WEBSITE ANALYSIS REPORT

http://woc.work.gd/

06 Jul 2026 · 05:05:51.000 UTCpublic

Report tags: dyndns
Submit tags

Request review

Suspicious activity

21 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

acs.aliexpress.com0 captured requests
ajbtop.click1 captured requests
aplus.aliexpress.com16 captured requests
best.aliexpress.com0 captured requests
efreecode.com1 captured requests
hometeens.top1 captured requests
i.imgur.com1 captured requests
images2.imgbox.com1 captured requests
js.mbidadm.com1 captured requests
js.onclckmn.com4 captured requests
log.mmstat.com1 captured requests
pl29691875.effectivecpmnetwork.com1 captured requests
pl29691876.effectivecpmnetwork.com1 captured requests
pl29691878.effectivecpmnetwork.com1 captured requests
portalfluently.com2 captured requests
protrafficinspector.com2 captured requests
sexymodels.top1 captured requests
us.ynuf.aliapp.org1 captured requests
vipamateur.top1 captured requests
woc.work.gd6 captured requests
workdeadlinededicate.com3 captured requests
www.bigland.top1 captured requests
www.highperformanceformat.com5 captured requests

Connections

acs.aliexpress.com → log.mmstat.comLoads from1 captured connections
best.aliexpress.com → aplus.aliexpress.comCalls15 captured connections
best.aliexpress.com → aplus.aliexpress.comLoads from1 captured connections
best.aliexpress.com → us.ynuf.aliapp.orgCalls1 captured connections
woc.work.gd → ajbtop.clickLoads from1 captured connections
woc.work.gd → efreecode.comLoads from1 captured connections
woc.work.gd → hometeens.topLoads from1 captured connections
woc.work.gd → i.imgur.comLoads from1 captured connections
woc.work.gd → images2.imgbox.comLoads from1 captured connections
woc.work.gd → js.mbidadm.comLoads from1 captured connections
woc.work.gd → js.onclckmn.comLoads from4 captured connections
woc.work.gd → pl29691875.effectivecpmnetwork.comLoads from1 captured connections
woc.work.gd → pl29691876.effectivecpmnetwork.comLoads from1 captured connections
woc.work.gd → pl29691878.effectivecpmnetwork.comLoads from1 captured connections
woc.work.gd → portalfluently.comLoads from2 captured connections
woc.work.gd → protrafficinspector.comCalls2 captured connections
woc.work.gd → sexymodels.topLoads from1 captured connections
woc.work.gd → vipamateur.topLoads from1 captured connections
woc.work.gd → workdeadlinededicate.comCalls1 captured connections
woc.work.gd → workdeadlinededicate.comLoads from2 captured connections
woc.work.gd → www.bigland.topLoads from1 captured connections
woc.work.gd → www.highperformanceformat.comLoads from5 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

05:05:28.565 GET No response document 0 B 0 ms 4 alerts

05:05:28.796 GET 200 document 25.4 KB 542 ms 4 alerts

05:05:29.620 GET 200 script 95.4 KB 495 ms 1 alerts

05:05:29.623 GET 200 script 91.2 KB 586 ms 1 alerts

05:05:29.626 GET 404 script 138 B 107 ms 4 alerts

Transaction #45

Request / response

URL

GET HTTP

http://woc.work.gd/pop.js

IP / ASN

92.118.112.8

AS215540 · Global Connectivity Solutions Llp

Requested by: http://woc.work.gd/

Resource information

File type: HTML document, ASCII text
MIME type: text/html
First seen (UTC): 13 Mar 2023 · 12:56:15.000 UTC
Last seen (UTC): 24 Oct 2026 · 11:25:59.540 UTC
Times seen: 349692

Size: 138 B (138 bytes)
MD5: 7389d931c86b3d7bb6b8af46d8c4172b
SHA1: 8d2a4760aa0b47984d11cd1a66448719177fb791
SHA256: 301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f

Certificate information

Certificate and TLS information not recorded.

Technology fingerprints

Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Suspicious - DynDNS domain	low	Suspicious
Quad9 DNS Sinkholed	medium	Malicious
DigiCert UltraDNS Sinkholed	medium	Malicious
Hagezi Threat Feed Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /pop.js HTTP/1.1
Host: woc.work.gd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate
Referer: http://woc.work.gd/
Sec-GPC: 1
Connection: keep-alive
Cookie: sloth_src=noref; sloth_cc=0; sloth_sc=0; sloth_nosend=6a4b3799%253A00%253ATnoref%253A
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 06 Jul 2026 05:05:29 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
ETag: "6a102cc1-8a"

05:05:29.629 GET 404 script 138 B 212 ms 4 alerts

05:05:29.630 GET 200 script 132.8 KB 369 ms —

05:05:29.633 GET 200 script 4.8 KB 513 ms —

05:05:29.638 GET 200 script 47.3 KB 591 ms 1 alerts

05:05:29.641 GET 200 script 50.4 KB 560 ms 4 alerts

05:05:29.643 GET 200 script 50.3 KB 868 ms 4 alerts

05:05:29.647 GET 200 script 132.8 KB 82 ms —

05:05:29.681 GET 200 script 50.4 KB 560 ms 4 alerts

05:05:29.684 GET 200 script 50.3 KB 556 ms 4 alerts

05:05:29.691 GET 200 img 63.8 KB 172 ms 2 alerts

05:05:29.693 GET 200 img 0 B 0 ms 1 alerts

05:05:29.695 GET 200 img 11.1 KB 86 ms —

05:05:30.176 GET 200 script 83.4 KB 125 ms —

05:05:30.179 GET 200 xhr 40 B 111 ms —

05:05:30.182 GET 200 img 0 B 0 ms 2 alerts

05:05:30.230 GET 200 script 83.4 KB 115 ms —

05:05:30.235 GET 200 xhr 40 B 91 ms —

05:05:30.237 GET 404 script 138 B 107 ms 4 alerts

05:05:30.354 GET 404 script 138 B 107 ms 4 alerts

05:05:30.469 GET 200 script 0 B 0 ms —

05:05:30.472 GET 200 script 0 B 0 ms —

05:05:30.475 GET 200 script 0 B 0 ms —

05:05:30.521 GET 200 img 0 B 0 ms 2 alerts

05:05:30.523 GET 200 img 0 B 0 ms 2 alerts

05:05:30.533 GET 200 img 0 B 0 ms —

05:05:30.539 GET 307 xhr 0 B 0 ms 2 alerts

05:05:30.541 GET 200 script 0 B 0 ms 2 alerts

05:05:30.545 GET 200 script 0 B 0 ms 4 alerts

05:05:30.547 GET 206 media 0 B 0 ms —

05:05:38.106 GET No response img 0 B 0 ms —

05:05:38.107 POST No response beacon 0 B 0 ms —

05:05:38.110 POST No response beacon 0 B 0 ms —

05:05:38.112 POST No response beacon 0 B 0 ms —

05:05:38.113 POST No response beacon 0 B 0 ms —

05:05:38.114 POST No response beacon 0 B 0 ms —

05:05:38.116 POST No response beacon 0 B 0 ms —

05:05:38.117 POST No response beacon 0 B 0 ms —

05:05:38.118 POST No response beacon 0 B 0 ms —

05:05:38.119 POST No response beacon 0 B 0 ms —

05:05:38.120 POST No response beacon 0 B 0 ms —

05:05:38.121 POST No response beacon 0 B 0 ms —

05:05:38.122 POST No response beacon 0 B 0 ms —

05:05:38.124 POST No response beacon 0 B 0 ms —

05:05:38.125 POST No response beacon 0 B 0 ms —

05:05:38.126 POST No response beacon 0 B 0 ms —

http://woc.work.gd/

Domain graph

Hostnames

Connections

Network requests

Transaction #45

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://woc.work.gd/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #45

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://woc.work.gd/

Domain graph

Network requests