Report - goo.su/kzQXJh

Report Overview

Submitted URL
goo.su/kzQXJh
IP
172.67.139.105
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-04 04:41:25
Access
public
Website Title
Server Not Found
Final URL
about:neterror?e=dnsNotFound&u=https%3A//facebook-case.cyclic.app/contact/1003784549657034/&c=UTF-8&d=We%20can%E2%80%99t%20connect%20to%20the%20server%20at%20facebook-case.cyclic.app.
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
enduresopens.com	unknown	2023-08-31	2023-08-31	2024-04-18	401 B	1.5 kB	23.109.170.103
goo.su	377451	2019-06-14	2017-05-12	2024-04-18	8.2 kB	76 kB	104.21.38.221
richinfo.co	285236	2019-06-20	2019-06-26	2024-04-09	445 B	36 kB	5.200.15.240
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-05-03	1.1 kB	36 kB	216.58.207.227
rtb.pushdom.co	244282	2018-12-28	2019-01-08	2024-03-22	509 B	158 B	31.204.132.208
st.top100.ru	27374	1999-09-30	2014-03-27	2024-04-30	814 B	138 kB	81.19.89.17
facebook-case.cyclic.app	unknown	unknown	No data	No data	532 B	0 B	0.0.0.0
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-05-02	877 B	9.6 kB	142.250.74.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-04	medium	facebook-case.cyclic.app	Sinkholed
2024-05-04	medium	enduresopens.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	about:neterror?e=dnsNotFound&u=https%3A//facebook-case.cyclic.app/contact/1003784549657034/&c=UTF-8&d=We%20can%E2%80%99t%20connect%20to%20the%20server%20at%20facebook-case.cyclic.app.	0 B	2023-03-07	2024-05-22
Pretty URL about:neterror?e=dnsNotFound&u=https%3A//facebook-case.cyclic.app/contact/1003784549657034/&c=UTF-8&d=We%20can%E2%80%99t%20connect%20to%20the%20server%20at%20facebook-case.cyclic.app. IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-22 23:59:29 Times Seen37987038 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

		Size	First Seen	Last Seen
	#1 Write - 0869ac2422f4f57338741c39b5422acb	234 B	2024-05-04	2024-05-04
Pretty Observations First Seen2024-05-04 06:41:32 Last Seen2024-05-04 06:41:32 Times Seen1 Hash 0869ac2422f4f57338741c39b5422acb 9b5505540e90833b859b0a501703d014d9c2c83b 2334433db2fd682f33e61a8cc359f6aea0ef78776cf29ee23a7295c8d5bdd0a9 Loading...

HTTP Transactions (17)

URL IP Response Size

goo.su/frontend/js/redirect.js?id=399eaf833ac5f607b305c4ace0c25eb5

104.21.38.221

200 OK

32 kB

URL GET HTTP/3
goo.su/frontend/js/redirect.js?id=399eaf833ac5f607b305c4ace0c25eb5
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Size
32 kB (32112 bytes)
Hash
f152f828206d2cf93e62818f9504e023
182c57654b3f05537cd722545f8d8dd99a8e2652
237a9a5d407ec860020474b01d73aaf1ca71ba2519c8ca92dba2ec81cf479d0b

HTTP Headers

GET /frontend/js/redirect.js?id=399eaf833ac5f607b305c4ace0c25eb5 HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/kzQXJh
Cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 04 May 2024 04:41:00 GMT
content-type: application/javascript
cache-control: max-age=604800
cf-bgj: minify
cf-polished: origSize=87787
etag: W/"65896ec2-156eb"
expires: Tue, 07 May 2024 18:40:19 GMT
last-modified: Mon, 25 Dec 2023 12:00:02 GMT
cf-cache-status: HIT
age: 295241
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=griV11G2%2FgwczVoBHsq3wlPVqEp77osKjo%2BP6SzwoQDOlvndr1evJVX0fQrsxh5hzkjzxTagRqhRBKSj76uOYulVy2zt5nnNzO0Qry1f6XG8HLQnhcLlPZw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87e5d0e2ad1c5687-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

richinfo.co/richpartners/push/js/rp-cl-ob.js?pubid=883146&siteid=330256&niche=33

5.200.15.240

200 OK

35 kB

URL GET HTTP/2
richinfo.co/richpartners/push/js/rp-cl-ob.js?pubid=883146&siteid=330256&niche=33
IP
5.200.15.240:443
ASN
#49544 i3D.net B.V

Requested by
https://goo.su/kzQXJh
Certificate
IssuerLet's Encrypt
Subjectrichinfo.co
Fingerprint25:29:37:EE:41:C6:34:D2:D5:4C:10:A7:3F:D7:C5:E4:2E:7D:3B:2D
ValidityMon, 25 Mar 2024 13:05:17 GMT - Sun, 23 Jun 2024 13:05:16 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (65471), with no line terminators
Size
35 kB (35367 bytes)
Hash
48e0c66e13f063ffe401a275add23665
1bb323c0046281baacf09fa4b891a2040721fdab
84887cf8337ccb3b43e39d98601758bf33dea79534abb027f2b9e7bba98e1bff

HTTP Headers

GET /richpartners/push/js/rp-cl-ob.js?pubid=883146&siteid=330256&niche=33 HTTP/1.1
Host: richinfo.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.21.4.1
date: Sat, 04 May 2024 04:41:00 GMT
content-type: application/x-javascript
x-amz-id-2: 2raNU8rQhWOyKduUEmLrVOk8A5o/Rqlu68lPiwbeLq6VV8GODH3Ltv+JmAVvUOShmWjZzFfSQb0=
x-amz-request-id: JYG52N99SS31W2GT
last-modified: Thu, 02 May 2024 10:22:54 GMT
etag: W/"48e0c66e13f063ffe401a275add23665"
x-amz-server-side-encryption: AES256
content-encoding: gzip
X-Firefox-Spdy: h2

goo.su/kzQXJh

104.21.38.221

200 OK

9.9 kB

URL User Request GET HTTP/2
goo.su/kzQXJh
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (7391)
Size
9.9 kB (9889 bytes)
Hash
f4d5e8d1fe7b7d4f9547f4e1166563ed
bd504c12d1669adfd177692f45f474f981705485
f67609dc97981fa737414182551d879b2f47f9066aa247b57f99a3398572b2a7

HTTP Headers

GET /kzQXJh HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 04 May 2024 04:41:00 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/8.2.13
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
set-cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; expires=Sat, 04 May 2024 23:21:00 GMT; Max-Age=67200; path=/; secure; samesite=lax
goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D; expires=Sat, 04 May 2024 23:21:00 GMT; Max-Age=67200; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qCShW%2FYvHfEPgnBMdRu0DtoxV%2FlvDt%2BBT3ZyeXJUqt1Gqyr%2BXUP9wUax8vnLWs1ImysM35ErwTgoLjm8Ondih6yes%2BkqF5mIhIb1NxXnPtXywlqXpVS6r1E%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87e5d0e01ba256a2-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

216.58.207.227

200 OK

19 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Size
19 kB (18668 bytes)
Hash
8655d20bbcc8cdbfab17b6be6cf55df3
90edbfa9a7dabb185487b4774076f82eb6412270
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

HTTP Headers

GET /s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goo.su
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18668
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 01:49:21 GMT
expires: Fri, 02 May 2025 01:49:21 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
content-type: font/woff2
age: 183099
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

216.58.207.227

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Size
16 kB (15744 bytes)
Hash
15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

