Report - terfas.ru/5YxNDSVX

Report Overview

Submitted URL
terfas.ru/5YxNDSVX
IP
185.198.164.116
ASN
#21100 ITL LLC
Submitted
2024-05-10 12:48:52
Access
public
Website Title
r.secprf.com/v1/redirect?url=http%3A%2F%2Fwww.dyrekassen.no&api_key=6e214a2e5eaa4f87f699b7c54a542a6a&type=url&source=https%3A%2F%2Fwww.linkbux.com&site_id=2588750acba045468d0d6283a3c3afec&yk_tag=lb_4zk3uaz
Final URL
r.secprf.com/v1/redirect?url=http%3A%2F%2Fwww.dyrekassen.no&api_key=6e214a2e5eaa4f87f699b7c54a542a6a&type=url&source=https%3A%2F%2Fwww.linkbux.com&site_id=2588750acba045468d0d6283a3c3afec&yk_tag=lb_4zk3uaz
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
track.jajaloop.com	unknown	2024-03-28	2024-03-31	2024-05-04	589 B	1.1 kB	143.204.55.106
terfas.ru	unknown	2023-08-16	2023-08-16	2024-03-16	472 B	796 B	185.198.164.116
mdakky.com	unknown	2023-10-12	2023-10-13	2024-05-09	515 B	184 B	185.162.85.3
xml-eu.yellow-resultsbidder.com	unknown	2023-07-05	2023-08-08	2024-04-29	507 B	295 B	77.245.57.64
r.secprf.com	unknown	2021-10-28	2022-06-02	2024-04-30	694 B	442 B	54.154.136.171
arbgsu.com	unknown	unknown	No data	No data	575 B	344 kB	185.162.87.220
wokoez.com	unknown	2024-02-05	2024-02-06	2024-04-11	1.0 kB	824 B	185.162.85.19
status.rapidssl.com	6946	2002-04-05	2018-06-15	2024-05-09	331 B	733 B	192.229.221.95
www.linkbux.com	157995	2017-05-31	2020-06-14	2024-05-05	633 B	1.0 kB	163.181.1.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-10	medium	mdakky.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

terfas.ru/5YxNDSVX

185.198.164.116

302 Found

0 B

URL User Request GET HTTP/1.1
terfas.ru/5YxNDSVX
IP
185.198.164.116:443
ASN
#21100 ITL LLC

Certificate
IssuerLet's Encrypt
Subjectterfas.ru
FingerprintB3:B7:1F:CD:A1:D8:1F:46:F6:5B:84:AD:B7:32:CC:01:77:3B:DD:4B
ValiditySat, 13 Apr 2024 15:35:31 GMT - Fri, 12 Jul 2024 15:35:30 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /5YxNDSVX HTTP/1.1
Host: terfas.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 10 May 2024 12:48:27 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Expires: Fri, 10 May 2024 12:48:27 GMT
Location: https://arbgsu.com/porno-land?h=waWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTMsInNyYyI6Mn0=eyJ&clickid=376l60j1gbd9b&si1=
Set-Cookie: _subid=376l60j1gbd9b; expires=Mon, 10 Jun 2024 12:48:27 GMT; path=/
0b21f=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMyNTUxNzdcIjoxNzE1MzQ1MzA3fSxcImNhbXBhaWduc1wiOntcIjExNFwiOjE3MTUzNDUzMDd9LFwidGltZVwiOjE3MTUzNDUzMDd9In0.VOlkZ5Gy5eSWixR0oGuAHidjn_XD8h2js7vaVCDucDc; expires=Mon, 19 Sep 2078 01:36:54 GMT; path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *

mdakky.com/rpe?a=1&s=1&act=18&src=2&p=1009992&st=1178361&wd=409593&d=arbgsu.com&tpl=80&rnd=0.7812502541593215&sbid=&sbid2=

185.162.85.3

200 OK

0 B

URL GET HTTP/2
mdakky.com/rpe?a=1&s=1&act=18&src=2&p=1009992&st=1178361&wd=409593&d=arbgsu.com&tpl=80&rnd=0.7812502541593215&sbid=&sbid2=
IP
185.162.85.3:443
ASN
#39572 DataWeb Global Group B.V.

