Report - shopgrb.com/

Report Overview

Submitted URL
shopgrb.com/
IP
45.199.123.28
ASN
#134548 DXTL Tseung Kwan O Service
Submitted
2024-04-18 09:52:50
Access
public
Website Title
404 Not Found
Final URL
156.226.62.84/tz/404.html
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
shopgrb.com	unknown	unknown	No data	No data	382 B	2.0 kB	45.199.123.28
hm.baidu.com	8254	1999-10-11	2012-05-26	2024-04-18	1.1 kB	12 kB	14.215.183.79
156.226.62.84	unknown	unknown	2021-01-30	2022-12-21	1.8 kB	3.6 kB	156.226.62.84

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	156.226.62.84	Sinkholed
2024-04-18	medium	156.226.62.84	Sinkholed
2024-04-18	medium	156.226.62.84	Sinkholed
2024-04-18	medium	156.226.62.84	Sinkholed
2024-04-18	medium	156.226.62.84	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (8)

URL IP Response Size

shopgrb.com/

45.199.123.28

1.8 kB

URL
shopgrb.com/
IP
45.199.123.28:0
ASN
#134548 DXTL Tseung Kwan O Service

File type
HTML document, Unicode text, UTF-8 text, with very long lines (1509)
Size
1.8 kB (1819 bytes)
Hash
05ba24909147e7723212514e6c5c607a
a5d0286e667c5c4289f637d7e4a66be0af4d3106
22f8e71e883e64eb5a1b066a6f226e2fd4b11973297ab02f23811a92ccd9485d

HTTP Headers

GET / HTTP/1.1
Host: shopgrb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 09:52:26 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

hm.baidu.com/hm.js?03c51b41dc9bebeeb72fda19418a4c9b

14.215.183.79

11 kB

URL
hm.baidu.com/hm.js?03c51b41dc9bebeeb72fda19418a4c9b
IP
14.215.183.79:0
ASN
#4134 Chinanet

File type
JavaScript source, ASCII text, with very long lines (621)
Size
11 kB (11259 bytes)
Hash
027e80cda7e6abb66b34c10718e1e183
4721be73b6bf5d35d1b5e1d55caa3c938a2d346a
bd8161a4714325abdb0c88455f223dd3906bb485289119a731be20a8b5bd4cf8

HTTP Headers

GET /hm.js?03c51b41dc9bebeeb72fda19418a4c9b HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://shopgrb.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11259
Content-Type: application/javascript
Date: Thu, 18 Apr 2024 09:52:27 GMT
Etag: 1cc7fc98e49c559af9496c42d9a05ffe
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=05C0EB44B64CD8BD; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800

hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1222736340&si=03c51b41dc9bebeeb72fda19418a4c9b&v=1.3.0&lv=1&sn=21373&r=0&ww=1280&u=http%3A%2F%2Fshopgrb.com%2F&tt=%E5%8C%97%E4%BA%AC%E8%80%83%E9%A2%98%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

14.215.183.79

43 B

URL
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1222736340&si=03c51b41dc9bebeeb72fda19418a4c9b&v=1.3.0&lv=1&sn=21373&r=0&ww=1280&u=http%3A%2F%2Fshopgrb.com%2F&tt=%E5%8C%97%E4%BA%AC%E8%80%83%E9%A2%98%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
IP
14.215.183.79:0
ASN
#4134 Chinanet

File type
GIF image data, version 89a, 1 x 1
Size
43 B (43 bytes)
Hash
ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

HTTP Headers

GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=1024&et=0&ja=0&ln=en-us&lo=0&rnd=1222736340&si=03c51b41dc9bebeeb72fda19418a4c9b&v=1.3.0&lv=1&sn=21373&r=0&ww=1280&u=http%3A%2F%2Fshopgrb.com%2F&tt=%E5%8C%97%E4%BA%AC%E8%80%83%E9%A2%98%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://shopgrb.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Thu, 18 Apr 2024 09:52:28 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=BD2BC61FA8E24AE0; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff

156.226.62.84/

156.226.62.84

1.0 kB

URL
156.226.62.84/
IP
156.226.62.84:0
ASN
#135097 LUOGELANG FRANCE LIMITED

File type
HTML document, Unicode text, UTF-8 text
Size
1.0 kB (1030 bytes)
Hash
581f361db3ddddeb1abab8b9e9ab494b
4fa47bc445800eb2d8d47427c39f0ca5f25840f4
4d89b3416ed1774c34698ec42d640af1b9f1aeb18f96bccbb2b4242535c5bf12

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 156.226.62.84
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://shopgrb.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 09:52:32 GMT
Content-Type: text/html
Last-Modified: Thu, 28 Mar 2024 10:20:45 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6605447d-dad"
Content-Encoding: gzip

156.226.62.84/provjp.js

156.226.62.84

519 B

URL
156.226.62.84/provjp.js
IP
156.226.62.84:0
ASN
#135097 LUOGELANG FRANCE LIMITED

File type
ASCII text
Size
519 B (519 bytes)
Hash
1bb258570609f9299c4e0d09310a95e2
af15b46203b43068bf2c7d6ac90a0c8f99b3991e
42b9c6857d5341bb4e1c62c80933713671ca8218fb219090aa689213c4941a91

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /provjp.js HTTP/1.1
Host: 156.226.62.84
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://156.226.62.84/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 09:52:32 GMT
Content-Type: application/javascript
Last-Modified: Thu, 18 Apr 2024 04:40:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6620a44f-4e2"
Expires: Thu, 18 Apr 2024 21:52:32 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

156.226.62.84/static/css/style-m.css

156.226.62.84

500 B

URL
156.226.62.84/static/css/style-m.css
IP
156.226.62.84:0
ASN
#135097 LUOGELANG FRANCE LIMITED

File type
troff or preprocessor input, ASCII text
Size
500 B (500 bytes)
Hash
30e4858efeb6754f9d5d0d75f0a252e1
ad39dbde3135a03d53aff07d840b5e91829464c3
d9c319b51cea3c2be7f2fbd0bc162da286642c870f7b316f2a011869e2b7ef5d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/css/style-m.css HTTP/1.1
Host: 156.226.62.84
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://156.226.62.84/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 09:52:32 GMT
Content-Type: text/css
Last-Modified: Wed, 27 Mar 2024 11:08:08 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6603fe18-51d"
Expires: Thu, 18 Apr 2024 21:52:32 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

156.226.62.84/tz/404.html

156.226.62.84

146 B

URL User Request GET
156.226.62.84/tz/404.html
IP
156.226.62.84:0
ASN
#135097 LUOGELANG FRANCE LIMITED

File type
HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /tz/404.html HTTP/1.1
Host: 156.226.62.84
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://156.226.62.84/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 18 Apr 2024 09:52:33 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

156.226.62.84/favicon.ico

156.226.62.84

404 Not Found

146 B

URL GET HTTP/1.1
156.226.62.84/favicon.ico
IP
156.226.62.84:80
ASN
#135097 LUOGELANG FRANCE LIMITED

Requested by
http://156.226.62.84/tz/404.html

File type
HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 156.226.62.84
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://156.226.62.84/tz/404.html
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 18 Apr 2024 09:52:34 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (8)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers