WEBSITE ANALYSIS REPORT

http://woc.work.gd/

06 Jul 2026 · 05:05:51.000 UTCpublic

Report tags: dyndns
Submit tags

Request review

Suspicious activity

21 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

acs.aliexpress.com0 captured requests
ajbtop.click1 captured requests
aplus.aliexpress.com16 captured requests
best.aliexpress.com0 captured requests
efreecode.com1 captured requests
hometeens.top1 captured requests
i.imgur.com1 captured requests
images2.imgbox.com1 captured requests
js.mbidadm.com1 captured requests
js.onclckmn.com4 captured requests
log.mmstat.com1 captured requests
pl29691875.effectivecpmnetwork.com1 captured requests
pl29691876.effectivecpmnetwork.com1 captured requests
pl29691878.effectivecpmnetwork.com1 captured requests
portalfluently.com2 captured requests
protrafficinspector.com2 captured requests
sexymodels.top1 captured requests
us.ynuf.aliapp.org1 captured requests
vipamateur.top1 captured requests
woc.work.gd6 captured requests
workdeadlinededicate.com3 captured requests
www.bigland.top1 captured requests
www.highperformanceformat.com5 captured requests

Connections

acs.aliexpress.com → log.mmstat.comLoads from1 captured connections
best.aliexpress.com → aplus.aliexpress.comCalls15 captured connections
best.aliexpress.com → aplus.aliexpress.comLoads from1 captured connections
best.aliexpress.com → us.ynuf.aliapp.orgCalls1 captured connections
woc.work.gd → ajbtop.clickLoads from1 captured connections
woc.work.gd → efreecode.comLoads from1 captured connections
woc.work.gd → hometeens.topLoads from1 captured connections
woc.work.gd → i.imgur.comLoads from1 captured connections
woc.work.gd → images2.imgbox.comLoads from1 captured connections
woc.work.gd → js.mbidadm.comLoads from1 captured connections
woc.work.gd → js.onclckmn.comLoads from4 captured connections
woc.work.gd → pl29691875.effectivecpmnetwork.comLoads from1 captured connections
woc.work.gd → pl29691876.effectivecpmnetwork.comLoads from1 captured connections
woc.work.gd → pl29691878.effectivecpmnetwork.comLoads from1 captured connections
woc.work.gd → portalfluently.comLoads from2 captured connections
woc.work.gd → protrafficinspector.comCalls2 captured connections
woc.work.gd → sexymodels.topLoads from1 captured connections
woc.work.gd → vipamateur.topLoads from1 captured connections
woc.work.gd → workdeadlinededicate.comCalls1 captured connections
woc.work.gd → workdeadlinededicate.comLoads from2 captured connections
woc.work.gd → www.bigland.topLoads from1 captured connections
woc.work.gd → www.highperformanceformat.comLoads from5 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

05:05:28.565 GET No response document 0 B 0 ms 4 alerts

05:05:28.796 GET 200 document 25.4 KB 542 ms 4 alerts

05:05:29.620 GET 200 script 95.4 KB 495 ms 1 alerts

05:05:29.623 GET 200 script 91.2 KB 586 ms 1 alerts

05:05:29.626 GET 404 script 138 B 107 ms 4 alerts

05:05:29.629 GET 404 script 138 B 212 ms 4 alerts

05:05:29.630 GET 200 script 132.8 KB 369 ms —

05:05:29.633 GET 200 script 4.8 KB 513 ms —

05:05:29.638 GET 200 script 47.3 KB 591 ms 1 alerts

05:05:29.641 GET 200 script 50.4 KB 560 ms 4 alerts

05:05:29.643 GET 200 script 50.3 KB 868 ms 4 alerts

05:05:29.647 GET 200 script 132.8 KB 82 ms —

05:05:29.681 GET 200 script 50.4 KB 560 ms 4 alerts

Transaction #28

Request / response

URL

GET HTTPS

https://www.highperformanceformat.com/4d247ae1d24292c0188ea3d8c974e0cb/invoke.js

IP / ASN

172.240.127.244

AS7979 · SERVERS-COM

Requested by: http://woc.work.gd/

Resource information

File type: JavaScript source, ASCII text, with very long lines (51561), with no line terminators
MIME type: application/javascript
First seen (UTC): 06 Jul 2026 · 05:05:59.566 UTC
Last seen (UTC): 06 Jul 2026 · 20:30:26.768 UTC
Times seen: 2

Size: 50.4 KB (51561 bytes)
MD5: 723e8740afec10249893f651037ecc36
SHA1: 4609e5de7687308d50c6edbfedfe5b7a09ce11ad
SHA256: 7599e2958ec5f484cd52e0a9e802a7a087155c7d3a5a13e1dace6c61592ca456

Certificate information

Issuer: Let's Encrypt · YR2
Subject: highperformanceformat.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 54:46:9A:99:5D:9F:19:5B:67:21:55:1F:5C:6F:38:A2:52:41:7E:57
Valid from: Sun, 07 Jun 2026 22:27:03 GMT
Valid until: Sat, 05 Sep 2026 22:27:02 GMT

Technology fingerprints

Nginx:1.28.2 (Web servers, Reverse proxies)
Envoy (Reverse proxies)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Cloudflare DNS Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious
Hagezi Threat Feed Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /4d247ae1d24292c0188ea3d8c974e0cb/invoke.js HTTP/1.1
Host: www.highperformanceformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: http://woc.work.gd/
Sec-Fetch-Storage-Access: none
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.28.2
Date: Mon, 06 Jul 2026 05:05:30 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Device-Stock-UA,X-Device-User-Agent,Sec-CH-UA,Sec-CH-UA-PlatformUser-Agent,Sec-CH-UA-Full-Version,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA,User-Agent,Sec-CH-UA-Platform-Version
access-control-allow-origin: *
content-encoding: zstd
vary: Accept-Encoding
x-envoy-upstream-service-time: 2
Host: www.highperformanceformat.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 32a4d442bde33f58ba84934afaedce8f
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

05:05:29.684 GET 200 script 50.3 KB 556 ms 4 alerts

05:05:29.691 GET 200 img 63.8 KB 172 ms 2 alerts

05:05:29.693 GET 200 img 0 B 0 ms 1 alerts

05:05:29.695 GET 200 img 11.1 KB 86 ms —

05:05:30.176 GET 200 script 83.4 KB 125 ms —

05:05:30.179 GET 200 xhr 40 B 111 ms —

05:05:30.182 GET 200 img 0 B 0 ms 2 alerts

05:05:30.230 GET 200 script 83.4 KB 115 ms —

05:05:30.235 GET 200 xhr 40 B 91 ms —

05:05:30.237 GET 404 script 138 B 107 ms 4 alerts

05:05:30.354 GET 404 script 138 B 107 ms 4 alerts

05:05:30.469 GET 200 script 0 B 0 ms —

05:05:30.472 GET 200 script 0 B 0 ms —

05:05:30.475 GET 200 script 0 B 0 ms —

05:05:30.521 GET 200 img 0 B 0 ms 2 alerts

05:05:30.523 GET 200 img 0 B 0 ms 2 alerts

05:05:30.533 GET 200 img 0 B 0 ms —

05:05:30.539 GET 307 xhr 0 B 0 ms 2 alerts

05:05:30.541 GET 200 script 0 B 0 ms 2 alerts

05:05:30.545 GET 200 script 0 B 0 ms 4 alerts

05:05:30.547 GET 206 media 0 B 0 ms —

05:05:38.106 GET No response img 0 B 0 ms —

05:05:38.107 POST No response beacon 0 B 0 ms —

05:05:38.110 POST No response beacon 0 B 0 ms —

05:05:38.112 POST No response beacon 0 B 0 ms —

05:05:38.113 POST No response beacon 0 B 0 ms —

05:05:38.114 POST No response beacon 0 B 0 ms —

05:05:38.116 POST No response beacon 0 B 0 ms —

05:05:38.117 POST No response beacon 0 B 0 ms —

05:05:38.118 POST No response beacon 0 B 0 ms —

05:05:38.119 POST No response beacon 0 B 0 ms —

05:05:38.120 POST No response beacon 0 B 0 ms —

05:05:38.121 POST No response beacon 0 B 0 ms —

05:05:38.122 POST No response beacon 0 B 0 ms —

05:05:38.124 POST No response beacon 0 B 0 ms —

05:05:38.125 POST No response beacon 0 B 0 ms —

05:05:38.126 POST No response beacon 0 B 0 ms —

http://woc.work.gd/