Requested by
https://arbgsu.com/porno-land?h=waWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTMsInNyYyI6Mn0=eyJ&clickid=376l60j1gbd9b&si1=
Certificate
IssuerLet's Encrypt
Subjectmdakky.com
Fingerprint7A:0C:72:D0:A6:FD:F3:07:52:09:F5:25:14:D7:80:14:BA:76:A9:B5
ValiditySun, 07 Apr 2024 22:40:39 GMT - Sat, 06 Jul 2024 22:40:38 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rpe?a=1&s=1&act=18&src=2&p=1009992&st=1178361&wd=409593&d=arbgsu.com&tpl=80&rnd=0.7812502541593215&sbid=&sbid2= HTTP/1.1
Host: mdakky.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://arbgsu.com
DNT: 1
Connection: keep-alive
Referer: https://arbgsu.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 10 May 2024 12:48:28 GMT
content-length: 0
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2

wokoez.com/cuclc?aid=6975987563009491549&t=1715345308&s=37

185.162.85.19

302 Found

182 B

URL User Request GET HTTP/2
wokoez.com/cuclc?aid=6975987563009491549&t=1715345308&s=37
IP
185.162.85.19:443
ASN
#39572 DataWeb Global Group B.V.

Certificate
IssuerLet's Encrypt
Subjectwokoez.com
Fingerprint4C:70:8E:53:1E:93:17:BF:C6:1C:D6:0D:98:EE:A0:92:CE:0A:12:95
ValidityThu, 04 Apr 2024 20:05:01 GMT - Wed, 03 Jul 2024 20:05:00 GMT

File type
HTML document, ASCII text, with no line terminators
Size
182 B (182 bytes)
Hash
c28b3bd303b87cd7f2366acccbc29d61
c8bd91c94e75dbaeaf71a0a67f62a140eb725fd2
f3d4c63c3defa18cc26d1311a54280ed3f2e4d6aa8067840e5bd1b59bad2e1ee

HTTP Headers

GET /cuclc?aid=6975987563009491549&t=1715345308&s=37 HTTP/1.1
Host: wokoez.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://arbgsu.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx/1.18.0
date: Fri, 10 May 2024 12:48:28 GMT
content-type: text/html; charset=utf-8
content-length: 182
location: http://xml-eu.yellow-resultsbidder.com/click?i=Cjbvl6i6O0E_0
X-Firefox-Spdy: h2

xml-eu.yellow-resultsbidder.com/click?i=Cjbvl6i6O0E_0

77.245.57.64

302 Found

0 B

URL User Request GET HTTP/1.1
xml-eu.yellow-resultsbidder.com/click?i=Cjbvl6i6O0E_0
IP
77.245.57.64:443
ASN
#36057 WEBAIR-INTERNET-MTL

Certificate
IssuerLet's Encrypt
Subjectyellow-resultsbidder.com
FingerprintBC:AE:5D:E8:4C:F1:C3:73:17:2A:0B:3D:1E:B1:E7:9E:D7:3E:A8:9E
ValidityMon, 29 Apr 2024 06:58:09 GMT - Sun, 28 Jul 2024 06:58:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click?i=Cjbvl6i6O0E_0 HTTP/1.1
Host: xml-eu.yellow-resultsbidder.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx
Date: Fri, 10 May 2024 12:48:28 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Location: https://track.jajaloop.com/717a0983-e961-4ed5-98dc-35fbb30c40f8?banner=6354964&pubfeed=643353&siteid=1178361&cost=0.0005&conversion=fa7pjhgE5Lc

track.jajaloop.com/717a0983-e961-4ed5-98dc-35fbb30c40f8?banner=6354964&pubfeed=643353&siteid=1178361&cost=0.0005&conversion=fa7pjhgE5Lc

143.204.55.106

302 Found

0 B

URL User Request GET HTTP/2
track.jajaloop.com/717a0983-e961-4ed5-98dc-35fbb30c40f8?banner=6354964&pubfeed=643353&siteid=1178361&cost=0.0005&conversion=fa7pjhgE5Lc
IP
143.204.55.106:443
ASN
#16509 AMAZON-02

Certificate
IssuerAmazon
Subjecttrack.jajaloop.com
FingerprintB2:8B:F7:DA:FA:DB:BD:98:DB:88:6D:5F:F8:30:A6:60:19:63:73:FE
ValidityWed, 17 Apr 2024 00:00:00 GMT - Fri, 16 May 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /717a0983-e961-4ed5-98dc-35fbb30c40f8?banner=6354964&pubfeed=643353&siteid=1178361&cost=0.0005&conversion=fa7pjhgE5Lc HTTP/1.1
Host: track.jajaloop.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-length: 0
location: https://www.linkbux.com/track/b5b20v1WkH7yi3TVxNZSP_bZiP8BiX_bmVlpBSmwsA0XJAnB4zpMQWeZu6ygAKfBA4KJDLBkXLkA_c_c?url=http%3A%2F%2Fwww.dyrekassen.no&uid=wqn6u4rqpg3dgk613a3o2be8&uid2=6354964
date: Fri, 10 May 2024 12:48:29 GMT
cache-control: no-store, no-cache, pre-check=0, post-check=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: 717a0983-e961-4ed5-98dc-35fbb30c40f8-v4=ejnV0c74vNLvNHvvhVA9xPJoCJorE3CkbgCRpX_3dok; Max-Age=86400; Expires=Sat, 11-May-2024 12:48:29 GMT; Domain=track.jajaloop.com; Path=/; Secure; HttpOnly;SameSite=None
voluum-cid-v4=%7B%22cid%22%3A%22wqn6u4rqpg3dgk613a3o2be8%22%2C%22caid%22%3A%22717a0983-e961-4ed5-98dc-35fbb30c40f8%22%7D; Max-Age=31536000; Expires=Sat, 10-May-2025 12:48:29 GMT; Domain=track.jajaloop.com; Path=/; Secure; HttpOnly;SameSite=None
server: nginx
x-cache: Miss from cloudfront
via: 1.1 6cb1d4b545e7beb4ead790454f4807c6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 1zQDnkmTu-5x-v2KQnea4W2bYEIev3mtHAYYgNdaYGxdV_Y-m7r5sA==
X-Firefox-Spdy: h2

status.rapidssl.com/

192.229.221.95

471 B

URL
status.rapidssl.com/
IP
192.229.221.95:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
544a2a8692953cbe54b9642919458054
a176cd13df3f16d6d35598c773b5d496e6179d83
164d8944e6d776379770a06bc481f72f0671b3703963e325a71476a948b0fe13

HTTP Headers

POST / HTTP/1.1
Host: status.rapidssl.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 77
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Fri, 10 May 2024 12:48:29 GMT
Last-Modified: Fri, 10 May 2024 12:47:12 GMT
Server: ECAcc (ska/F775)
X-Cache: HIT
Content-Length: 471

www.linkbux.com/track/b5b20v1WkH7yi3TVxNZSP_bZiP8BiX_bmVlpBSmwsA0XJAnB4zpMQWeZu6ygAKfBA4KJDLBkXLkA_c_c?url=http%3A%2F%2Fwww.dyrekassen.no&uid=wqn6u4rqpg3dgk613a3o2be8&uid2=6354964

163.181.1.226

200 OK

551 B

URL User Request GET HTTP/1.1
www.linkbux.com/track/b5b20v1WkH7yi3TVxNZSP_bZiP8BiX_bmVlpBSmwsA0XJAnB4zpMQWeZu6ygAKfBA4KJDLBkXLkA_c_c?url=http%3A%2F%2Fwww.dyrekassen.no&uid=wqn6u4rqpg3dgk613a3o2be8&uid2=6354964
IP
163.181.1.226:443
ASN
#24429 Zhejiang Taobao Network Co.,Ltd

Certificate
IssuerDigiCert Inc
Subject*.linkbux.com
Fingerprint85:43:2D:A8:86:CB:B4:03:47:26:A7:87:5A:80:9D:1E:E1:55:C2:92
ValidityWed, 26 Jul 2023 00:00:00 GMT - Thu, 08 Aug 2024 23:59:59 GMT

File type
HTML document, ASCII text
Size
551 B (551 bytes)
Hash
bbf0119b484d232b6411f12d0daa9052
6c44f060eea256924c0795e9171c885ac5751794
affeb512df3cf7e4afef0a4a4b07d7963466f0cfa9268877ead274cc09ad30d3

HTTP Headers

GET /track/b5b20v1WkH7yi3TVxNZSP_bZiP8BiX_bmVlpBSmwsA0XJAnB4zpMQWeZu6ygAKfBA4KJDLBkXLkA_c_c?url=http%3A%2F%2Fwww.dyrekassen.no&uid=wqn6u4rqpg3dgk613a3o2be8&uid2=6354964 HTTP/1.1
Host: www.linkbux.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Tengine
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 10 May 2024 12:48:29 GMT
Vary: Accept-Encoding
Set-Cookie: discuz_2132_saltkey=9YFPjz72; expires=Sun, 09-Jun-2024 12:48:29 GMT; Max-Age=2592000; path=/; httponly
discuz_2132_lang=en; path=/
discuz_2132_lang=en; path=/
Content-Encoding: gzip
Via: cache31.l2us2[122,0], cache10.ru6[310,0]
Timing-Allow-Origin: *
EagleId: a3b5019e17153453095262710e

r.secprf.com/v1/redirect?url=http%3A%2F%2Fwww.dyrekassen.no&api_key=6e214a2e5eaa4f87f699b7c54a542a6a&type=url&source=https%3A%2F%2Fwww.linkbux.com&site_id=2588750acba045468d0d6283a3c3afec&yk_tag=lb_4zk3uaz

