Report - www.shotgunexpress.com/

Report Overview

Submitted URL
www.shotgunexpress.com/
IP
156.224.158.251
ASN
#133201 ABCDE GROUP COMPANY LIMITED
Submitted
2022-11-06 11:08:23
Access
Website Title
Final URL
Tags
None
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-10T05:09:10Z	676 B	1.8 kB	23.36.77.32
www.shotgunexpress.com	unknown	2022-01-28T18:14:51Z	2022-11-06T12:08:09Z	959 B	6.9 kB	156.224.158.251
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-10T13:49:44Z	341 B	796 B	93.184.220.29
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-10T05:12:35Z	413 B	5.8 kB	34.160.144.191
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-10T05:10:00Z	333 B	229 B	34.117.237.239
www.kailang17.com	unknown	2013-11-12T00:47:28Z	2023-02-26T01:49:27Z	986 B	74 kB	175.6.243.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-11-06	medium	kailang17.com	Sinkholed
2022-11-06	medium	kailang17.com	Sinkholed
2022-11-06	medium	kailang17.com	Sinkholed

JavaScript (4)

	URL	Size	First Seen	Last Seen
	www.shotgunexpress.com/888.js	2.4 kB	2023-03-10	2023-03-10
Pretty URL www.shotgunexpress.com/888.js IP 156.224.158.251 ASN #133201 ABCDE GROUP COMPANY LIMITED Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-10 22:22:14 Last Seen2023-03-10 22:22:14 Times Seen1 Hash 7fa6c6be5b2910266fe7bdcda0606bc1 3bae54283fb4e9ed6b8c895152ff7869b70d8b0f e3b518401cdbf35a6866684c0415273c670f5eefef69e14ac9cbd677561f5d0f Loading...

		Size	First Seen	Last Seen
	#1 Write - d93e1215cff5d4c42f64c8a02d06a514	67 B	2023-03-07	2023-12-14
Pretty Observations First Seen2023-03-07 12:08:41 Last Seen2023-12-14 20:53:07 Times Seen231 Hash d93e1215cff5d4c42f64c8a02d06a514 671e0c1de9f4e74f7cfa0854d62318b248843410 53ba6a10d65d00e320337485745f6ee955db6063e284688629231212a461f32f Loading...

	#2 Write - 111b7728d73d036f7f08d085803296ec	124 B	2023-03-10	2023-03-10
Pretty Observations First Seen2023-03-10 22:22:14 Last Seen2023-03-10 22:22:14 Times Seen1 Hash 111b7728d73d036f7f08d085803296ec d006ae931dc64780d6afcb7819da267abaf9233b 706dd8cee562499a2f9b1f5018975655d8a5e9f9c2fbe2058c410db0dbfdcaab Loading...

	#3 Write - 978cf4ebea4905ee74647da257c32b21	11 B	2023-03-07	2024-01-26
Pretty Observations First Seen2023-03-07 12:08:41 Last Seen2024-01-26 11:10:16 Times Seen314 Hash 978cf4ebea4905ee74647da257c32b21 f2a9a3f2bf9282ee51e5e40139ebeb33c0a2b660 0f752c743aa4658752caa563ab21cd6c27531768ea1842812e37b86d543cffac Loading...

HTTP Transactions (11)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8286265a56e3e10efd41b41618a54071
5f10ac9a050e15f5598674dc7ee3865b325d01a8
2da2fa0b2b86ccc4029d0baa4e9c5b21a6433228b84b451b72b1d318561d4ef2

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2DA2FA0B2B86CCC4029D0BAA4E9C5B21A6433228B84B451B72B1D318561D4EF2"
Last-Modified: Sat, 05 Nov 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2744
Expires: Sun, 06 Nov 2022 11:53:54 GMT
Date: Sun, 06 Nov 2022 11:08:10 GMT
Connection: keep-alive

www.shotgunexpress.com/

156.224.158.251

200 OK

5.0 kB

URL HTTP/1.1
www.shotgunexpress.com/
IP
156.224.158.251:0
ASN
#133201 ABCDE GROUP COMPANY LIMITED

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
5.0 kB (5001 bytes)
Hash
6e19820c36fa533c001a1cf66f94a174
8888daee50e88948ae5975af645a2cfe956390c0
93084f1eadd6926ec8adceb1f66584b8ead858fc837e9841f49ef7bd4d8a783a

HTTP Headers

GET / HTTP/1.1
Host: www.shotgunexpress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Nov 2022 11:08:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
72c64df35304c35cd95e4ed6e101e795
a39287987854d644a8da295da536fb31de8b44c1
a9bf0da57e0f108b376781ede4b9762ae1b0d088910d26fb7be98c2d03e69092

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5680
Cache-Control: max-age=86254
Content-Type: application/ocsp-response
Date: Sun, 06 Nov 2022 11:08:10 GMT
Etag: "63662d58-1d7"
Expires: Mon, 07 Nov 2022 11:05:44 GMT
Last-Modified: Sat, 05 Nov 2022 09:31:04 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9f3527f898221f8ba6b5015f6decc100
ead93baa0e9d3a6297be3377dc3a624e5a3f509a
73a068f907cc50dd60af18d545b4264dd44bc4b9f40bf9adfceea157fdc33099

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "73A068F907CC50DD60AF18D545B4264DD44BC4B9F40BF9ADFCEEA157FDC33099"
Last-Modified: Thu, 03 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2497
Expires: Sun, 06 Nov 2022 11:49:47 GMT
Date: Sun, 06 Nov 2022 11:08:10 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: uiFekk3PYMVc7E9twvhbbXsjL+qJVdfjcxRxDaWPg4xTGadFcu8nvGgDWdDp40wODPZJmjCzAms=
x-amz-request-id: EG6GXAWNYQC2KRG7
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 06 Nov 2022 10:47:36 GMT
age: 1234
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sun, 06 Nov 2022 11:08:10 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

www.shotgunexpress.com/888.js

156.224.158.251

200 OK

1.0 kB

URL HTTP/1.1
www.shotgunexpress.com/888.js
IP
156.224.158.251:0
ASN
#133201 ABCDE GROUP COMPANY LIMITED

File type
HTML document, ASCII text, with very long lines (388)
Size
1.0 kB (1036 bytes)
Hash
5e914305bd68052f920fd8cc58e87aae
e17f0088eb1f46b141f93153a289eb823aeb3e69
6cfd0c2bc173866f8acf59fb6745294e4edae89a8d8633edf466362d9ffdb235

HTTP Headers

GET /888.js HTTP/1.1
Host: www.shotgunexpress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.shotgunexpress.com/

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 06 Nov 2022 11:08:21 GMT
Content-Type: application/javascript
Last-Modified: Thu, 03 Nov 2022 05:17:35 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63634eef-97b"
Expires: Sun, 06 Nov 2022 23:08:21 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

www.kailang17.com/Skins/185618/css/style.css

175.6.243.35

200 OK

6.9 kB

URL HTTP/1.1
www.kailang17.com/Skins/185618/css/style.css
IP
175.6.243.35:0
ASN
#63838 Hengyang

File type
ISO-8859 text, with CRLF line terminators
Size
6.9 kB (6857 bytes)
Hash
b375128f0104bc9e25b14bfeb4fa498f
e6ede03ab8451c490cd1f6a17cb6cf9f7654dbbc
27c1f79a6918f79161d284e7029a0854a61b3204e7760e709b8a254cf88824bf

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /Skins/185618/css/style.css HTTP/1.1
Host: www.kailang17.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.shotgunexpress.com/

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sun, 06 Nov 2022 11:08:12 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 24 Mar 2020 08:02:26 GMT
ETag: W/"7ceae08eb21d61:0"
Content-Encoding: gzip
Vary: Accept-Encoding, Accept-Encoding
X-Powered-By: ASP.NET-4.182
Content-Security-Policy: script-src?'self'
Referrer-Policy: unsafe-url
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1;?mode=block
Timing-Allow-Origin: *
Ohc-Cache-HIT: hengyct62 [1], xiangyix158 [1]
X-Cache-Status: MISS

www.kailang17.com/Skins/185618/images/news_img.jpg

175.6.243.35

200 OK

13 kB

URL HTTP/1.1
www.kailang17.com/Skins/185618/images/news_img.jpg
IP
175.6.243.35:0
ASN
#63838 Hengyang

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 155x155, components 3\012- data
Size
13 kB (13291 bytes)
Hash
90607c79bcbbf734b579c93fb11a5259
ad792a1a22f7ef6a2f6981f894fdd9c7a3ef9128
ee3af8f5f6565a5c42c2e5662f3a576a3e100211a9d50d7a73a33f7d279d8f66

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /Skins/185618/images/news_img.jpg HTTP/1.1
Host: www.kailang17.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.shotgunexpress.com/

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sun, 06 Nov 2022 11:08:12 GMT
Content-Type: image/jpeg
Content-Length: 13291
Connection: keep-alive
Last-Modified: Thu, 27 Sep 2018 07:55:35 GMT
ETag: "44cd2c793756d41:0"
Accept-Ranges: bytes
X-Powered-By: ASP.NET-4.182
Content-Security-Policy: script-src?'self'
Referrer-Policy: unsafe-url
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1;?mode=block
Timing-Allow-Origin: *
Ohc-Cache-HIT: hengyct62 [1], xiangyix140 [1]
Ohc-File-Size: 13291
X-Cache-Status: MISS

www.kailang17.com/Skins/185618/images/aboutus_img.jpg

175.6.243.35

200 OK

52 kB

URL HTTP/1.1
www.kailang17.com/Skins/185618/images/aboutus_img.jpg
IP
175.6.243.35:0
ASN
#63838 Hengyang

File type
JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2014:04:03 17:50:12 DIY-Thermocam raw data\012- (Lepton 2.x), scale 28277-27756, spot sensor temperature 3715504275456.000000, unit celsius, color scheme 0, show scale bar, calibration: offset 0.000000, slope 1148955454630999422402560.000000], baseline, precision 8, 119x164, components 3\012- data
Size
52 kB (51872 bytes)
Hash
c65b88f2ff0df1d714f21fa222beec4f
c1e9ec822aaed6e6808ca30a208f518f85d6a7da
4e04f1aa4f601b97bd3bd5f6c68e422c3cd7eb6a1bf259002cbbb0e8a64a5fe3

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /Skins/185618/images/aboutus_img.jpg HTTP/1.1
Host: www.kailang17.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.shotgunexpress.com/

HTTP/1.1 200 OK
Server: JSP3/2.0.14
Date: Sun, 06 Nov 2022 11:08:12 GMT
Content-Type: image/jpeg
Content-Length: 51872
Connection: keep-alive
Last-Modified: Fri, 08 Aug 2014 03:48:31 GMT
ETag: "e33bed9ebbb2cf1:0"
Accept-Ranges: bytes
X-Powered-By: ASP.NET-4.181
Content-Security-Policy: script-src?'self'
Referrer-Policy: unsafe-url
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1;?mode=block
Timing-Allow-Origin: *
Ohc-Cache-HIT: hengyct76 [1], bdix136 [1]
Ohc-File-Size: 51872
X-Cache-Status: MISS

www.shotgunexpress.com/favicon.ico

156.224.158.251

404 Not Found

146 B

URL HTTP/1.1
www.shotgunexpress.com/favicon.ico
IP
156.224.158.251:0
ASN
#133201 ABCDE GROUP COMPANY LIMITED

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.shotgunexpress.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.shotgunexpress.com/

HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 06 Nov 2022 11:08:25 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (11)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash