| trk.theonesstoodtheirground.com/15GtmW?CC=RO&tn=10&tx=50&affid=onw_500556&rawAffid=500556&onw=1&link=url=https://tidyllama.com/click?a=A76v&e=gAAAAABmOm3z2A-XQIWHYDFkt9HnGa09gdRCjhQ9AFtzAPgaERsYuGWWjcMYhG77VPVVGTfWnE87y3q6Nf1vVnU7yeeJJVgYcQTTDmFVLWZZ6zcgH3MGMfpVwu_grGbBX4_59AJK_pdnZDoyruhu4-UYfxsFYybA6b05DHOOxcEcpbjViYK74LfyU4C9E9G-HRnhiKuBKe00c2SFo1EJap2JjERUdxySu42Q5E_bl37CZA_k1VRhAzr33b9B67YWNfLq7synQvd2gz_p1e6GijsQ5ZSEZ0WSnZ-YgQm-iPukBLsWTXTqtiC-b1l43FSLur2KNG8s6pHp1Xj8-3uLrOvuB334q4-Rx4Hlzy2AXeRJcmV3U0JpIDxkXVNImz03IeFDmXKi_2rtLCH3buGgV809-GWNeoniU0ijdDfiH5U6YnYLk1jfvLQixrhOQ4e3MTHQrNtcpIb7CdCvDNiJDWl6yoDnxIjnlsYioAoRM_jeHsQMWo3qaPqzA3XiBdnSXLWqSlpCKyd8priVfbHO6FnXMPz-t03cNh12cABZc8mhr6GykGDmxlFIjLxLSALUfCEW2zDkx2WVQEKLktVKWF4jJ7NDF7egdVyz_AnBfsYYHyjJuVsBasygTrjNoeg0MZYqRMQ-RbF2NaQwwPCV1THFKla4iJXu3zKPvSn8pn9Kuwhe2X78HdnbOPfo7ZQc4z4JzeL1Ervh1o3rPefYuu84b-dFE04W2PB_LaThMb0IgG6a_usXBTJ_KMUFZS3HVH8GFBRSd4G7Vj5KWDfFCXvV03vm3kxoFP-bLdkFLlm5k_xKqWZ82ezT9q7jVAJcLSQDlJYryXpOVs8NLRnw8uDAh-FnN6Uh2DVuYfvVJCUhYOAM9bq9UHVX28bsWs6wH-3msN0TqpTNVj34wcv_E2o7x3QkO5tpGVo8O8uJD5RY9anlRd4jrNbyeTgTun98xLDwPkly9paMjSMUk36cnDoVvP6LTtjwNPayur-fpCpG21M0sUnj_e4=&s=2161&a=bid_onw_500556&uA=bid_500556&sub=undefined&ts=1715105268&d=27&i=4063caklvwpe6as&t=client&cbjs=1&c=37981427863 |  164.90.174.196 | 302 Found | 95 B |
URL User Request GET HTTP/1.1trk.theonesstoodtheirground.com/15GtmW?CC=RO&tn=10&tx=50&affid=onw_500556&rawAffid=500556&onw=1&link=url=https://tidyllama.com/click?a=A76v&e=gAAAAABmOm3z2A-XQIWHYDFkt9HnGa09gdRCjhQ9AFtzAPgaERsYuGWWjcMYhG77VPVVGTfWnE87y3q6Nf1vVnU7yeeJJVgYcQTTDmFVLWZZ6zcgH3MGMfpVwu_grGbBX4_59AJK_pdnZDoyruhu4-UYfxsFYybA6b05DHOOxcEcpbjViYK74LfyU4C9E9G-HRnhiKuBKe00c2SFo1EJap2JjERUdxySu42Q5E_bl37CZA_k1VRhAzr33b9B67YWNfLq7synQvd2gz_p1e6GijsQ5ZSEZ0WSnZ-YgQm-iPukBLsWTXTqtiC-b1l43FSLur2KNG8s6pHp1Xj8-3uLrOvuB334q4-Rx4Hlzy2AXeRJcmV3U0JpIDxkXVNImz03IeFDmXKi_2rtLCH3buGgV809-GWNeoniU0ijdDfiH5U6YnYLk1jfvLQixrhOQ4e3MTHQrNtcpIb7CdCvDNiJDWl6yoDnxIjnlsYioAoRM_jeHsQMWo3qaPqzA3XiBdnSXLWqSlpCKyd8priVfbHO6FnXMPz-t03cNh12cABZc8mhr6GykGDmxlFIjLxLSALUfCEW2zDkx2WVQEKLktVKWF4jJ7NDF7egdVyz_AnBfsYYHyjJuVsBasygTrjNoeg0MZYqRMQ-RbF2NaQwwPCV1THFKla4iJXu3zKPvSn8pn9Kuwhe2X78HdnbOPfo7ZQc4z4JzeL1Ervh1o3rPefYuu84b-dFE04W2PB_LaThMb0IgG6a_usXBTJ_KMUFZS3HVH8GFBRSd4G7Vj5KWDfFCXvV03vm3kxoFP-bLdkFLlm5k_xKqWZ82ezT9q7jVAJcLSQDlJYryXpOVs8NLRnw8uDAh-FnN6Uh2DVuYfvVJCUhYOAM9bq9UHVX28bsWs6wH-3msN0TqpTNVj34wcv_E2o7x3QkO5tpGVo8O8uJD5RY9anlRd4jrNbyeTgTun98xLDwPkly9paMjSMUk36cnDoVvP6LTtjwNPayur-fpCpG21M0sUnj_e4=&s=2161&a=bid_onw_500556&uA=bid_500556&sub=undefined&ts=1715105268&d=27&i=4063caklvwpe6as&t=client&cbjs=1&c=37981427863 IP164.90.174.196:443 ASN#14061 DIGITALOCEAN-ASN
CertificateIssuerLet's Encrypt Subjecttrk.theonesstoodtheirground.com Fingerprint94:AC:75:BC:C0:5E:39:C2:70:DD:38:76:AE:CB:C5:73:C8:F2:B1:A5 ValidityMon, 04 Mar 2024 07:28:04 GMT - Sun, 02 Jun 2024 07:28:03 GMT
File typeHTML document, ASCII text Hash03d270735ceec278379aaeb42b31f6b0 91e3fa52dee72502574a125d95d1374dc2cd3bb2 bacd84cf187cea5bd2858610737358e6f50dba99f1cef9da60475b6928f1bebb
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /15GtmW?CC=RO&tn=10&tx=50&affid=onw_500556&rawAffid=500556&onw=1&link=url=https://tidyllama.com/click?a=A76v&e=gAAAAABmOm3z2A-XQIWHYDFkt9HnGa09gdRCjhQ9AFtzAPgaERsYuGWWjcMYhG77VPVVGTfWnE87y3q6Nf1vVnU7yeeJJVgYcQTTDmFVLWZZ6zcgH3MGMfpVwu_grGbBX4_59AJK_pdnZDoyruhu4-UYfxsFYybA6b05DHOOxcEcpbjViYK74LfyU4C9E9G-HRnhiKuBKe00c2SFo1EJap2JjERUdxySu42Q5E_bl37CZA_k1VRhAzr33b9B67YWNfLq7synQvd2gz_p1e6GijsQ5ZSEZ0WSnZ-YgQm-iPukBLsWTXTqtiC-b1l43FSLur2KNG8s6pHp1Xj8-3uLrOvuB334q4-Rx4Hlzy2AXeRJcmV3U0JpIDxkXVNImz03IeFDmXKi_2rtLCH3buGgV809-GWNeoniU0ijdDfiH5U6YnYLk1jfvLQixrhOQ4e3MTHQrNtcpIb7CdCvDNiJDWl6yoDnxIjnlsYioAoRM_jeHsQMWo3qaPqzA3XiBdnSXLWqSlpCKyd8priVfbHO6FnXMPz-t03cNh12cABZc8mhr6GykGDmxlFIjLxLSALUfCEW2zDkx2WVQEKLktVKWF4jJ7NDF7egdVyz_AnBfsYYHyjJuVsBasygTrjNoeg0MZYqRMQ-RbF2NaQwwPCV1THFKla4iJXu3zKPvSn8pn9Kuwhe2X78HdnbOPfo7ZQc4z4JzeL1Ervh1o3rPefYuu84b-dFE04W2PB_LaThMb0IgG6a_usXBTJ_KMUFZS3HVH8GFBRSd4G7Vj5KWDfFCXvV03vm3kxoFP-bLdkFLlm5k_xKqWZ82ezT9q7jVAJcLSQDlJYryXpOVs8NLRnw8uDAh-FnN6Uh2DVuYfvVJCUhYOAM9bq9UHVX28bsWs6wH-3msN0TqpTNVj34wcv_E2o7x3QkO5tpGVo8O8uJD5RY9anlRd4jrNbyeTgTun98xLDwPkly9paMjSMUk36cnDoVvP6LTtjwNPayur-fpCpG21M0sUnj_e4=&s=2161&a=bid_onw_500556&uA=bid_500556&sub=undefined&ts=1715105268&d=27&i=4063caklvwpe6as&t=client&cbjs=1&c=37981427863 HTTP/1.1
Host: trk.theonesstoodtheirground.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.25.2
Date: Tue, 07 May 2024 18:37:48 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 95
