| go-g3t-push.net/icn/626tn8APDeVmzz_lqdDcc3qIJtQQR9g0D_wKHFO95NJPwlQw9aNnCHG6SvWWzGScC-Xvglzm-UaWSSPw7iQ2cJLyElCH7ED4Ym9SLZiYMqsvEUbaBi0kRa4munYdslTqVv1SEz0KMyVmzFWU1XtKnPDHlUVn2ta2UDtkanyCGE8w_XJ0EWLFGPMWWlmXrHZTZA7u785KkzHG7059Jot-W2ofxF04ki0o4ipSpR8w-vFO3_0lDsKOYJ0orkwWeRRjKUDdvxGp8rwzbsGD-kD7ludQi5n_TJa1clGFdncA6kDnfYQ5UpEEM9NEG8ZQ0zOW5QyFkw6_--WbNwvezZu6fdvdvhLTwmH8hlBcg3k3MkF6xnPpQg_7oFIDpIlorPrQ6Z5HAxH6cY887PxHJut4DCpf3uwC-8ik_N6qQNkpFjJju6CPobW2EmZc9c3bag_kTYldyQYkKp5hdGmFpba5OCRjlOMXy9QzQX5pPikM4BC7s4q5MUUfPPkFIq1-_LrAVn6aQM0n6utXfV1VcSJUsAFGs1Oeew116S8x2iae1uC1oryGDN7Wq1Ph1BQCIgFoJwNLisYs-vXRCG-QOSJCoe0jfuKTUySMLIDNQ_3dP9TGVaDcSzZAGk9dGZxStkASR9GRGI4ZfWzvni0Wn8dZKoGhH9v1GctXvDvi7Wcq8tRTlr1AJBkq1zY-dn1EbhEbZH0kbs-IUCw159ABvxzenLUyuMc2VHOr1B-gE3aLhaGplN18qhpTZ-9ORpRYK9RjgQZ9NQtJJvA-UHKdXT4DAunYf8pvzHf20IGNGXSG2x4LaEz694JnfgLVY-o_IGFrTkioczY2GujsJQ3wlqybrfreLGC_PwIcZluhU2g-W1l2cvCXNj7PxUa5OZdQeR7zoJ8zf4wikIYZNANprGJdMirXcHEPcODBkTZMXTXgfMw5CfGk7r-JOws-685F9s7vxbCpCEAbLKcXO2ccADvxB-1r0aQKyfn30HZxEJsCEp13kzXovzx3eFRqG3_DH8A4IbYZDbAb8ONVGH2wegoVoL4jfI1IQzCbQ23IcaCgmwxMwY4YCCLwWQ |  157.90.33.125 | 301 Moved Permanently | 0 B |
URL User Request GET HTTP/2go-g3t-push.net/icn/626tn8APDeVmzz_lqdDcc3qIJtQQR9g0D_wKHFO95NJPwlQw9aNnCHG6SvWWzGScC-Xvglzm-UaWSSPw7iQ2cJLyElCH7ED4Ym9SLZiYMqsvEUbaBi0kRa4munYdslTqVv1SEz0KMyVmzFWU1XtKnPDHlUVn2ta2UDtkanyCGE8w_XJ0EWLFGPMWWlmXrHZTZA7u785KkzHG7059Jot-W2ofxF04ki0o4ipSpR8w-vFO3_0lDsKOYJ0orkwWeRRjKUDdvxGp8rwzbsGD-kD7ludQi5n_TJa1clGFdncA6kDnfYQ5UpEEM9NEG8ZQ0zOW5QyFkw6_--WbNwvezZu6fdvdvhLTwmH8hlBcg3k3MkF6xnPpQg_7oFIDpIlorPrQ6Z5HAxH6cY887PxHJut4DCpf3uwC-8ik_N6qQNkpFjJju6CPobW2EmZc9c3bag_kTYldyQYkKp5hdGmFpba5OCRjlOMXy9QzQX5pPikM4BC7s4q5MUUfPPkFIq1-_LrAVn6aQM0n6utXfV1VcSJUsAFGs1Oeew116S8x2iae1uC1oryGDN7Wq1Ph1BQCIgFoJwNLisYs-vXRCG-QOSJCoe0jfuKTUySMLIDNQ_3dP9TGVaDcSzZAGk9dGZxStkASR9GRGI4ZfWzvni0Wn8dZKoGhH9v1GctXvDvi7Wcq8tRTlr1AJBkq1zY-dn1EbhEbZH0kbs-IUCw159ABvxzenLUyuMc2VHOr1B-gE3aLhaGplN18qhpTZ-9ORpRYK9RjgQZ9NQtJJvA-UHKdXT4DAunYf8pvzHf20IGNGXSG2x4LaEz694JnfgLVY-o_IGFrTkioczY2GujsJQ3wlqybrfreLGC_PwIcZluhU2g-W1l2cvCXNj7PxUa5OZdQeR7zoJ8zf4wikIYZNANprGJdMirXcHEPcODBkTZMXTXgfMw5CfGk7r-JOws-685F9s7vxbCpCEAbLKcXO2ccADvxB-1r0aQKyfn30HZxEJsCEp13kzXovzx3eFRqG3_DH8A4IbYZDbAb8ONVGH2wegoVoL4jfI1IQzCbQ23IcaCgmwxMwY4YCCLwWQ IP157.90.33.125:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subjectgo-g3t-push.net Fingerprint32:E7:5D:DA:6E:6D:86:15:15:E5:FE:03:BB:0F:9C:4C:D5:9A:35:48 ValidityMon, 08 Apr 2024 15:17:58 GMT - Sun, 07 Jul 2024 15:17:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /icn/626tn8APDeVmzz_lqdDcc3qIJtQQR9g0D_wKHFO95NJPwlQw9aNnCHG6SvWWzGScC-Xvglzm-UaWSSPw7iQ2cJLyElCH7ED4Ym9SLZiYMqsvEUbaBi0kRa4munYdslTqVv1SEz0KMyVmzFWU1XtKnPDHlUVn2ta2UDtkanyCGE8w_XJ0EWLFGPMWWlmXrHZTZA7u785KkzHG7059Jot-W2ofxF04ki0o4ipSpR8w-vFO3_0lDsKOYJ0orkwWeRRjKUDdvxGp8rwzbsGD-kD7ludQi5n_TJa1clGFdncA6kDnfYQ5UpEEM9NEG8ZQ0zOW5QyFkw6_--WbNwvezZu6fdvdvhLTwmH8hlBcg3k3MkF6xnPpQg_7oFIDpIlorPrQ6Z5HAxH6cY887PxHJut4DCpf3uwC-8ik_N6qQNkpFjJju6CPobW2EmZc9c3bag_kTYldyQYkKp5hdGmFpba5OCRjlOMXy9QzQX5pPikM4BC7s4q5MUUfPPkFIq1-_LrAVn6aQM0n6utXfV1VcSJUsAFGs1Oeew116S8x2iae1uC1oryGDN7Wq1Ph1BQCIgFoJwNLisYs-vXRCG-QOSJCoe0jfuKTUySMLIDNQ_3dP9TGVaDcSzZAGk9dGZxStkASR9GRGI4ZfWzvni0Wn8dZKoGhH9v1GctXvDvi7Wcq8tRTlr1AJBkq1zY-dn1EbhEbZH0kbs-IUCw159ABvxzenLUyuMc2VHOr1B-gE3aLhaGplN18qhpTZ-9ORpRYK9RjgQZ9NQtJJvA-UHKdXT4DAunYf8pvzHf20IGNGXSG2x4LaEz694JnfgLVY-o_IGFrTkioczY2GujsJQ3wlqybrfreLGC_PwIcZluhU2g-W1l2cvCXNj7PxUa5OZdQeR7zoJ8zf4wikIYZNANprGJdMirXcHEPcODBkTZMXTXgfMw5CfGk7r-JOws-685F9s7vxbCpCEAbLKcXO2ccADvxB-1r0aQKyfn30HZxEJsCEp13kzXovzx3eFRqG3_DH8A4IbYZDbAb8ONVGH2wegoVoL4jfI1IQzCbQ23IcaCgmwxMwY4YCCLwWQ HTTP/1.1
Host: go-g3t-push.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
server: nginx
date: Fri, 10 May 2024 17:52:43 GMT
content-length: 0
accept-ch: Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Wow64
referrer-policy: no-referrer
location: https://95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/dsp/push/icon?ssp=ea9215ee-835b-46b2-8336-750870b57889&hit=95caea29-5174-459c-ab98-fe7ed165281d
X-Firefox-Spdy: h2
|
| 95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/favicon.ico | 49.13.125.255 | 404 Not Found | 146 B |
URL GET HTTP/295caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/favicon.ico IP49.13.125.255:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/dsp/push/icon?ssp=ea9215ee-835b-46b2-8336-750870b57889&hit=95caea29-5174-459c-ab98-fe7ed165281d CertificateIssuerLet's Encrypt Subject*.dsp-redirect.com Fingerprint37:DF:45:B8:0C:4B:F3:97:9C:4A:C6:F4:AC:51:38:73:F8:87:7C:A9 ValidityWed, 10 Apr 2024 05:26:26 GMT - Tue, 09 Jul 2024 05:26:25 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel |
GET /favicon.ico HTTP/1.1
Host: 95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/dsp/push/icon?ssp=ea9215ee-835b-46b2-8336-750870b57889&hit=95caea29-5174-459c-ab98-fe7ed165281d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Fri, 10 May 2024 17:52:44 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2
|
| 95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/dsp/push/icon?ssp=ea9215ee-835b-46b2-8336-750870b57889&hit=95caea29-5174-459c-ab98-fe7ed165281d | 49.13.125.255 | 200 OK | 30 kB |
URL User Request GET HTTP/295caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com/dsp/push/icon?ssp=ea9215ee-835b-46b2-8336-750870b57889&hit=95caea29-5174-459c-ab98-fe7ed165281d IP49.13.125.255:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject*.dsp-redirect.com Fingerprint37:DF:45:B8:0C:4B:F3:97:9C:4A:C6:F4:AC:51:38:73:F8:87:7C:A9 ValidityWed, 10 Apr 2024 05:26:26 GMT - Tue, 09 Jul 2024 05:26:25 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 192x192, components 3 Hash0f5e68b9a99783a3438d2972b7e523c4 5d127f17474f963eac53393b17c4f3cfec3930c8 3f2700f84e9c7fb79622c2b67d1fcbd9aa8b39197ffd9662d609a8856f3ba992
GET /dsp/push/icon?ssp=ea9215ee-835b-46b2-8336-750870b57889&hit=95caea29-5174-459c-ab98-fe7ed165281d HTTP/1.1
Host: 95caea29-5174-459c-ab98-fe7ed165281d.dsp-redirect.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 17:52:43 GMT
content-type: image/png
X-Firefox-Spdy: h2
|