54.154.136.171

403 Forbidden

64 B

URL User Request GET HTTP/2
r.secprf.com/v1/redirect?url=http%3A%2F%2Fwww.dyrekassen.no&api_key=6e214a2e5eaa4f87f699b7c54a542a6a&type=url&source=https%3A%2F%2Fwww.linkbux.com&site_id=2588750acba045468d0d6283a3c3afec&yk_tag=lb_4zk3uaz
IP
54.154.136.171:443
ASN
#16509 AMAZON-02

Certificate
IssuerLet's Encrypt
Subjectlinksprf.com
FingerprintFB:04:66:40:AF:53:56:65:25:C8:A3:54:2D:ED:20:75:A5:4C:EB:58
ValidityThu, 02 May 2024 08:32:50 GMT - Wed, 31 Jul 2024 08:32:49 GMT

File type
JSON text data
Size
64 B (64 bytes)
Hash
cff81841520c4fe3df6ac55eac2928eb
804bd29529505fb1ca20f33b6c86828d7b445c54
8e8bdef1d7ea08d573f403d48f80ea5e08e578a672ea9ea4a1ae9b2ab1e4bdda

HTTP Headers

GET /v1/redirect?url=http%3A%2F%2Fwww.dyrekassen.no&api_key=6e214a2e5eaa4f87f699b7c54a542a6a&type=url&source=https%3A%2F%2Fwww.linkbux.com&site_id=2588750acba045468d0d6283a3c3afec&yk_tag=lb_4zk3uaz HTTP/1.1
Host: r.secprf.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.linkbux.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Fri, 10 May 2024 12:48:30 GMT
content-type: application/json
content-length: 64
set-cookie: ykuid=10e8ce920b9c4d85a98b7697b73c55b0; Path=/; Secure; Domain=.secprf.com; Max-Age=31536000; SameSite=None
JSESSIONID=16FFBCAA19A0BE2201DDE23B59044E8E; Path=/; HttpOnly
strict-transport-security: max-age=31536000; includeSubDomains
X-Firefox-Spdy: h2

arbgsu.com/porno-land?h=waWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTMsInNyYyI6Mn0=eyJ&clickid=376l60j1gbd9b&si1=

185.162.87.220

200 OK

344 kB

URL User Request GET HTTP/2
arbgsu.com/porno-land?h=waWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTMsInNyYyI6Mn0=eyJ&clickid=376l60j1gbd9b&si1=
IP
185.162.87.220:443
ASN
#39572 DataWeb Global Group B.V.

Certificate
IssuerLet's Encrypt
Subjectarbgsu.com
FingerprintF1:B5:94:81:3F:DE:80:65:1B:67:DF:CA:C3:28:95:15:A6:66:00:46
ValidityWed, 10 Apr 2024 12:59:17 GMT - Tue, 09 Jul 2024 12:59:16 GMT

File type

Size
344 kB (344129 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /porno-land?h=waWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTMsInNyYyI6Mn0=eyJ&clickid=376l60j1gbd9b&si1= HTTP/1.1
Host: arbgsu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.25.0
date: Fri, 10 May 2024 12:48:27 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: truniq=1; expires=Sat, 11-May-2024 12:48:27 GMT; Max-Age=86400; path=/; domain=arbgsu.com
x-zone: eu4
content-encoding: gzip
X-Firefox-Spdy: h2

wokoez.com/phtbload?a=1&e=aeyJwaWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTN9

185.162.85.4

200 OK

145 B

URL GET HTTP/2
wokoez.com/phtbload?a=1&e=aeyJwaWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTN9
IP
185.162.85.4:443
ASN
#39572 DataWeb Global Group B.V.

Requested by
https://arbgsu.com/porno-land?h=waWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTMsInNyYyI6Mn0=eyJ&clickid=376l60j1gbd9b&si1=
Certificate
IssuerLet's Encrypt
Subjectwokoez.com
Fingerprint4C:70:8E:53:1E:93:17:BF:C6:1C:D6:0D:98:EE:A0:92:CE:0A:12:95
ValidityThu, 04 Apr 2024 20:05:01 GMT - Wed, 03 Jul 2024 20:05:00 GMT

File type
ASCII text, with no line terminators
Size
145 B (145 bytes)
Hash
a6e4977c868cb8716b433a3a03012108
52ecf48c2f02633d9c0f5d03fc0f72f879c4e960
51d8a9bb8430760523cbf464fb396a4f65a1bba915117a71d0d519105d4ddcee

HTTP Headers

GET /phtbload?a=1&e=aeyJwaWQiOjEwMDk5OTIsInNpZCI6MTE3ODM2MSwid2lkIjo0MDk1OTN9 HTTP/1.1
Host: wokoez.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://arbgsu.com/
Origin: https://arbgsu.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Fri, 10 May 2024 12:48:28 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
accept-ch: Sec-CH-UA-Platform-Version
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (10)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate