Report - www.tg-me.com/us/GypsyCrusader+News+Network/com.gypsycrusader

Report Overview

URL

www.tg-me.com/us/GypsyCrusader+News+Network/com.gypsycrusader
IP

188.114.96.1

ASN

#13335 CLOUDFLARENET
Submitted

2023-02-03T23:45:10Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

0
Threat Detection Systems

6

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
intorterraon.com (3)	unknown	2022-08-02T13:41:34Z	2023-03-13T08:01:01Z	1888	77693	139.45.197.239
connect.facebook.net (2)	139	2012-05-22T04:51:28Z	2023-03-13T05:09:29Z	840	91129	31.13.72.12
acceptable.a-ads.com (1)	109567	2017-07-05T09:01:45Z	2023-03-13T03:52:07Z	474	407	144.76.28.254
cdn.innity.net (2)	28850	2012-05-21T16:13:30Z	2023-03-13T09:01:33Z	720	4181	23.32.97.102
knlrfijhvch.com (3)	unknown	2022-12-07T11:04:59Z	2023-02-21T10:05:09Z	1377	2806	62.122.171.6
ocsp.sectigo.com (4)	487	2019-11-29T12:50:24Z	2023-03-13T08:22:43Z	1360	17610	172.64.155.188
ocsp.digicert.com (2)	86	2012-05-21T09:02:23Z	2023-03-13T06:00:13Z	682	1474	93.184.220.29
api-public.addthis.com (6)	4111	2012-05-21T15:44:35Z	2023-03-13T05:19:27Z	3178	6112	2.18.172.123
r3.o.lencr.org (11)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3718	10380	95.101.11.115
my.rtmark.net (1)	9054	2015-02-04T10:54:57Z	2023-03-13T05:11:40Z	420	742	139.45.195.8
www.tg-me.com (2)	662678	2021-12-12T14:48:12Z	2023-03-09T17:41:27Z	882	1374	188.114.97.1
region1.google-analytics.com (1)	unknown	2022-03-17T12:26:33Z	2023-03-13T05:09:18Z	726	444	216.239.32.36
z.moatads.com (1)	374	2014-02-11T17:19:47Z	2023-03-13T05:10:11Z	388	1431	2.18.173.140
optimize.innity.com (4)	37523	2012-05-23T05:16:01Z	2023-03-13T09:30:22Z	1660	1740	119.81.3.35
www.facebook.com (1)	99	2012-05-21T02:23:41Z	2021-02-04T00:31:35Z	913	2464	31.13.72.36
e1.o.lencr.org (2)	6159	2021-08-20T09:36:30Z	2023-03-13T05:21:46Z	676	1456	95.101.11.115
s7.addthis.com (5)	1504	2012-05-21T05:34:04Z	2023-03-13T05:11:56Z	1959	198149	2.18.172.123
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	54.212.170.166
grid.bidswitch.net (1)	1211	2018-12-10T23:55:42Z	2023-03-13T04:59:33Z	367	212	18.194.21.26
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
www.googletagmanager.com (1)	75	2013-05-22T04:07:37Z	2023-03-13T08:28:24Z	381	77667	142.250.74.40
as.innity.com (4)	23995	2012-05-23T05:15:58Z	2023-03-13T09:34:01Z	2364	4030	149.129.240.178
v1.addthisedge.com (2)	1721	2019-05-22T20:56:22Z	2023-03-13T05:11:57Z	870	1680	2.18.172.123
m.addthis.com (1)	1448	2013-11-06T21:12:22Z	2023-03-13T08:48:31Z	835	361	2.18.172.123
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2372	35.241.9.150
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
ocsp.pki.goog (2)	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	686	1400	142.250.74.163
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	58038	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-02-03	medium	knlrfijhvch.com	Sinkholed
2023-02-03	medium	intorterraon.com	Sinkholed
2023-02-03	medium	knlrfijhvch.com	Sinkholed
2023-02-03	medium	intorterraon.com	Sinkholed
2023-02-03	medium	knlrfijhvch.com	Sinkholed
2023-02-03	medium	intorterraon.com	Sinkholed

ThreatFox

No alerts detected

HTTP Transactions (73)

URL IP Response Size

www.tg-me.com/us/GypsyCrusader+News+Network/com.gypsycrusader

188.114.97.1

301 Moved Permanently

URL HTTP/1.1

www.tg-me.com/us/GypsyCrusader+News+Network/com.gypsycrusader
IP

188.114.97.1:0
ASN

#13335 CLOUDFLARENET

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /us/GypsyCrusader+News+Network/com.gypsycrusader HTTP/1.1
Host: www.tg-me.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 301 Moved Permanently
Date: Fri, 03 Feb 2023 23:44:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 04 Feb 2023 00:44:58 GMT
Location: https://www.tg-me.com/us/GypsyCrusader+News+Network/com.gypsycrusader
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LfML7aByOfDwEWHPykgsb%2FLyWoDhOs%2F4177zx2eGh%2F5hwIhu2ny%2F%2Fte8BUWyQyX%2Brnxm13ih4sh8omxTyhmMVYr0I8oqgMjy9KBf2nQR8huP%2FOQ3mXFMbsda82qYHewT"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 793f09a08bd30b39-OSL
alt-svc: h2=":443"; ma=60

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

e935ea42be4feaed61a824b0b903913e

f966cfa80d65a805cb9d7c6a53b3340865d7c51a

eb0ce9ae50d156fe5924b2d77346735e4e93b5240cff301c9aa835bb0b385815

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB0CE9AE50D156FE5924B2D77346735E4E93B5240CFF301C9AA835BB0B385815"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3765
Expires: Sat, 04 Feb 2023 00:47:44 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

d4e95d0d8982bcd07804baf6fc88231c

5027abda0875bd2529dd4d6691784c74da71a9ee

373799b5749d2cb08b5721699a3e4c6b94b0d41604ac07d4ef7179e47dabc71f

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "373799B5749D2CB08B5721699A3E4C6B94B0D41604AC07D4EF7179E47DABC71F"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16612
Expires: Sat, 04 Feb 2023 04:21:51 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

30db107dcf4380cef05efea409c2e6a3

96e6a306fbc07299aba64e5c14e2bfca35872fa9

b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Alert, Retry-After, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 03 Feb 2023 23:43:35 GMT
content-type: application/json
age: 84
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

9a76feabb767086ae0fa54e0ffbf763f

3655d78994a1e9838340669462728b67c8c12e54

bf215ab858c7785b7c01f7d3d437a918f056f00fe9b065820e1cdd09b7bba8f9

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BF215AB858C7785B7C01F7D3D437A918F056F00FE9B065820E1CDD09B7BBA8F9"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11464
Expires: Sat, 04 Feb 2023 02:56:03 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

7b922915ebf1fa3639b333f994c74f24

144a3f80b98fd0652d4614f24cf6cbbee40f8938

adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: cpeOLWagBRDV3cuVkQaAtkEy6vPwkS4n8uZNtJtjTH+XkRyANU/b70PnUqFF4Ec/sntjgIBPGCQ=
x-amz-request-id: KDGNR4R100H6CMJ6
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 03 Feb 2023 23:23:46 GMT
age: 1273
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

e1.o.lencr.org/

95.101.11.115

200 OK

345

URL HTTP/1.1

e1.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

345
Hash

a4adb48fcec11be5899662d157aac89e

84b645e20d1fcb83415a3a12cce9224ef5d0621e

8cdbef7a8f6aafd8548816afc90ea12ac07f94aa2701c657be30eafc0a82914e

HTTP Headers

                                        POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "8CDBEF7A8F6AAFD8548816AFC90EA12AC07F94AA2701C657BE30EAFC0A82914E"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9901
Expires: Sat, 04 Feb 2023 02:30:00 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Fri, 03 Feb 2023 23:44:59 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

e1.o.lencr.org/

95.101.11.115

200 OK

345

URL HTTP/1.1

e1.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

345
Hash

a4adb48fcec11be5899662d157aac89e

84b645e20d1fcb83415a3a12cce9224ef5d0621e

8cdbef7a8f6aafd8548816afc90ea12ac07f94aa2701c657be30eafc0a82914e

HTTP Headers

                                        POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "8CDBEF7A8F6AAFD8548816AFC90EA12AC07F94AA2701C657BE30EAFC0A82914E"
Last-Modified: Fri, 03 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9901
Expires: Sat, 04 Feb 2023 02:30:00 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive

s7.addthis.com/js/300/addthis_widget.js

2.18.172.123

200 OK

116423

URL HTTP/2

s7.addthis.com/js/300/addthis_widget.js
IP

2.18.172.123:0
ASN

#16625 AKAMAI-AS

Magic

ASCII text, with very long lines (54602)

Size

116423
Hash

d5b9b7a3accd3b7b7de639c072ae3ee2

9583b5c046d78af5c6379d844219f828aa2222d0

648dad6716bb917c7d981e7772fca499d9583717fd83ffef47b0534cb9132b60

HTTP Headers

                                        GET /js/300/addthis_widget.js HTTP/1.1
Host: s7.addthis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx/1.15.8
content-type: application/javascript
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
etag: W/"5f971164-5834c"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 116423
date: Fri, 03 Feb 2023 23:44:59 GMT
vary: Accept-Encoding
x-distribution: 99
x-host: s7.addthis.com
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.163:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

7d482750bf7fdfcaa38c0efd583ef4dc

a4f68a124e4be130bc838e70f23fd4c6d2f4ef2d

5e6f1cadf4bc425664bb26fa2b384cf13900461b689c77d0916b1d2edd41337c

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 03 Feb 2023 23:44:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

cdn.innity.net/admanager.js

23.32.97.102

200 OK

3250

URL HTTP/1.1

cdn.innity.net/admanager.js
IP

23.32.97.102:0
ASN

#16625 AKAMAI-AS

Magic

ASCII text, with very long lines (10252), with no line terminators

Size

3250
Hash

67f70474488554526256d7b6c332ab34

e4e77246c8564d7ed7983ed1b665f78a87d3d4ac

1c7447c854562f1cb49f51443725ecb7a1483cab2a5ff39382528236af20014f

HTTP Headers

                                        GET /admanager.js HTTP/1.1
Host: cdn.innity.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Server: Apache
Last-Modified: Sat, 28 Aug 2021 09:22:10 GMT
ETag: "280c-5ca9b226f1480-gzip"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 3250
Content-Type: application/javascript
Unused62: 8096267
Cache-Control: max-age=86400
Expires: Sat, 04 Feb 2023 23:44:59 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive
Vary: Accept-Encoding

www.googletagmanager.com/gtag/js?id=G-H9DDVMTLKY

142.250.74.40

200 OK

77066

URL HTTP/2

www.googletagmanager.com/gtag/js?id=G-H9DDVMTLKY
IP

142.250.74.40:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (19467)

Size

77066
Hash

d6766fd9fe54f5465edc0143ce72a4c3

28309c39b8dcb24a40acc8f696fd7c3c7ff93a65

65f646365edca87f0c4454ef2f3f4f8a9080f33b474f7a12c7fc45eb8055b487

HTTP Headers

                                        GET /gtag/js?id=G-H9DDVMTLKY HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 03 Feb 2023 23:44:59 GMT
expires: Fri, 03 Feb 2023 23:44:59 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 77066
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

9a6c8215eb3a89ad30f7f0ae1509bfbd

09ad9c5a9a5793e3d60fa707ec6ee7246ec273ed

8aedfc66db7517c5f3e7392a66caab3018740c18d3cd192c76372481a4d5f2d6

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8AEDFC66DB7517C5F3E7392A66CAAB3018740C18D3CD192C76372481A4D5F2D6"
Last-Modified: Thu, 02 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10988
Expires: Sat, 04 Feb 2023 02:48:07 GMT
Date: Fri, 03 Feb 2023 23:44:59 GMT
Connection: keep-alive

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.163:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

7d482750bf7fdfcaa38c0efd583ef4dc

a4f68a124e4be130bc838e70f23fd4c6d2f4ef2d

5e6f1cadf4bc425664bb26fa2b384cf13900461b689c77d0916b1d2edd41337c

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 03 Feb 2023 23:44:59 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Content-Type, ETag, Last-Modified, Alert, Retry-After, Content-Length, Cache-Control, Pragma, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 03 Feb 2023 23:07:19 GMT
age: 2260
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

95.101.11.115

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

8913af0be619500295008bb91f506660

a7b8068ba9aa506205a295b24458c2616997a0d1

6a9838d00256431807ca382fc205064b07c08d5054f2895c2ae3cc4e9094179a

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A9838D00256431807CA382FC205064B07C08D5054F2895C2AE3CC4E9094179A"
Last-Modified: Wed, 01 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2274
Expires: Sat, 04 Feb 2023 00:22:54 GMT
Date: Fri, 03 Feb 2023 23:45:00 GMT
Connection: keep-alive

push.services.mozilla.com/

54.212.170.166

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

54.212.170.166:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: QhPp0nyC/62Kx0aTZiLQAQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: zM7YMTrAM1E1Ov336axiUUY+2FQ=

region1.google-analytics.com/g/collect?v=2&tid=G-H9DDVMTLKY&gtm=45je3210&_p=2041370825&cid=692671172.1675467933&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675467933&sct=1&seg=0&dl=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&dt=GypsyCrusader%20News%20Network%20Telegram&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1

216.239.32.36

204 No Content

URL HTTP/2

region1.google-analytics.com/g/collect?v=2&tid=G-H9DDVMTLKY&gtm=45je3210&_p=2041370825&cid=692671172.1675467933&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675467933&sct=1&seg=0&dl=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&dt=GypsyCrusader%20News%20Network%20Telegram&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
IP

216.239.32.36:0
ASN

#15169 GOOGLE

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        POST /g/collect?v=2&tid=G-H9DDVMTLKY&gtm=45je3210&_p=2041370825&cid=692671172.1675467933&ul=en-us&sr=1280x1024&uaW=1&_s=1&sid=1675467933&sct=1&seg=0&dl=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&dt=GypsyCrusader%20News%20Network%20Telegram&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.tg-me.com
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

                                        HTTP/2 204 No Content
access-control-allow-origin: https://www.tg-me.com
date: Fri, 03 Feb 2023 23:45:00 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.sectigo.com/

172.64.155.188

200 OK

471

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

471
Hash

5c62320f6ab246ad9986250b38b94f64

7a6728673ae060401127e4e527c45beca83a63da

8956040d5467106058972d77127e73243f85816f6fa650e1a310b987fe8af7c1

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Fri, 03 Feb 2023 23:45:00 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 01 Feb 2023 02:44:31 GMT
Expires: Wed, 08 Feb 2023 02:44:30 GMT
Etag: "7a6728673ae060401127e4e527c45beca83a63da"
Cache-Control: max-age=355769,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 793f09aa8b7eb517-OSL

ocsp.sectigo.com/

172.64.155.188

200 OK

471

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

471
Hash

5c62320f6ab246ad9986250b38b94f64

7a6728673ae060401127e4e527c45beca83a63da

8956040d5467106058972d77127e73243f85816f6fa650e1a310b987fe8af7c1

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Fri, 03 Feb 2023 23:45:00 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 01 Feb 2023 02:44:31 GMT
Expires: Wed, 08 Feb 2023 02:44:30 GMT
Etag: "7a6728673ae060401127e4e527c45beca83a63da"
Cache-Control: max-age=355769,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 793f09aaa86cb506-OSL

as.innity.com/synd/?cb=1675467932898&ver=1&pub=dc727151e5d55dde1e950767cf861ca5&zone=93380&output=js&flash=0&url=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&width=*&height=*&vpw=1280&vph=939&auction=2d74aba-a6352ce

Indonesia Alibaba US Technology Co., Ltd.

149.129.240.178

200 OK

296

URL HTTP/1.1

as.innity.com/synd/?cb=1675467932898&ver=1&pub=dc727151e5d55dde1e950767cf861ca5&zone=93380&output=js&flash=0&url=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&width=*&height=*&vpw=1280&vph=939&auction=2d74aba-a6352ce
IP

149.129.240.178:0
ASN

#45102 Alibaba US Technology Co., Ltd.

Magic

HTML document, ASCII text, with very long lines (463), with no line terminators

Size

296
Hash

dfb6a3fa4c95ca568674eece21d9c6c8

6e80193407a29499499543af35d8ca9a038ce298

81e69867bfd76563e80321931b84585d89a1e3b4cd9f410fb82b36dde19b338a

HTTP Headers

                                        GET /synd/?cb=1675467932898&ver=1&pub=dc727151e5d55dde1e950767cf861ca5&zone=93380&output=js&flash=0&url=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&width=*&height=*&vpw=1280&vph=939&auction=2d74aba-a6352ce HTTP/1.1
Host: as.innity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Date: Fri, 03 Feb 2023 23:45:00 GMT
Server: Apache
Expires: Sat, 03 Sep 1983 02:00:00 GMT
Last-Modified: Fri, 03 Feb 2023 23:45:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Pragma: no-cache
P3P: policyref=http://www.innity.com/p3p/p3p.xml,CP="CURa ADMa DEVa OUR BUS UNI COM NAV INT"
Set-Cookie: iUUID=dfe7d129b42cd79a2dcc04cddc2ef621; expires=Sun, 02-Feb-2025 23:45:00 GMT; Max-Age=63072000; path=/; SameSite=None; Secure; domain=innity.com
iGEO=NO%7E12; expires=Sat, 04-Feb-2023 23:45:00 GMT; Max-Age=86400; path=/; SameSite=None; Secure; domain=innity.com
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 296
Content-Type: text/javascript; charset=utf-8

as.innity.com/synd/?cb=1675467932886&ver=1&pub=dc727151e5d55dde1e950767cf861ca5&zone=93378&output=js&flash=0&url=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&width=*&height=*&vpw=1280&vph=939&auction=2d74aba-a6352ce

149.129.240.178

200 OK

296

URL HTTP/1.1

as.innity.com/synd/?cb=1675467932886&ver=1&pub=dc727151e5d55dde1e950767cf861ca5&zone=93378&output=js&flash=0&url=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&width=*&height=*&vpw=1280&vph=939&auction=2d74aba-a6352ce
IP

149.129.240.178:0
ASN

#45102 Alibaba US Technology Co., Ltd.

Magic

HTML document, ASCII text, with very long lines (463), with no line terminators

Size

296
Hash

7145243f25bbf2f128acf3ed17316a71

7dc40a9f7e5d5f195a9b4c999faf155a58e373c2

d2c14153b3058cda767c068d4672022ffe29c613b038e7330456121f18bd4a48

HTTP Headers

                                        GET /synd/?cb=1675467932886&ver=1&pub=dc727151e5d55dde1e950767cf861ca5&zone=93378&output=js&flash=0&url=https%3A%2F%2Fwww.tg-me.com%2Fus%2FGypsyCrusader%2BNews%2BNetwork%2Fcom.gypsycrusader&width=*&height=*&vpw=1280&vph=939&auction=2d74aba-a6352ce HTTP/1.1
Host: as.innity.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Date: Fri, 03 Feb 2023 23:45:01 GMT
Server: Apache
Expires: Sat, 03 Sep 1983 02:00:00 GMT
Last-Modified: Fri, 03 Feb 2023 23:45:01 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Pragma: no-cache
P3P: policyref=http://www.innity.com/p3p/p3p.xml,CP="CURa ADMa DEVa OUR BUS UNI COM NAV INT"
Set-Cookie: iUUID=934d83095735f2fde8b2947c6a4f3bf0; expires=Sun, 02-Feb-2025 23:45:01 GMT; Max-Age=63072000; path=/; SameSite=None; Secure; domain=innity.com
iGEO=NO%7E12; expires=Sat, 04-Feb-2023 23:45:01 GMT; Max-Age=86400; path=/; SameSite=None; Secure; domain=innity.com
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 296
Content-Type: text/javascript; charset=utf-8

cdn.innity.net/analytics.js

23.32.97.102

200 OK

152

URL HTTP/1.1

cdn.innity.net/analytics.js
IP

23.32.97.102:0
ASN

#16625 AKAMAI-AS

Magic

ASCII text, with no line terminators

Size

152
Hash

46d5024ebf1b6a988ead272230810b3f

14f8bac9205ef9cea440bd07bc08f21203181854

e29a328204732024e194cde9dbd28b72d517c2f56f228e50d5a496fd746b51aa

HTTP Headers

                                        GET /analytics.js HTTP/1.1
Host: cdn.innity.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 09 Dec 2015 07:32:50 GMT
ETag: "ad-5267218ef0c80-gzip"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 152
Content-Type: application/javascript
Unused62: 8096267
Cache-Control: max-age=86400
Expires: Sat, 04 Feb 2023 23:45:01 GMT
Date: Fri, 03 Feb 2023 23:45:01 GMT
Connection: keep-alive
Vary: Accept-Encoding

knlrfijhvch.com/solid.gif?z=1945070&abvar=2

62.122.171.6

200 OK

URL HTTP/2

knlrfijhvch.com/solid.gif?z=1945070&abvar=2
IP

62.122.171.6:0
ASN

#50245 Serverel Inc.

