Report - nmhgyt-dfd.com/3PVyK_4G/xK

Report Overview

Submitted URL
nmhgyt-dfd.com/3PVyK_4G/xK_W/index.html
IP
143.204.55.28
ASN
#16509 AMAZON-02
Submitted
2024-05-07 05:57:09
Access
public
Website Title
ギフト
Final URL
5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
5jv-qxp31.com	unknown	2024-01-27	2024-01-31	2024-02-29	5.2 kB	23 kB	103.30.254.195
www.yahoo.co.jp	89307	2019-09-27	2012-05-21	2024-04-29	612 B	11 kB	182.22.16.251
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-05-06	338 B	863 B	143.204.53.97
nmhgyt-dfd.com	unknown	2023-12-13	2023-12-14	2023-12-14	758 B	886 B	143.204.55.28

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-07	medium	nmhgyt-dfd.com	Sinkholed
2024-05-07	medium	nmhgyt-dfd.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (14)

URL IP Response Size

ocsp.r2m03.amazontrust.com/

143.204.53.97

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
143.204.53.97:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
a39656e3b154bf331db50a7b79599fe1
cb4ecd311d93d677fee1e63f1b8583b84dceb1b2
21fda9112c40b5ca3ecdbd00abd7b7e7c4438b93a9492e33ac967e574d8d65f5

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Tue, 07 May 2024 05:56:44 GMT
Server: ECAcc (amb/6AFD)
X-Cache: Miss from cloudfront
Via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: jtEfju-ZTR8vgrfzyt6YwGSbB8FE5PNs-nzc2QuKj5z7Dwz5ZjeslQ==

nmhgyt-dfd.com/3PVyK_4G/xK_W/index.html

143.204.55.28

302 Found

4 B

URL User Request GET HTTP/2
nmhgyt-dfd.com/3PVyK_4G/xK_W/index.html
IP
143.204.55.28:443
ASN
#16509 AMAZON-02

Certificate
IssuerAmazon
Subjectnmhgyt-dfd.com
Fingerprint95:49:A4:C9:93:E1:2B:23:7B:5A:47:5E:13:8C:70:0D:46:60:49:CC
ValidityThu, 29 Feb 2024 00:00:00 GMT - Sat, 29 Mar 2025 23:59:59 GMT

File type
ASCII text
Size
4 B (4 bytes)
Hash
ff4c8ff01d544500ea4bfea43e6108c1
3f3d2d8955322f325af6db2238355fa07007ebd9
545c38b0922de19734fbffde62792c37c2aef6a3216cfa472449173165220f7d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /3PVyK_4G/xK_W/index.html HTTP/1.1
Host: nmhgyt-dfd.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: text/html; charset=UTF-8
content-length: 4
location: https://5jv-qxp31.com/7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB
x-powered-by: PHP/7.4.33
date: Tue, 07 May 2024 05:56:46 GMT
server: lighttpd/1.4.54
x-cache: Miss from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: fIOhN9yrxLIbOt9Foe7x4famwGys9wBmnCAIKTy4jFzVB-Jh4rKmyA==
X-Firefox-Spdy: h2

5jv-qxp31.com/7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB

103.30.254.195

302 Found

236 B

URL User Request GET HTTP/1.1
5jv-qxp31.com/7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
HTML document, ASCII text
Size
236 B (236 bytes)
Hash
5f1f6d0c0caa39095eca847012acce56
ea7f41ba6425488260dd166682c6450da11f9c4c
138f62e4fc72af0e894723db1827031719d344de4b884ffc191f17c0d52f4258

HTTP Headers

GET /7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Tue, 07 May 2024 05:56:48 GMT
Location: https://5jv-qxp31.com/jump/?code=7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 236
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

5jv-qxp31.com/jump/?code=7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB

103.30.254.195

302 Moved Temporarily

20 B

URL User Request GET HTTP/1.1
5jv-qxp31.com/jump/?code=7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
gzip compressed data, from Unix
Size
20 B (20 bytes)
Hash
7029066c27ac6f5ef18d660d5741979a
46c6643f07aa7f6bfe7118de926b86defc5087c4
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

HTTP Headers

GET /jump/?code=7xK/9yKbzQeGSfm6cDMbEK9xO7mL8FK8BPfCvjAYaMB HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Tue, 07 May 2024 05:56:48 GMT
Server: Apache
Location: https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Content-Type: text/html;charset=ISO-8859-1
Set-Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539; Path=/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

nmhgyt-dfd.com/

143.204.55.3

0 B

URL
nmhgyt-dfd.com/
IP
143.204.55.3:0
ASN
#16509 AMAZON-02

Certificate
IssuerAmazon
Subjectnmhgyt-dfd.com
Fingerprint95:49:A4:C9:93:E1:2B:23:7B:5A:47:5E:13:8C:70:0D:46:60:49:CC
ValidityThu, 29 Feb 2024 00:00:00 GMT - Sat, 29 Mar 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: nmhgyt-dfd.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/7.4.33
Location: http://www.yahoo.co.jp/
Date: Tue, 07 May 2024 05:56:49 GMT
Server: lighttpd/1.4.54
X-Cache: Miss from cloudfront
Via: 1.1 1ca0323262515c9240c58fe69a9ac826.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: wgZrj3eTN_Phk1HzZOu-X6iaoAnTlL8TlcVaksFNa4nxN1UmUDAgmA==

www.yahoo.co.jp/

182.22.16.251

1 B

URL
www.yahoo.co.jp/
IP
182.22.16.251:0
ASN
#23816 Yahoo Japan Corporation

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
7215ee9c7d9dc229d2921a40e899ec5f
b858cb282617fb0956d960215c8e84d1ccf909c6
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

HTTP Headers

GET / HTTP/1.1
Host: www.yahoo.co.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Redirect
Date: Tue, 07 May 2024 05:56:49 GMT
Connection: keep-alive
Cache-Control: no-store
Location: https://www.yahoo.co.jp:443/
Content-Type: text/html
Content-Language: en
X-Z-Chihaya: r=1
Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
Permissions-Policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*, unload=()
Content-Length: 1

5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587

103.30.254.195

200 OK

2.0 kB

URL User Request GET HTTP/1.1
5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
2.0 kB (1978 bytes)
Hash
99677fe3b8bac8208f3c5e12b89595a4
451e9763096bf57361cfa6a1eeb2ea43af60b54c
80cc7f1642fdad99763079c01dea1cdde4cf0de32d1bba4eb9c9fe8f36957c2f

HTTP Headers

GET /mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587 HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 05:56:49 GMT
Server: Apache
Content-Type: text/html;charset=UTF-8
Content-Language: ja-JP
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

5jv-qxp31.com/styles/usr.css

103.30.254.195

200 OK

57 B

URL GET HTTP/1.1
5jv-qxp31.com/styles/usr.css
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Requested by
https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
ASCII text, with CRLF line terminators
Size
57 B (57 bytes)
Hash
a4994603d8c13d09255c71f2ecddabb5
56682b874737cf0099d3d2a599411076bdf745e3
a59934e45f5317549289ab7970eabbd5583444e80cda0faabe4105e4ae1bc00f

HTTP Headers

GET /styles/usr.css HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 05:56:50 GMT
Server: Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/1.0.2d PHP/5.4.44
Last-Modified: Mon, 06 Dec 2021 07:38:15 GMT
ETag: "3320858-25-5d27556ee07c0"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: private, max-age=100
Content-Length: 57
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/css/common.css

103.30.254.195

200 OK

2.5 kB

URL GET HTTP/1.1
5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/css/common.css
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Requested by
https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size
2.5 kB (2488 bytes)
Hash
35070052f315fe1ed7447acdd4b03673
9c3d30f24f90f76f96a117a4c87c96a6b60bedf7
2c65af0adfbb65ae6c55611977512680fecedf587b50c16bbc2f07c87f6733a4

HTTP Headers

GET /freefiles/83r7a7pn/giht/PC/css/common.css HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 05:56:50 GMT
Server: Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/1.0.2d PHP/5.4.44
Last-Modified: Sat, 20 Jan 2024 08:39:40 GMT
ETag: "27100b0-29e9-60f5c89964b00"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: private, max-age=100
Content-Length: 2488
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/css

www.yahoo.co.jp/

182.22.16.251

10 kB

URL
www.yahoo.co.jp/
IP
182.22.16.251:0
ASN
#23816 Yahoo Japan Corporation

File type
HTML document, Unicode text, UTF-8 text, with very long lines (486)
Size
10 kB (10051 bytes)
Hash
bf7ebe1cc45db5a11337e505248ca4f8
ca46580e39a792218e8a0adc5a3e6e25dc11ee1f
ae97b45362096c079f51de99d60833ee729b9daca0d414bf20dd797395b4717b

