF-8Content-Length: 2338Connection: keep-aliveVary: accept-encodingReport-To: {group:cf-nel,max_age:604800,endpoints:{url:https://a.nel.cloudflare.com/report/v4?sjpqfo7TaDfN08juMFcjQ22EIM3h5bYJopvtR2hnplBDYqh8QxgAufxPWMv%2BNECE6rzIeSx5FnIshXo3ET9WKP9uJ66xX4HJUXyKS%2BxKX%2BX0SOhc9JDa7oApV6TnKinmnOYDe}}Nel: {report_to:cf-nel,success_fraction:0.0,max_age:604800}Server: cloudflareCF-RAY: 9c3af5b3882defe2-PDXalt-svc: h3:443; ma86400

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > ancient-scene-d12c.i1ho1w.workers.dev

Is this malicious?

DNS Resolutions

Port 80

Port 443