Report - enexnar.ga/

Report Overview

URL

enexnar.ga/
IP

188.114.96.1

ASN

#13335 CLOUDFLARENET
Submitted

2023-02-01T15:52:07Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

3
Threat Detection Systems

0

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
www.google.com (1)	7	2015-05-10T13:11:19Z	2023-03-13T06:40:43Z	402	15092	142.250.74.132
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	59879	34.120.237.76
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5842	34.160.144.191
ocsp.digicert.com (3)	86	2012-05-21T09:02:23Z	2023-03-13T06:00:13Z	1023	1638	93.184.220.29
ocsp.pki.goog (21)	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	7203	24835	142.250.74.131
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	34.210.143.205
googleads.g.doubleclick.net (2)	42	2021-02-20T16:43:32Z	2023-03-13T08:39:16Z	802	1526	142.250.74.130
r3.o.lencr.org (8)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	2704	7089	23.36.76.226
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2372	35.241.9.150
fonts.gstatic.com (1)	unknown	2014-09-09T02:40:21Z	2023-03-13T08:44:36Z	474	16177	142.250.74.35
netdna.bootstrapcdn.com (1)	3413	2012-09-07T17:11:00Z	2023-03-13T05:50:43Z	404	21733	104.18.10.207
www.youtube.com (5)	90	2013-04-13T09:43:20Z	2023-03-13T05:09:12Z	2263	851758	172.217.21.174
jnn-pa.googleapis.com (7)	2640	2021-11-16T07:12:21Z	2023-03-13T08:11:18Z	4045	34916	216.58.207.202
yt3.ggpht.com (1)	203	2014-01-15T17:55:17Z	2023-03-13T05:09:16Z	446	6073	142.250.74.161
enexnar.ga (2)	unknown	2022-12-20T23:33:13Z	2022-12-21T09:24:16Z	650	9165	188.114.97.1
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
code.jquery.com (1)	634	2012-05-21T19:28:02Z	2023-03-13T05:09:57Z	354	84333	69.16.175.10
static.doubleclick.net (1)	333	2012-06-26T18:16:24Z	2023-03-13T08:46:37Z	379	770	142.250.74.134
i.ytimg.com (1)	109	2012-10-03T19:11:04Z	2023-03-13T08:43:01Z	402	63442	216.58.211.22

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-01T15:52:18Z	low	Client IP	Internal IP	ET INFO DNS Query for Suspicious .ga Domain
2023-02-01T15:52:18Z	medium	Client IP	188.114.97.1	ET INFO HTTP Request to a *.ga domain
2023-02-01T15:52:19Z	medium	Client IP	188.114.97.1	ET INFO HTTP Request to a *.ga domain

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

HTTP Transactions (66)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

d2e72d45afe3d391c204b5391599607c

149d68b9d00a720b6f380fa2324779dca9dbe26d

f6f1c295c68dfebadacb1fc812b44e01c7ede0e203615ef3e2cced2ce2251e7e

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6F1C295C68DFEBADACB1FC812B44E01C7EDE0E203615EF3E2CCED2CE2251E7E"
Last-Modified: Mon, 30 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8695
Expires: Wed, 01 Feb 2023 18:16:51 GMT
Date: Wed, 01 Feb 2023 15:51:56 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

62de35a6c8e4efd7633fc5236b5b086f

6a92912a86dfcd0330d040cef06bef36889c76ab

ebb8ca05df5ba73b92174105d54d192a8d9e3e10fba48bf96161b0cb759220ec

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EBB8CA05DF5BA73B92174105D54D192A8D9E3E10FBA48BF96161B0CB759220EC"
Last-Modified: Tue, 31 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10441
Expires: Wed, 01 Feb 2023 18:45:57 GMT
Date: Wed, 01 Feb 2023 15:51:56 GMT
Connection: keep-alive

enexnar.ga/

188.114.97.1

200 OK

7788

URL HTTP/1.1

enexnar.ga/
IP

188.114.97.1:0
ASN

#13335 CLOUDFLARENET

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1187)

Size

7788
Hash

a65127e34b821f508e75fdd9621e1467

72709e9764f959a45237ee2d3fe4689c242ed43c

49ad3ea898195c9ca9faf7b29b33beecf2c510bb395503757a75d1637ca2d180

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

                                        GET / HTTP/1.1
Host: enexnar.ga
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 200 OK
Date: Wed, 01 Feb 2023 15:51:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: ch1c=b
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FGAolg6dc3XaalwMehiZZMpv5azuaxemDGqdBU8KVn%2FHRTb2YCJ9ZCXRWCC3cWcKNGOSVszMzIQR2u1Nez2x9lR2ak%2Bf3w8SIUH7RtL92NNwKdNfyafZ69hSAwxi"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 792bd9f22ee5b4fa-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

30db107dcf4380cef05efea409c2e6a3

96e6a306fbc07299aba64e5c14e2bfca35872fa9

b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 01 Feb 2023 15:36:02 GMT
content-type: application/json
age: 954
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

a8d45deaa7ebfcd996c2055dae592ab8

55befe074589fe7b39757c145968058162a8fc6b

50d7d516f446458145a304b288a0a39d391cd37ea50dabea36ae48d291c65ba7

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "50D7D516F446458145A304B288A0A39D391CD37EA50DABEA36AE48D291C65BA7"
Last-Modified: Tue, 31 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6449
Expires: Wed, 01 Feb 2023 17:39:25 GMT
Date: Wed, 01 Feb 2023 15:51:56 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

7b922915ebf1fa3639b333f994c74f24

144a3f80b98fd0652d4614f24cf6cbbee40f8938

adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: TNqTPGX4hVhSrzfpm44TLUTGvaxz6+OS1oWyvq9frcOuzYASh8QfNAs6YWNob9FiJgi8Fm/b57A=
x-amz-request-id: GD3D84V67DXQH3JF
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 01 Feb 2023 15:51:37 GMT
age: 19
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Wed, 01 Feb 2023 15:51:56 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

280

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

280
Hash

7c9cfd95365e4c498af2087df6694290

02d175c10c7f423deedcc2e4f59f6267f0701398

7f03c9ef03abc468b3c246e34fdd1465d131a8ba963aa735b0894af5ab371d5a

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5266
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 01 Feb 2023 15:51:56 GMT
Last-Modified: Wed, 01 Feb 2023 14:24:10 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 280

ocsp.digicert.com/

93.184.220.29

200 OK

280

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

280
Hash

7c9cfd95365e4c498af2087df6694290

02d175c10c7f423deedcc2e4f59f6267f0701398

7f03c9ef03abc468b3c246e34fdd1465d131a8ba963aa735b0894af5ab371d5a

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4849
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 01 Feb 2023 15:51:56 GMT
Last-Modified: Wed, 01 Feb 2023 14:31:07 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 280

code.jquery.com/jquery.js

69.16.175.10

200 OK

83875

URL HTTP/2

code.jquery.com/jquery.js
IP

69.16.175.10:0
ASN

#20446 STACKPATH-CDN

Magic

ASCII text

Size

83875
Hash

ea735805900bbd9b4dc4f93e4348b8d8

2e2d5c3270d6a6a0e4aab05f3a3f4ea8f8f7c07c

962d003a78697a2a9508f3da6cc6a65259f3fb9b59d6eaa1486f7034830494b2

HTTP Headers

                                        GET /jquery.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://enexnar.ga/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
date: Wed, 01 Feb 2023 15:51:56 GMT
content-encoding: gzip
content-length: 83875
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-4508e"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1675266716.dop215.sk1.t,1675266716.cds210.sk1.hn,1675266716.cds003.sk1.c
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

280

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

280
Hash

7c9cfd95365e4c498af2087df6694290

02d175c10c7f423deedcc2e4f59f6267f0701398

7f03c9ef03abc468b3c246e34fdd1465d131a8ba963aa735b0894af5ab371d5a

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5266
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Wed, 01 Feb 2023 15:51:56 GMT
Last-Modified: Wed, 01 Feb 2023 14:24:10 GMT
Server: ECS (ska/F71C)
X-Cache: HIT
Content-Length: 280

netdna.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css

104.18.10.207

200 OK

20840

URL HTTP/2

netdna.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css
IP

104.18.10.207:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with very long lines (65371)

Size

20840
Hash

876dc2257665885e6fadc67bb6bb790b

220cc575451e5d66ae1135d683e1d9786a545259

952e4ac94044845a5a8dc2512f0b4c750c26d11b97de2e76bb75c59387bd33a2

HTTP Headers

                                        GET /bootstrap/3.3.5/css/bootstrap.min.css HTTP/1.1
Host: netdna.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://enexnar.ga/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
date: Wed, 01 Feb 2023 15:51:56 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
cdn-edgestorageid: 632, 718, 718
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-cachedat: 2021-06-08 21:17:08
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cache-control: public, max-age=31919000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
cdn-requestid: 1069c930a797678e205aae54169cc208
cdn-status: 200
cdn-cache: HIT
cf-cache-status: HIT
age: 1163121
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 792bd9f459fe0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

10619

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

10619
Hash

900e1eb4caf01eb50a33a7cde5888b42

b5af45034eab95f47587ebbdb62e203d6e64a04c

678f04fe86d769f7f44681e1155f977175ebb16c99811d8377f72e8522154b06

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 01 Feb 2023 15:51:56 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

enexnar.ga/favicon.ico

188.114.97.1

404 Not Found

139

URL HTTP/1.1

enexnar.ga/favicon.ico
IP

188.114.97.1:0
ASN

#13335 CLOUDFLARENET

Magic

HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators

Size

139
Hash

0d47e45432db6a19c2fdd8f593d8ba49

769cf6dcda1152f3aff37f19a7bad234e060a692

21884a944c4e8b058101db37d7f874a56c574bc0717b013eb2e59864dcaf1371

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: enexnar.ga
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://enexnar.ga/
Cookie: ch1c=b

                                        HTTP/1.1 404 Not Found
Date: Wed, 01 Feb 2023 15:51:57 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Btiu%2FmNXVGgB0BM5TqiC178vb7IH4hw2vgal7DxfxfumPcHYqKm3wBW3JRFpGBCmnd0WLhe09Fxg2i6%2BmuEycHznE%2FBgfFIG8XRGfOWvi1GJI2lryGrzrttWYF%2FS"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 792bd9f50ab7b4fa-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

www.youtube.com/s/player/dac945fd/www-player.css

172.217.21.174

200 OK

49943

URL HTTP/2

www.youtube.com/s/player/dac945fd/www-player.css
IP

172.217.21.174:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (65536), with no line terminators

Size

49943
Hash

44fae7c4844ce1fc313ca62747036427

d5986b7a3504d913d8ee2077a337e9565a91e32d

a766a46ce1639acea30dc538bc4fc2735f421d3163c61a2ad87ac02d33c473af

HTTP Headers

                                        GET /s/player/dac945fd/www-player.css HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/LxjGReYFsnk
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 49943
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 16:49:09 GMT
expires: Tue, 30 Jan 2024 16:49:09 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 30 Jan 2023 01:18:05 GMT
content-type: text/css
age: 169368
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.youtube.com/s/player/dac945fd/www-embed-player.vflset/www-embed-player.js

172.217.21.174

200 OK

109695

URL HTTP/2

www.youtube.com/s/player/dac945fd/www-embed-player.vflset/www-embed-player.js
IP

172.217.21.174:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (679)

Size

109695
Hash

40b186ad1170470b0d89a7e3c4608ff2

f5ecf32b5b67c3d911bd81a246209f5473d7b6ae

f776addb3f8c34016bb4533baf1859485f3e2f92cfda097f1d5a4eb97bf06f82

HTTP Headers

                                        GET /s/player/dac945fd/www-embed-player.vflset/www-embed-player.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/LxjGReYFsnk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 109695
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 16:50:17 GMT
expires: Tue, 30 Jan 2024 16:50:17 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 30 Jan 2023 01:18:05 GMT
content-type: text/javascript
age: 169300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.youtube.com/embed/KEObQzh_fl0

172.217.21.174

200 OK

641350

URL HTTP/2

www.youtube.com/embed/KEObQzh_fl0
IP

172.217.21.174:0
ASN

#15169 GOOGLE

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (58644)

Size

641350
Hash

d461cfc512036434ce4ccc6601ea2f6c

818418c24bd8242070eeba3958fbacfec25a2858

00301bae70f1ff6d4f1b2ec383da579c058d5f4cbb52e2ce1a37ffe614012950

HTTP Headers

                                        GET /embed/KEObQzh_fl0 HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://enexnar.ga/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 01 Feb 2023 15:51:57 GMT
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=RERMviZcYTY; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none
VISITOR_INFO1_LIVE=wIbZ8dk9UC0; Domain=.youtube.com; Expires=Mon, 31-Jul-2023 15:51:57 GMT; Path=/; Secure; HttpOnly; SameSite=none
DEVICE_INFO=ChxOekU1TlRJeE5UYzJNak15TWpBek5qZzVNUT09EJ2V6p4GGJ2V6p4G; Domain=.youtube.com; Expires=Mon, 31-Jul-2023 15:51:57 GMT; Path=/; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+554; expires=Fri, 31-Jan-2025 15:51:57 GMT; path=/; domain=.youtube.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.youtube.com/s/player/dac945fd/fetch-polyfill.vflset/fetch-polyfill.js

172.217.21.174

200 OK

2786

URL HTTP/2

www.youtube.com/s/player/dac945fd/fetch-polyfill.vflset/fetch-polyfill.js
IP

172.217.21.174:0
ASN

#15169 GOOGLE

Magic

Algol 68 source text\012- Pascal source, ASCII text, with very long lines (555)

Size

2786
Hash

80fe2d229007996c8397073b00755dc7

121f82c77bcf2a297a1085e3b092415c463fcafe

033dfa8941482c82d4f1aaa4a9172fb379b9e46a02d5b36297c5476bbbfdea2c

HTTP Headers

                                        GET /s/player/dac945fd/fetch-polyfill.vflset/fetch-polyfill.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.youtube.com/embed/LxjGReYFsnk
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding, Origin
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 2786
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 30 Jan 2023 16:50:17 GMT
expires: Tue, 30 Jan 2024 16:50:17 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 30 Jan 2023 01:18:05 GMT
content-type: text/javascript
age: 169300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

d06fd066caf4dfa1e21a722a5c468158

acb765577662906ae8e11242bed487ce1051db28

4b45760de269e60345d43ff2da6c5803722f7c052edd0a9f5258ce69b2ffa32f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 01 Feb 2023 15:51:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

789b41f1f8027d4275a66ac9cb2f124d

c5eff6750f9a50fc52a7a6ec6e30a7afaf28fc79

e053b0b29fc44721473ed39ddfe41064f09b56b3531c765228fa322d599e770f

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 01 Feb 2023 15:51:57 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.131:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

789b41f1f8027d4275a66ac9cb2f124d

c5eff6750f9a50fc52a7a6ec6e30a7afaf28fc79

e053b0b29fc44721473ed39ddfe4

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (134)

#1 JS:Script (size: 134)

#2 JS:Script (size: 2213490)

#3 JS:Script (size: 121558)

#4 JS:Script (size: 0)

#5 JS:Script (size: 61525)

#6 JS:Script (size: 26)

#7 JS:Script (size: 25)

#8 JS:Script (size: 25)

#9 JS:Script (size: 36816)

#10 JS:Script (size: 1991)

#11 JS:Script (size: 61070)

#12 JS:Script (size: 13)

#13 JS:Script (size: 26623)

#14 JS:Script (size: 351311)

#15 JS:Script (size: 9615)

#16 JS:Script (size: 29)

#17 JS:Script (size: 36988)

#1 JS:Eval (size: 79)

#2 JS:Eval (size: 2)

#3 JS:Eval (size: 22)

#4 JS:Eval (size: 10)

#5 JS:Eval (size: 26)

#6 JS:Eval (size: 22)

#7 JS:Eval (size: 324)

#8 JS:Eval (size: 132)

#9 JS:Eval (size: 88)

#10 JS:Eval (size: 71)

#11 JS:Eval (size: 265)

#12 JS:Eval (size: 206)

#13 JS:Eval (size: 356)

#14 JS:Eval (size: 206)

#15 JS:Eval (size: 378)

#16 JS:Eval (size: 2)

#17 JS:Eval (size: 22)

#18 JS:Eval (size: 230)

#19 JS:Eval (size: 2)

#20 JS:Eval (size: 2)

#21 JS:Eval (size: 98)

#22 JS:Eval (size: 94)

#23 JS:Eval (size: 2)

#24 JS:Eval (size: 95)

#25 JS:Eval (size: 19)

#26 JS:Eval (size: 83)

#27 JS:Eval (size: 79)

#28 JS:Eval (size: 22)

#29 JS:Eval (size: 1)

#30 JS:Eval (size: 2)

#31 JS:Eval (size: 160)

#32 JS:Eval (size: 47)

#33 JS:Eval (size: 78)

#34 JS:Eval (size: 43342)

#35 JS:Eval (size: 156)

#36 JS:Eval (size: 296)

#37 JS:Eval (size: 2)

#38 JS:Eval (size: 139)

#39 JS:Eval (size: 4)