HTTP Headers

GET / HTTP/1.1
Host: www.yahoo.co.jp
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Tue, 07 May 2024 05:56:50 GMT
x-z-chihaya: r=1
x-frame-options: SAMEORIGIN
content-length: 10051
content-type: text/html
X-Firefox-Spdy: h2

5jv-qxp31.com/favicon.ico

103.30.254.195

404 Not Found

22 B

URL GET HTTP/1.1
5jv-qxp31.com/favicon.ico
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Requested by
https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
ASCII text, with no line terminators
Size
22 B (22 bytes)
Hash
23b58def11b45727d3351702515f86af
099600a10a944114aac406d136b625fb416dd779
6c179f21e6f62b629055d8ab40f454ed02e48b68563913473b857d3638e23b28

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Tue, 07 May 2024 05:56:50 GMT
Server: Apache
Content-Type: text/html;charset=ISO-8859-1
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 22
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/image/logo.png

103.30.254.195

200 OK

15 kB

URL GET HTTP/1.1
5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/image/logo.png
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Requested by
https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
PNG image data, 241 x 75, 8-bit/color RGBA, non-interlaced
Size
15 kB (15233 bytes)
Hash
33353103df24eec6b03ad129993f1271
4b3ff4271dac816834176fa2c4c6b770bcd1c0b1
abc32d0b50e0940d785b2516a2471066770f9fc3893cc5b6dd3bd7352181dcad

HTTP Headers

GET /freefiles/83r7a7pn/giht/PC/image/logo.png HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 05:56:50 GMT
Server: Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/1.0.2d PHP/5.4.44
Last-Modified: Sat, 20 Jan 2024 08:39:40 GMT
ETag: "27100ab-3b81-60f5c89964b00"
Accept-Ranges: bytes
Content-Length: 15233
Cache-Control: private, max-age=100
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png

5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/image/login_arrow.gif

103.30.254.195

200 OK

60 B

URL GET HTTP/1.1
5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/image/login_arrow.gif
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Requested by
https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
GIF image data, version 89a, 10 x 10
Size
60 B (60 bytes)
Hash
55aa2af5c8935b2baf5b1c0cb5555f3b
b974ff6ef3d8faee918c1b193d1b198e1df2e8ea
c9b5e6805f5f307d3b1d19ca14b3fdcc9773cf9cc1123c467ec1d91aff5d98fe

HTTP Headers

GET /freefiles/83r7a7pn/giht/PC/image/login_arrow.gif HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/css/common.css
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 05:56:51 GMT
Server: Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/1.0.2d PHP/5.4.44
Last-Modified: Sat, 20 Jan 2024 08:39:40 GMT
ETag: "2710099-3c-60f5c89964b00"
Accept-Ranges: bytes
Content-Length: 60
Cache-Control: private, max-age=100
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/gif

5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/image/list_circle.gif

103.30.254.195

200 OK

54 B

URL GET HTTP/1.1
5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/image/list_circle.gif
IP
103.30.254.195:443
ASN
#9919 New Century InfoComm Tech Co., Ltd.

Requested by
https://5jv-qxp31.com/mail/view?id=104267988&mailid=m5624702040&loginkey=c3e3db80128b9eacc6e2f761922abe914a9d1f1f53ec75a950a588e0ec2a5587
Certificate
IssuerLet's Encrypt
Subjectgi.gi-f-t.com
Fingerprint4A:E0:C5:BC:B8:15:DE:97:0F:AC:F2:94:2E:B3:2C:39:0C:60:A0:31
ValidityMon, 01 Apr 2024 00:32:17 GMT - Sun, 30 Jun 2024 00:32:16 GMT

File type
GIF image data, version 89a, 8 x 8
Size
54 B (54 bytes)
Hash
10e9dd63bf37353f8a209f348c07a3cc
71ac6a22118518f2833a1ed6a25e46ea13d39000
f6fe383a6a9365c9f95bdd874694a80eab325ebf585ae71ea751865556188557

HTTP Headers

GET /freefiles/83r7a7pn/giht/PC/image/list_circle.gif HTTP/1.1
Host: 5jv-qxp31.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5jv-qxp31.com/freefiles/83r7a7pn/giht/PC/css/common.css
Cookie: JSESSIONID=8C6C637E37597CCB9B2E005C88932539
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 05:56:53 GMT
Server: Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/1.0.2d PHP/5.4.44
Last-Modified: Sat, 20 Jan 2024 08:39:40 GMT
ETag: "2710098-36-60f5c89964b00"
Accept-Ranges: bytes
Content-Length: 54
Cache-Control: private, max-age=100
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (14)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type