Report - 126895eb2c3c.techsavvytrafficoffers.com/?p=14946&plid=1&plid_hmac=09bd1ca36de75cdb864c07f749c615d1&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click

Report Overview

Submitted URL
126895eb2c3c.techsavvytrafficoffers.com/?p=14946&plid=1&plid_hmac=09bd1ca36de75cdb864c07f749c615d1&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084
IP
94.237.90.104
ASN
#202053 UpCloud Ltd
Submitted
2024-05-04 07:52:26
Access
public
Website Title
FILE READY
Final URL
www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
126895eb2c3c.techsavvytrafficoffers.com	unknown	unknown	No data	No data	649 B	62 kB	94.237.90.104
12689c0ed3fc.seethis.click	unknown	unknown	No data	No data	600 B	62 kB	94.237.92.107
www.megawinner.xyz	unknown	2024-04-19	2021-06-19	2021-10-03	641 B	62 kB	94.237.92.126

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-04	medium	megawinner.xyz	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1	142 B	2024-02-16	2024-05-05
Pretty URL www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1 IP 94.237.92.126 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML true Observations First Seen2024-02-16 08:45:33 Last Seen2024-05-05 16:07:19 Times Seen12 Hash f3e8b830522d7d4a57cd2a4dca9c1ccb ffbdadd7552d3fba565c3f1bcf10a673e51ada44 2dd662e6f94049e35657520772b88ed4484dbc1578dcd09b53fe95ac9d9407be Loading...

	www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1	1.0 kB	2024-02-16	2024-05-05
Pretty URL www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1 IP 94.237.92.126 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML true Observations First Seen2024-02-16 08:45:33 Last Seen2024-05-05 16:07:19 Times Seen12 Hash b2b69053f9244f3b84a4fa18acd4f2fa b8e92bb4d2847c92dd0ff98a733a0712955575bc 21072322a4c5c1076425b483f8e8ca1c5be9b7848f163bc9ea62cd379db10a48 Loading...

	www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1	2.1 kB	2024-05-04	2024-05-04
Pretty URL www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1 IP 94.237.92.126 ASN #202053 UpCloud Ltd Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-04 09:52:32 Last Seen2024-05-04 09:52:32 Times Seen1 Hash 3a8166ba3e3f59bedeef914a4d91cc1c 3365dd544842e94fbc7b091a6f8f88f6943b7b0a 9a79baf8da89c0b608f031055d09db229a889ca5b9860092bd1846272f7954cc Loading...

HTTP Transactions (3)

URL IP Response Size

126895eb2c3c.techsavvytrafficoffers.com/?p=14946&plid=1&plid_hmac=09bd1ca36de75cdb864c07f749c615d1&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084

94.237.90.104

302 Found

62 kB

URL User Request GET HTTP/2
126895eb2c3c.techsavvytrafficoffers.com/?p=14946&plid=1&plid_hmac=09bd1ca36de75cdb864c07f749c615d1&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084
IP
94.237.90.104:443
ASN
#202053 UpCloud Ltd

Certificate
IssuerLet's Encrypt
Subject*.techsavvytrafficoffers.com
Fingerprint42:11:33:4F:D0:FD:3A:39:0D:E8:51:A1:83:1F:81:D7:C3:66:65:7C
ValiditySat, 09 Mar 2024 18:45:08 GMT - Fri, 07 Jun 2024 18:45:07 GMT

File type

Size
62 kB (61480 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /?p=14946&plid=1&plid_hmac=09bd1ca36de75cdb864c07f749c615d1&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084 HTTP/1.1
Host: 126895eb2c3c.techsavvytrafficoffers.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sat, 04 May 2024 07:52:02 GMT
content-type: text/html; charset=UTF-8
location: https://12689c0ed3fc.seethis.click?p=14946&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084&co=1&noback=1
X-Firefox-Spdy: h2

12689c0ed3fc.seethis.click/?p=14946&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084&co=1&noback=1

94.237.92.107

302 Found

62 kB

URL User Request GET HTTP/2
12689c0ed3fc.seethis.click/?p=14946&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084&co=1&noback=1
IP
94.237.92.107:443
ASN
#202053 UpCloud Ltd

Certificate
IssuerLet's Encrypt
Subject*.seethis.click
Fingerprint35:9F:36:BB:42:BC:C4:6A:25:58:5A:DA:B9:DC:F8:EB:B9:45:50:1F
ValidityThu, 29 Feb 2024 11:46:37 GMT - Wed, 29 May 2024 11:46:36 GMT

File type

Size
62 kB (61480 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /?p=14946&wid=132902&wid_hmac=1a60f522ad05ad98292626dd3f37802d&click_id=6635e90e78bf7b00018523a4&pi=2084&co=1&noback=1 HTTP/1.1
Host: 12689c0ed3fc.seethis.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sat, 04 May 2024 07:52:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: rts-trck=1; expires=Sat, 04 May 2024 08:02:02 GMT; Max-Age=600; path=/; domain=12689c0ed3fc.seethis.click
t-uuid=62tq2rkq3e4rgt3h6f40088ss; expires=Thu, 04 May 2034 07:52:02 GMT; Max-Age=315532800; path=/; domain=.12689c0ed3fc.seethis.click
rts-trck=1; expires=Sat, 04 May 2024 08:02:02 GMT; Max-Age=600; path=/; domain=12689c0ed3fc.seethis.click
traffic-visited-domain=megawinner.xyz; expires=Mon, 03 Jun 2024 07:52:02 GMT; Max-Age=2592000; path=/; domain=.12689c0ed3fc.seethis.click
traffic-back=ok; expires=Sat, 04 May 2024 07:52:32 GMT; Max-Age=30; path=/; domain=.12689c0ed3fc.seethis.click
location: https://www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1
X-Firefox-Spdy: h2

www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1

94.237.92.126

200 OK

62 kB

URL User Request GET HTTP/2
www.megawinner.xyz/dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1
IP
94.237.92.126:443
ASN
#202053 UpCloud Ltd

Certificate
IssuerLet's Encrypt
Subject*.megawinner.xyz
FingerprintE1:3F:35:F8:78:45:55:BE:FA:4F:C2:BE:D0:9B:8A:89:8A:6E:FE:37
ValidityFri, 19 Apr 2024 07:20:12 GMT - Thu, 18 Jul 2024 07:20:11 GMT

File type

Size
62 kB (61480 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /dl/all/offer/sub/download/?tid=62tq2rkq13mableb7yekgc484,17594783,5,14946&ctrack=1714809122.3302683494&p=14946&pi=2084&click_id=6635e90e78bf7b00018523a4&co=1&noback=1 HTTP/1.1
Host: www.megawinner.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-cache, private
date: Sat, 04 May 2024 07:52:02 GMT
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (3)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers