Report - cgxegj1.9hz1.shop/j/P1Osv8so

Report Overview

Visited public
2023-12-01 19:14:18
Tags
URL
cgxegj1.9hz1.shop/j/P1Osv8so
Finishing URL
cgxegj1.9hz1.shop/j/P1Osv8so
IP / ASN
46.21.250.208
#204601 Zomro B.V.
Title
Для просмотра видео нажмите кнопку Разрешить

Detections

urlquery

0

Network Intrusion Detection

2

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cgxegj1.9hz1.shop	unknown	unknown	No data	No data	1.6 kB	21 kB	46.21.250.208
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2023-12-01 08:06:52	455 B	31 kB	151.101.194.137
images2.info	unknown	2022-03-15	2022-03-15 20:27:56	2023-11-28 21:14:24	451 B	122 kB	46.21.250.227
cashmachines.biz	unknown	2023-08-01	2017-04-05 05:46:37	2023-11-30 00:15:42	445 B	470 B	185.177.92.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-01 19:14:07	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD
2023-12-01 19:14:07	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .biz TLD

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.3.1.min.js	ScriptElement	87 kB	2023-03-07	2025-05-11
Pretty URL code.jquery.com/jquery-3.3.1.min.js IP 151.101.194.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 12:25 Times Seen57552 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

	cgxegj1.9hz1.shop/j/P1Osv8so	ScriptElement	2.3 kB	2023-09-30	2025-04-13
Pretty URL cgxegj1.9hz1.shop/j/P1Osv8so IP 46.21.250.208 ASN #204601 Zomro B.V. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-30 19:40 Last Seen2025-04-13 03:01 Times Seen19 Hash f9344313b31ee59c8aa0273a553fd172 d943dbe651a6b74707b551a4fbc1bc59294ccfd4 5a4cecba981c987dccda44167c99f47c5746fa5718bb57ceba72496c469da5c4 Loading...

	cgxegj1.9hz1.shop/j/P1Osv8so	ScriptElement	387 B	2023-12-01	2024-08-20
Pretty URL cgxegj1.9hz1.shop/j/P1Osv8so IP 46.21.250.208 ASN #204601 Zomro B.V. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-12-01 20:14 Last Seen2024-08-20 17:08 Times Seen3 Hash 4e7672c9553e0edb88da147e1fd7e03d c59221cb6f1ba64a3511526548fe0ec3394dc763 889facbe72670eee4b5225df787db2bdf7a3259602df92240367d4cfc40db9c3 Loading...

	cashmachines.biz/?re=gbsgkzdcmy5ha3ddf42tmnbw&sub4=8525	ScriptElement	10 B	2023-03-07	2025-05-11
Pretty URL cashmachines.biz/?re=gbsgkzdcmy5ha3ddf42tmnbw&sub4=8525 IP 185.177.92.132 ASN #39572 DataWeb Global Group B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03 Last Seen2025-05-11 08:53 Times Seen2106 Hash f495e69f2e9edc75eeae7dd3ea78a747 a89e38bbe70fa2de5db9d578975abd4e9dcda52e 8bf4c7cf443426b4cd8b5a56d22109b4e70314c1d2b8d0eb68887696722c132c Loading...

HTTP Transactions (6)

	URL	IP	Response	Size
	cgxegj1.9hz1.shop/j/P1Osv8so	46.21.250.208	200 OK	18 kB
URL User Request GET HTTP/1.1 cgxegj1.9hz1.shop/j/P1Osv8so IP 46.21.250.208:443 ASN #204601 Zomro B.V. Certificate IssuerLet's Encrypt Subject9hz1.shop Fingerprint55:30:D7:43:DA:FD:6B:E2:35:78:23:D5:6E:D4:7E:9F:76:F7:A2:BE ValidityThu, 16 Nov 2023 05:50:11 GMT - Wed, 14 Feb 2024 05:50:10 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (12413) Size 18 kB (17477 bytes) Hash fa51cb0a25f0435157828f8f3c2f73c4 4803f0f68ee2cc043090e450882b45c5f37219fd 8a3b03fba58e07b241c7c58b2de5aca6a928da6c80c142f7cab1d73e29033c9d HTTP Headers `GET /j/P1Osv8so HTTP/1.1 Host: cgxegj1.9hz1.shop User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 01 Dec 2023 19:14:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.16 Set-Cookie: PHPSESSID=lqvsgjgfvasn036e99nu2vsan7; path=/; domain=.9hz1.shop Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Access-Control-Allow-Origin: * Content-Encoding: gzip`

	code.jquery.com/jquery-3.3.1.min.js	151.101.194.137	200 OK	30 kB
URL GET HTTP/2 code.jquery.com/jquery-3.3.1.min.js IP 151.101.194.137:443 ASN #54113 FASTLY Requested by https://cgxegj1.9hz1.shop/j/P1Osv8so Certificate IssuerSectigo Limited Subject.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT File type ASCII text, with very long lines (65451) Size 30 kB (30288 bytes) Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef HTTP Headers `GET /jquery-3.3.1.min.js HTTP/1.1 Host: code.jquery.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: /* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: https://cgxegj1.9hz1.shop DNT: 1 Connection: keep-alive Referer: https://cgxegj1.9hz1.shop/ Sec-Fetch-Dest: script Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK server: nginx content-type: application/javascript; charset=utf-8 last-modified: Fri, 18 Oct 1991 12:00:00 GMT etag: W/"28feccc0-1538f" cache-control: public, max-age=31536000, stale-while-revalidate=604800 access-control-allow-origin: * content-encoding: gzip via: 1.1 varnish, 1.1 varnish accept-ranges: bytes date: Fri, 01 Dec 2023 19:14:01 GMT age: 6655841 x-served-by: cache-lga13622-LGA, cache-bma1642-BMA x-cache: HIT, HIT x-cache-hits: 24, 345519 x-timer: S1701458042.502791,VS0,VE0 vary: Accept-Encoding content-length: 30288 X-Firefox-Spdy: h2

	images2.info/i2/136024/5330291kadr-min.jpg	46.21.250.227	200 OK	121 kB
URL GET HTTP/1.1 images2.info/i2/136024/5330291kadr-min.jpg IP 46.21.250.227:443 ASN #204601 Zomro B.V. Requested by https://cgxegj1.9hz1.shop/j/P1Osv8so Certificate IssuerLet's Encrypt Subjectimages2.info FingerprintDD:7C:0A:CD:4D:81:88:45:77:E4:04:6D:0D:37:F2:6F:1B:50:02:E6 ValidityTue, 07 Nov 2023 19:57:24 GMT - Mon, 05 Feb 2024 19:57:23 GMT File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 850x450, components 3\012- data Size 121 kB (121389 bytes) Hash 1f308234ccafd94de919b53c35cc66fc cc84ca0de5b7cd538661d4913a5f6e4cbe03ea55 4f658759ff1d24de366021f93bd8adb48c05d3c4d92e1d1dc0b3c7bda0d2d587 HTTP Headers `GET /i2/136024/5330291kadr-min.jpg HTTP/1.1 Host: images2.info User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://cgxegj1.9hz1.shop/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Dec 2023 19:14:01 GMT Content-Type: image/jpeg Content-Length: 121389 Last-Modified: Sun, 10 Sep 2023 15:51:46 GMT Connection: keep-alive ETag: "64fde612-1da2d" Accept-Ranges: bytes`

	cgxegj1.9hz1.shop/favicon.ico	46.21.250.208	200 OK	2.0 kB
URL GET HTTP/1.1 cgxegj1.9hz1.shop/favicon.ico IP 46.21.250.208:443 ASN #204601 Zomro B.V. Requested by https://cgxegj1.9hz1.shop/j/P1Osv8so Certificate IssuerLet's Encrypt Subject9hz1.shop Fingerprint55:30:D7:43:DA:FD:6B:E2:35:78:23:D5:6E:D4:7E:9F:76:F7:A2:BE ValidityThu, 16 Nov 2023 05:50:11 GMT - Wed, 14 Feb 2024 05:50:10 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (527) Size 2.0 kB (2041 bytes) Hash 27a33afe0df7f0083bd93a25fc5149a5 612b0b21f4dcbb7f4a972902c2eaae9e5e68803f db167706e03d47768484c1c507aebfa3010235090e10003bb9e9207a5234bc5a HTTP Headers `GET /favicon.ico HTTP/1.1 Host: cgxegj1.9hz1.shop User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://cgxegj1.9hz1.shop/j/P1Osv8so Cookie: PHPSESSID=lqvsgjgfvasn036e99nu2vsan7 Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 01 Dec 2023 19:14:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Access-Control-Allow-Origin: * Content-Encoding: gzip`

	cgxegj1.9hz1.shop/application.php	46.21.250.208	200 OK	28 B
URL POST HTTP/1.1 cgxegj1.9hz1.shop/application.php IP 46.21.250.208:443 ASN #204601 Zomro B.V. Requested by https://cgxegj1.9hz1.shop/j/P1Osv8so Certificate IssuerLet's Encrypt Subject9hz1.shop Fingerprint55:30:D7:43:DA:FD:6B:E2:35:78:23:D5:6E:D4:7E:9F:76:F7:A2:BE ValidityThu, 16 Nov 2023 05:50:11 GMT - Wed, 14 Feb 2024 05:50:10 GMT File type ASCII text, with no line terminators Size 28 B (28 bytes) Hash 402e7a087747cb56c718bde84651f96a 7ce01f6381463362cf6aef2f843a59261e8f5587 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f HTTP Headers POST /application.php HTTP/1.1 Host: cgxegj1.9hz1.shop User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html, /; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 74 Origin: https://cgxegj1.9hz1.shop DNT: 1 Connection: keep-alive Referer: https://cgxegj1.9hz1.shop/j/P1Osv8so Cookie: PHPSESSID=lqvsgjgfvasn036e99nu2vsan7 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 01 Dec 2023 19:14:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Encoding: gzip`

	cashmachines.biz/?re=gbsgkzdcmy5ha3ddf42tmnbw&sub4=8525	185.177.92.132	200 OK	10 B
URL GET HTTP/2 cashmachines.biz/?re=gbsgkzdcmy5ha3ddf42tmnbw&sub4=8525 IP 185.177.92.132:443 ASN #39572 DataWeb Global Group B.V. Requested by https://cgxegj1.9hz1.shop/j/P1Osv8so Certificate IssuerLet's Encrypt Subjecttailstories.biz Fingerprint49:06:04:C7:DD:53:A5:CF:98:EC:D1:CF:2F:86:84:EF:F9:74:3E:27 ValidityThu, 30 Nov 2023 18:28:23 GMT - Wed, 28 Feb 2024 18:28:22 GMT File type ASCII text, with no line terminators Size 10 B (10 bytes) Hash f495e69f2e9edc75eeae7dd3ea78a747 a89e38bbe70fa2de5db9d578975abd4e9dcda52e 8bf4c7cf443426b4cd8b5a56d22109b4e70314c1d2b8d0eb68887696722c132c HTTP Headers `GET /?re=gbsgkzdcmy5ha3ddf42tmnbw&sub4=8525 HTTP/1.1 Host: cashmachines.biz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://cgxegj1.9hz1.shop/ Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: nginx date: Fri, 01 Dec 2023 19:14:02 GMT content-type: application/javascript; charset=UTF-8 access-control-allow-origin: * set-cookie: uuid=e3eead21-0190-47ff-a3b8-153be699b6ba; expires=Sun, 31-Dec-2023 19:14:02 GMT; Max-Age=2592000; path=/; SameSite=None; domain=cashmachines.biz; secure strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests X-Firefox-Spdy: h2`