Magic

GIF image data, version 89a, 1 x 1\012- data

Size

43
Hash

28e463819a210071de3b45ebe7633613

6dccd571828ec0912629119cf7eabfea9f33ddbc

44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        POST /solid.gif?z=1945070&abvar=2 HTTP/1.1
Host: knlrfijhvch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.tg-me.com
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Fri, 03 Feb 2023 23:45:01 GMT
content-type: image/gif
content-length: 43
x-route-id: stats.tag.loaded
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

z.moatads.com/addthismoatframe568911941483/moatframe.js

2.18.173.140

200 OK

948

URL HTTP/2

z.moatads.com/addthismoatframe568911941483/moatframe.js
IP

2.18.173.140:0
ASN

#16625 AKAMAI-AS

Magic

ASCII text, with very long lines (523)

Size

948
Hash

f14b4e1f799b14f798a195f43cf58376

b6fd3b3d407fb4c0a00fb8a31862235e2a6e0a86

92ed3e9fda5fa4d738ff4d9023846b56633617363dda6a750cacb4fba53241ac

HTTP Headers

                                        GET /addthismoatframe568911941483/moatframe.js HTTP/1.1
Host: z.moatads.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: TYrAmp44ddThNKrHeBmfOrJOox8ItZdAJeP4Uj7Uut6T7Jvp1PpX/XFzXT0gU1oJH/SwK8Irisw=
x-amz-request-id: 598E0BAF9E725A50
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
etag: "f14b4e1f799b14f798a195f43cf58376"
content-encoding: gzip
accept-ranges: bytes
content-type: application/x-javascript
content-length: 948
server: AmazonS3
vary: Accept-Encoding
unused62: 8096267
cache-control: max-age=46103
date: Fri, 03 Feb 2023 23:45:01 GMT
X-Firefox-Spdy: h2

intorterraon.com/5/5557327

139.45.197.239

200 OK

50322

URL HTTP/2

intorterraon.com/5/5557327
IP

139.45.197.239:0
ASN

#9002 RETN Limited

Magic

ASCII text, with very long lines (64428)

Size

50322
Hash

451ef4a1b4a824413286897096efe340

39b70094e3b05abd2aa98728cd554e75f322978d

3f255b7347e8376ef999711b6379ce4a3305d27595dc04b00a7f8b33fd937d0a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /5/5557327 HTTP/1.1
Host: intorterraon.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Fri, 03 Feb 2023 23:44:59 GMT
content-type: application/javascript
x-trace-id: 786976f64ae531b2259d9c982a9691a1
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=bf78995502c646e0aaf4e82ea1eaef09; expires=Sat, 03 Feb 2024 23:44:59 GMT; path=/; secure; SameSite=None
oaidts=1675467899; expires=Sat, 03 Feb 2024 23:44:59 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

d3e050cf67675c3c19014a74517e3747

9931fd6a416e220e15ef5eccad6d0cb12edf3995

8411e23b7bfeba91b6252f15de6ed18b8cff1f752af0efc4f5429b54fccb0da4

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5613
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 03 Feb 2023 23:45:01 GMT
Last-Modified: Fri, 03 Feb 2023 22:11:28 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471

v1.addthisedge.com/live/boost/ra-61710efec007c081/_ate.track.config_resp

2.18.172.123

200 OK

526

URL HTTP/2

v1.addthisedge.com/live/boost/ra-61710efec007c081/_ate.track.config_resp
IP

2.18.172.123:0
ASN

#16625 AKAMAI-AS

Magic

ASCII text, with very long lines (1483), with no line terminators

Size

526
Hash

d28911df369ba0a8165a3d9611cb8fe3

cb00637ed6c61847fba8b33ee1048bbddc606d04

c60e78c2a41793d386fbfe0bc3aaac2cc73a75749da959a83c4f558306ee07ee

HTTP Headers

                                        GET /live/boost/ra-61710efec007c081/_ate.track.config_resp HTTP/1.1
Host: v1.addthisedge.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
content-type: application/javascript;charset=utf-8
content-length: 526
etag: 411546989--gzip
content-disposition: attachment; filename=1.txt
content-encoding: gzip
cache-control: public, max-age=0, s-maxage=86400
date: Fri, 03 Feb 2023 23:45:01 GMT
vary: Accept-Encoding
X-Firefox-Spdy: h2

connect.facebook.net/en_GB/sdk.js

31.13.72.12

200 OK

1687

URL HTTP/2

connect.facebook.net/en_GB/sdk.js
IP

31.13.72.12:0
ASN

#32934 FACEBOOK

Magic

ASCII text, with very long lines (1957)

Size

1687
Hash

083ae2d1056421d7cc6362e51339d07d

6e01248349d8bc704dd323b181ca7a83d064d7b4

b1a9b9e157565081209ce65891261108fd5434a2a9d8857854ea75a58ef4117c

HTTP Headers

                                        GET /en_GB/sdk.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.tg-me.com
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
access-control-expose-headers: X-FB-Content-MD5
x-fb-content-md5: 2db7f7a14b52cfe3c8b1836b03f4e3b1
etag: "fce29239f54f01a87cc0b9dde3647057"
content-type: application/x-javascript; charset=utf-8
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
expires: Fri, 03 Feb 2023 23:54:49 GMT
cache-control: public,max-age=1200,stale-while-revalidate=3600
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
x-frame-options: DENY
origin-agent-cluster: ?0
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-md5: CDri0QVkIdfMY2LlEznQfQ==
x-fb-debug: cGM0xCRFyxUMx/54rB/f+C1n9DuPkOBxWD4mBUfpe55QKVIcC52y6FpuhJgZYc5t5C0j2/yfWCxDB7hMnsTzxA==
content-length: 1687
x-fb-trip-id: 1904183273
date: Fri, 03 Feb 2023 23:45:01 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

knlrfijhvch.com/get/1945070?zoneid=1945070&jp=_cls2htb2pw27jq7ghe44ll&nojs=0&ix=0&abvar=2&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=954228396669095

62.122.171.6

200 OK

URL HTTP/2

knlrfijhvch.com/get/1945070?zoneid=1945070&jp=_cls2htb2pw27jq7ghe44ll&nojs=0&ix=0&abvar=2&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=954228396669095
IP

62.122.171.6:0
ASN

#50245 Serverel Inc.

Magic

ASCII text, with no line terminators

Size

7
Hash

a97eb6fbe6f13b601d5d48c0eba8baae

736efb938caf3d0edec406932ada889f1a4f2268

a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /get/1945070?zoneid=1945070&jp=_cls2htb2pw27jq7ghe44ll&nojs=0&ix=0&abvar=2&t=0&x=1280&y=939&wcks=1&wgl=0&cnvs=1&os=0&md=0&bb=0&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=1&sp=0&cid=954228396669095 HTTP/1.1
Host: knlrfijhvch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.tg-me.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Fri, 03 Feb 2023 23:45:01 GMT
content-type: text/javascript
content-length: 7
x-route-id: config
set-cookie: UID=2302031845688edefbf1cd4712a8448167e7; Path=/; Expires=Sat, 03 Feb 2024 23:45:01 GMT; HttpOnly; Secure; SameSite=None
timing-allow-origin: *
accept-ch: sec-ch-ua,ua,sec-ch-ua-platform,ua-platform,sec-ch-ua-mobile,ua-mobile,sec-ch-ua-full-version,ua-full-version,sec-ch-ua-platform-version,ua-platform-version,sec-ch-ua-arch,ua-arch,sec-ch-ua-bitness,ua-bitness,sec-ch-ua-model,ua-model,sec-ch-lang,lang,sec-ch-save-data,save-data,sec-ch-width,width,sec-ch-viewport-width,viewport-width,sec-ch-viewport-height,viewport-height,sec-ch-dpr,dpr,sec-ch-device-memory,device-memory,sec-ch-rtt,rtt,sec-ch-downlink,downlink,sec-ch-ect,ect,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

d3e050cf67675c3c19014a74517e3747

9931fd6a416e220e15ef5eccad6d0cb12edf3995

8411e23b7bfeba91b6252f15de6ed18b8cff1f752af0efc4f5429b54fccb0da4

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5613
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 03 Feb 2023 23:45:01 GMT
Last-Modified: Fri, 03 Feb 2023 22:11:28 GMT
Server: ECS (ska/F6FE)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

95.101.11.115

200 OK

1129

URL HTTP/1.1

r3.o.lencr.org/
IP

95.101.11.115:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

1129
Hash

426343663196a171ee1dee5614fa19ee

eabf9bfe50b6517a5d5d8000983afd6220632351

e5402edf1efd558a3f7315484718f172284601a91a16f143f540e06cc4856b85

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2864347C8CAFC993E298B6C80A7E34B0C49710B9E8E35AF6815EF685D4EFDAF2"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2731
Expires: Sat, 04 Feb 2023 00:30:32 GMT
Date: Fri, 03 Feb 2023 23:45:01 GMT
Connection: keep-alive

ocsp.sectigo.com/

172.64.155.188

200 OK

14229

URL HTTP/1.1

ocsp.sectigo.com/
IP

172.64.155.188:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

14229
Hash

3cc054e78b2551fe816870b38d6daf9f

176883422ef5a37cd7c6966306ebdb7804e1cc1b

49442abfdb9691aecad5e820f51fd57430347ecbef154bdada46b7fc6b1ee2c4

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Fri, 03 Feb 2023 23:45:01 GMT
Content-Type: application/ocsp-response
Content-Length: 280
Connection: keep-alive
Last-Modified: Thu, 02 Feb 2023 04:43:15 GMT
Expires: Thu, 09 Feb 2023 04:43:14 GMT
Etag: "a641e796e689acb14da9d8f820f6d3795bc69a06"
Cache-Control: max-age=449292,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 793f09afa8dfb517-OSL

my.rtmark.net/gid.js?userId=bf78995502c646e0aaf4e82ea1eaef09

139.45.195.8

200 OK

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (60)

#1 JS:Script (size: 173)

#2 JS:Script (size: 0)

#3 JS:Script (size: 185)

#4 JS:Script (size: 1679)

#5 JS:Script (size: 34)

#6 JS:Script (size: 34)

#7 JS:Script (size: 33)

#8 JS:Script (size: 10252)

#9 JS:Script (size: 463)

#10 JS:Script (size: 307858)

#11 JS:Script (size: 1839)

#12 JS:Script (size: 160)

#13 JS:Script (size: 1507)

#14 JS:Script (size: 361292)

#15 JS:Script (size: 170)

#16 JS:Script (size: 219706)

#17 JS:Script (size: 72197)

#18 JS:Script (size: 463)

#19 JS:Script (size: 389)

#20 JS:Script (size: 389)

#21 JS:Script (size: 151)

#22 JS:Script (size: 644)

#23 JS:Script (size: 564)

#24 JS:Script (size: 184)

#25 JS:Script (size: 22)

#26 JS:Script (size: 4663)

#27 JS:Script (size: 75425)

#28 JS:Script (size: 1487)

#29 JS:Script (size: 64233)

#30 JS:Script (size: 1483)

#31 JS:Script (size: 7)

#32 JS:Script (size: 389)

#33 JS:Script (size: 664)

#34 JS:Script (size: 33840)

#35 JS:Script (size: 269557)

#36 JS:Script (size: 3093)

#37 JS:Script (size: 89)

#38 JS:Script (size: 463)

#39 JS:Script (size: 113)

#40 JS:Script (size: 463)

#41 JS:Script (size: 33)

#42 JS:Script (size: 3716)

#43 JS:Script (size: 389)

#44 JS:Script (size: 1705)

#45 JS:Script (size: 64231)

#46 JS:Script (size: 90)

#1 JS:Eval (size: 8)

#2 JS:Eval (size: 11)

#1 JS:Write (size: 311)

#2 JS:Write (size: 1)

#3 JS:Write (size: 406)

#4 JS:Write (size: 317)

#5 JS:Write (size: 311)

#6 JS:Write (size: 406)

#7 JS:Write (size: 406)

#8 JS:Write (size: 313)