Connection: keep-alive
Location: https://clk.wbidder3.com/redirect?url=https://tidyllama.com/click?a=A76v
Set-Cookie: 15GtmWo=1; Path=/; Domain=trk.theonesstoodtheirground.com; Max-Age=1715193468; Secure; SameSite=None
pc-cid=c2d6fa07d437d969d4d03a511e85af58-4888-0507; Path=/; Domain=trk.theonesstoodtheirground.com; Max-Age=1715193468; Secure; SameSite=None
pc-campaign=15GtmW; Path=/; Domain=trk.theonesstoodtheirground.com; Max-Age=1715193468; Secure; SameSite=None
|
| clk.wbidder3.com/redirect?url=https://tidyllama.com/click?a=A76v |  5.79.72.207 | 500 Internal Server Error | 0 B |
URL User Request GET HTTP/2clk.wbidder3.com/redirect?url=https://tidyllama.com/click?a=A76v IP5.79.72.207:443 ASN#60781 LeaseWeb Netherlands B.V.
CertificateIssuerGlobalSign nv-sa Subject*.wbidder3.com Fingerprint34:FB:81:50:52:25:9F:CB:41:03:7B:F4:0B:78:07:15:87:3D:94:6C ValidityTue, 23 Apr 2024 12:38:03 GMT - Sun, 25 May 2025 12:38:02 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /redirect?url=https://tidyllama.com/click?a=A76v HTTP/1.1
Host: clk.wbidder3.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 500 Internal Server Error
vary: Origin
access-control-allow-origin: *
content-length: 0
date: Tue, 07 May 2024 18:37:48 GMT
X-Firefox-Spdy: h2
|
| clk.wbidder3.com/favicon.ico | 5.79.72.207 | 404 Not Found | 83 B |
URL GET HTTP/2clk.wbidder3.com/favicon.ico IP5.79.72.207:443 ASN#60781 LeaseWeb Netherlands B.V.
Requested byhttps://clk.wbidder3.com/redirect?url=https://tidyllama.com/click?a=A76v CertificateIssuerGlobalSign nv-sa Subject*.wbidder3.com Fingerprint34:FB:81:50:52:25:9F:CB:41:03:7B:F4:0B:78:07:15:87:3D:94:6C ValidityTue, 23 Apr 2024 12:38:03 GMT - Sun, 25 May 2025 12:38:02 GMT
Hash40e091ae8a82a69be213d095d414b1d5 674cc4d453e76e87d24ad971d001d16b5f7f81b1 39865fbfc83556c699194ce30ff5b84b4d21ec54b1d2e4495f65352d83af0657
GET /favicon.ico HTTP/1.1
Host: clk.wbidder3.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://clk.wbidder3.com/redirect?url=https://tidyllama.com/click?a=A76v
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
vary: Origin
access-control-allow-origin: *
content-type: application/json; charset=utf-8
content-length: 83
date: Tue, 07 May 2024 18:37:49 GMT
X-Firefox-Spdy: h2
|