HTTP Headers

GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goo.su
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 22:40:35 GMT
expires: Fri, 02 May 2025 22:40:35 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 108025
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

goo.su/cdn-cgi/challenge-platform/h/g/jsd/r/87e5d0e01ba256a2

104.21.38.221

200 OK

0 B

URL POST HTTP/3
goo.su/cdn-cgi/challenge-platform/h/g/jsd/r/87e5d0e01ba256a2
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/jsd/r/87e5d0e01ba256a2 HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12135
Origin: https://goo.su
DNT: 1
Connection: keep-alive
Referer: https://goo.su/kzQXJh
Cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 04 May 2024 04:41:01 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=3E5aCw_JZUSX.vVEnDxXCOq5euN.9ZPonpcZpCoZ9gY-1714797661-1.0.1.1-fN_34Mgwftl7r3Ojt3S19R4OyFetLC7GMT5_991pNuOn9LzzJce418IBSY4XzpRB6.FdohLLZhrSYws.Qkus_Q; path=/; expires=Sun, 04-May-25 04:41:01 GMT; domain=.goo.su; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B%2BaYC%2Bq5tF2zzYHMAE5E%2BNCwDr8Qn2SgcMj%2FmAoEZ%2Byts7XZ6dpWJ5cMl%2BGHqh9u1%2BDk8EYXdr%2FeG0ECxyJiM6q66JaqqMu2Ex1MBKDy9DP0xDuntEIVOuQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87e5d0e5aec05687-OSL
alt-svc: h3=":443"; ma=86400

rtb.pushdom.co/pb/st?sctp=content-locker&m=ht&pid=883146&sid=330256&dm=goo.su&c1=https&c2=1&c3=https://rtb.pushdom.co/pb/st

31.204.132.208

200 OK

0 B

URL GET HTTP/2
rtb.pushdom.co/pb/st?sctp=content-locker&m=ht&pid=883146&sid=330256&dm=goo.su&c1=https&c2=1&c3=https://rtb.pushdom.co/pb/st
IP
31.204.132.208:443
ASN
#49544 i3D.net B.V

Requested by
https://goo.su/kzQXJh
Certificate
IssuerLet's Encrypt
Subjectrtb.pushdom.co
Fingerprint12:C4:C5:EF:24:BE:28:31:C7:C1:45:E0:0F:F3:7E:9C:7F:5E:3E:30
ValidityMon, 01 Apr 2024 18:28:04 GMT - Sun, 30 Jun 2024 18:28:03 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /pb/st?sctp=content-locker&m=ht&pid=883146&sid=330256&dm=goo.su&c1=https&c2=1&c3=https://rtb.pushdom.co/pb/st HTTP/1.1
Host: rtb.pushdom.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.21.4.1
date: Sat, 04 May 2024 04:41:01 GMT
content-type: text/html;charset=UTF-8
content-length: 0
X-Firefox-Spdy: h2

st.top100.ru/top100/3.16.5/usability.js

81.19.89.17

200 OK

5.4 kB

URL GET HTTP/2
st.top100.ru/top100/3.16.5/usability.js
IP
81.19.89.17:443
ASN
#24638 Rambler Internet Holding LLC

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGlobalSign nv-sa
Subject*.top100.ru
Fingerprint67:1D:AC:E1:B4:A0:6A:53:F1:28:8C:9E:68:9F:77:67:A2:55:01:F3
ValidityWed, 14 Feb 2024 08:25:42 GMT - Mon, 17 Mar 2025 08:25:41 GMT

File type
gzip compressed data, from Unix
Size
5.4 kB (5437 bytes)
Hash
82bce14371de4db3aefb1e05e865851e
ee161dc3c66e8c1c8d690c72da6625d5a1c0e14c
fcc1bd46561e6542fdef3e761c7b8cacb6a44977ba40c240b33539575cff3681

HTTP Headers

GET /top100/3.16.5/usability.js HTTP/1.1
Host: st.top100.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sat, 04 May 2024 04:41:01 GMT
content-type: application/javascript
vary: Accept-Encoding
x-obs-request-id: 0000018F41E0D641A004EC4D275FB730
etag: W/"c01593ee181ba9c66dea9fda43185a3a"
last-modified: Fri, 26 Apr 2024 10:03:47 GMT
x-obs-meta-s3cmd-attrs: atime:1714125662/ctime:1714125825/gid:0/gname:root/md5:c01593ee181ba9c66dea9fda43185a3a/mode:33188/mtime:1714125662/uid:0/uname:root
x-obs-tagging-count: 0
x-obs-id-2: 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSZTqDMnZyNUxQn6rCYqU2hOmb1IFqY1
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
set-cookie: proto_uid=1CIAAF28NWaNXriZAX3lbAB=; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.rambler.ru; path=/
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-encoding: gzip
X-Firefox-Spdy: h2

goo.su/img/favicons/apple-touch-icon.png

104.21.38.221

200 OK

11 kB

URL GET HTTP/3
goo.su/img/favicons/apple-touch-icon.png
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced
Size
11 kB (10926 bytes)
Hash
dc1648f034a8879145ce2db071bdc305
28dfdc4f3f97f00e54528685427a83974cb04a81
7c51dc3139a5a8a07e00884f6558ed62511359803bcb4123668b8e0ccab896c7

HTTP Headers

GET /img/favicons/apple-touch-icon.png HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/kzQXJh
Cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D; cf_clearance=3E5aCw_JZUSX.vVEnDxXCOq5euN.9ZPonpcZpCoZ9gY-1714797661-1.0.1.1-fN_34Mgwftl7r3Ojt3S19R4OyFetLC7GMT5_991pNuOn9LzzJce418IBSY4XzpRB6.FdohLLZhrSYws.Qkus_Q; adtech_uid=59820bdc-7293-4d55-9787-68b54c1c8301%3Agoo.su; top100_id=t1.6673155.1763439386.1714797661264; t3_sid_6673155=s1.331187102.1714797661266.1714797661266.1.1; last_visit=1714797661271%3A%3A1714797661271
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 04 May 2024 04:41:01 GMT
content-type: image/png
content-length: 10926
last-modified: Sun, 24 Dec 2023 16:31:41 GMT
etag: "65885ced-2aae"
expires: Tue, 07 May 2024 20:54:43 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 287178
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FcUC%2BiYMkW4n72d%2F9fLicwZNdbYP4kiwlOKZscbjycxUTLfTwtwpJbobT%2Bod1LWpUbUUa8Dnh0KLICimUzjiBxhhG%2FjhGcJiZypKv40OmLn5h%2FkJO0Cj870%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87e5d0e77fad5687-OSL
alt-svc: h3=":443"; ma=86400

facebook-case.cyclic.app/contact/1003784549657034/

0.0.0.0

0 B

URL User Request GET
facebook-case.cyclic.app/contact/1003784549657034/
IP
0.0.0.0:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /contact/1003784549657034/ HTTP/1.1
Host: facebook-case.cyclic.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

st.top100.ru/top100/top100.js

81.19.89.17

200 OK

130 kB

URL GET HTTP/2
st.top100.ru/top100/top100.js
IP
81.19.89.17:443
ASN
#24638 Rambler Internet Holding LLC

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGlobalSign nv-sa
Subject*.top100.ru
Fingerprint67:1D:AC:E1:B4:A0:6A:53:F1:28:8C:9E:68:9F:77:67:A2:55:01:F3
ValidityWed, 14 Feb 2024 08:25:42 GMT - Mon, 17 Mar 2025 08:25:41 GMT

File type

Size
130 kB (130418 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /top100/top100.js HTTP/1.1
Host: st.top100.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sat, 04 May 2024 04:41:01 GMT
content-type: application/javascript
vary: Accept-Encoding
x-obs-request-id: 0000018F41E093C4B00612EC0ACB5081
etag: W/"0e29947931decab2f885d8d5c6de8f32"
last-modified: Fri, 26 Apr 2024 10:03:47 GMT
x-obs-meta-s3cmd-attrs: atime:1714125662/ctime:1714125825/gid:0/gname:root/md5:0e29947931decab2f885d8d5c6de8f32/mode:33188/mtime:1714125662/uid:0/uname:root
x-obs-tagging-count: 0
x-obs-id-2: 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCS722M6MtmCY8JBv60+AF36fIx+WBqUX
expires: Sat, 04 May 2024 05:41:01 GMT
cache-control: max-age=3600
set-cookie: proto_uid=1CIAAF28NWaNXriZAXXlbAB=; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.rambler.ru; path=/
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-encoding: gzip
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Open%20Sans:400&display=swap

142.250.74.106

200 OK

6.0 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Open%20Sans:400&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
ASCII text, with very long lines (6096), with no line terminators
Size
6.0 kB (5996 bytes)
Hash
7e18a097b51eb70d0d781735844b6897
bee01b4d68b934b8a85650c2edd6e0b51fd961b8
4eadd38b698cc5058bc6909316f68e23ad7784bcde595476b27b47a652ff83f0

HTTP Headers

GET /css?family=Open%20Sans:400&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 04 May 2024 04:41:00 GMT
date: Sat, 04 May 2024 04:41:00 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Roboto:400&display=swap

142.250.74.106

200 OK

2.3 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Roboto:400&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
ASCII text, with very long lines (2379), with no line terminators
Size
2.3 kB (2316 bytes)
Hash
03278c047a3192f4a25c4644284d910b
61fc733be8553b3e6d9847d43b4bef84b5ae947d
d5e8a5e5b7bfea2764abadded25ab112a034543a2315c942bb9fd3cbe7ece8fb

HTTP Headers

GET /css?family=Roboto:400&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 04 May 2024 04:41:00 GMT
date: Sat, 04 May 2024 04:41:00 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

enduresopens.com/ttkXIvunodY/69489

23.109.170.103

200 OK

5 B

URL GET HTTP/1.1
enduresopens.com/ttkXIvunodY/69489
IP
23.109.170.103:443
ASN
#7979 SERVERS-COM

Requested by
https://goo.su/kzQXJh
Certificate
IssuerLet's Encrypt
Subjectenduresopens.com
FingerprintC4:F1:82:55:01:80:DE:E4:BA:76:D0:1C:20:FC:58:30:9D:43:C0:2B
ValidityMon, 25 Mar 2024 23:51:07 GMT - Sun, 23 Jun 2024 23:51:06 GMT

File type
ASCII text, with no line terminators
Size
5 B (5 bytes)
Hash
f7a2939527fd9e68723da600e96d76bd
a9e717b6364d2895ee0a716050db32ca0ef1bb42
d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /ttkXIvunodY/69489 HTTP/1.1
Host: enduresopens.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 May 2024 04:41:00 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://goo.su
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Sun, 05-May-2024 04:41:00 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Sun, 05-May-2024 04:41:00 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

goo.su/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.38.221

302 Found

7.8 kB

URL GET HTTP/3
goo.su/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type

Size
7.8 kB (7824 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 302 Found
date: Sat, 04 May 2024 04:41:00 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js
cache-control: max-age=300, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WjxpinHAJ2zghmhUU4gZjXqOmuwvHjoYL4fCVKu5hvt8UsmeIjcKK%2BM5SLFB2gBMTBjjAhvURNGLZeunsu2ui1LW%2FSzcUwviWStORC0B7YaJWmSJMyI8kbc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87e5d0e47e115687-OSL
alt-svc: h3=":443"; ma=86400

goo.su/img/favicons/favicon-16x16.png

104.21.38.221

200 OK

1.6 kB

URL GET HTTP/3
goo.su/img/favicons/favicon-16x16.png
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type
PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Size
1.6 kB (1567 bytes)
Hash
2b201347b6d90e0ad2bbad3be209db73
ae5de3e7f779cf33aefd5dc738f2126633bb7824
df0a5932ec719656fd8f147bcc0c14312e53e52c2df13f5f815d72833de9c852

HTTP Headers

GET /img/favicons/favicon-16x16.png HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/kzQXJh
Cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D; cf_clearance=3E5aCw_JZUSX.vVEnDxXCOq5euN.9ZPonpcZpCoZ9gY-1714797661-1.0.1.1-fN_34Mgwftl7r3Ojt3S19R4OyFetLC7GMT5_991pNuOn9LzzJce418IBSY4XzpRB6.FdohLLZhrSYws.Qkus_Q; adtech_uid=59820bdc-7293-4d55-9787-68b54c1c8301%3Agoo.su; top100_id=t1.6673155.1763439386.1714797661264; t3_sid_6673155=s1.331187102.1714797661266.1714797661266.1.1; last_visit=1714797661271%3A%3A1714797661271
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 04 May 2024 04:41:01 GMT
content-type: image/png
content-length: 1567
last-modified: Sun, 24 Dec 2023 16:31:41 GMT
etag: "65885ced-61f"
expires: Tue, 07 May 2024 20:21:06 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 289195
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lu9JF8OR6YHcTaGstmGjk5lcaUcW5Kg2%2BFapSXfWALZeYfBlr0UC1b%2BFHmZ7oG%2FCtuJYLxDDXvS9I9fZ5Srcatj1RCqRrVXfaUz1EB8GkbtcedRGOH6bXak%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87e5d0e77fae5687-OSL
alt-svc: h3=":443"; ma=86400

goo.su/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js

104.21.38.221

200 OK

7.8 kB

URL GET HTTP/3
goo.su/cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js
IP
104.21.38.221:443
ASN
#13335 CLOUDFLARENET

Requested by
https://goo.su/kzQXJh
Certificate
IssuerGoogle Trust Services LLC
Subjectgoo.su
FingerprintDE:C6:4D:AF:DC:06:3A:ED:C6:AF:B6:FD:D7:3A:E7:C4:A6:AB:A2:60
ValidityMon, 01 Apr 2024 06:02:27 GMT - Sun, 30 Jun 2024 06:02:26 GMT

File type
JavaScript source, ASCII text, with very long lines (7824), with no line terminators
Size
7.8 kB (7824 bytes)
Hash
919dbfa585f774096acd439c319adf3d
d0517ef64660e5a21ac93b28cca2a127c2fb7677
175519ba36c5815d49da1ebfd01ff225393723430684a8e0fbaa46a983be276d

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/d0ff3ebede6b/main.js HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ii8rb3d6dlRxRGhONDgwWERPMkRhSmc9PSIsInZhbHVlIjoid2F3TDBpZWI2UENXQVFaQnNGRWt6RHNtOHdLLytwbWxTMkFYMWIydUl0NEgwNEFiYWxqeUdMQ0VPRnUyWnYxTWhPZTBnZUpobTBBOW9rcTF1TEZWZmVWalIwRi8zTzBUZ3Z6TEd5M0xLMWxoNG9TSXo2cHJWbndqSlR1Ti9WMHUiLCJtYWMiOiI1Nzc0NmUxNDQyMDA4ZTgzODFiOTg1NjVmZWZlOTdmZmEwMjU5YTcyNjRlZjAwZTg2ZmFjNGJhODRkN2RjMTAyIiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6Im5KbE1EYjlNUEhPdkxWTUxRaTduRWc9PSIsInZhbHVlIjoicit6di9CL1JLbFJKRFZkOHhoTU5GNTl1V0gzZm1pajk0VG5qMzlxdjY0elkya2NYdUpwYzEvYWxieUNmVVhWZlZCeE1IMFRSVHBMQVR2Y0pVUDRVNHRNbktJY25nS1BpZkY1SnhwSExSV3IxNHFXQTVZM1lqN0cyT3RnL0ltYVciLCJtYWMiOiI3MDY0NzhmMjk4YWI0Yzk5NDY2MTI2NGRjMzUyOTEzNjgxMGJkZjMxYjg1YmUwMDA5MTk1MjUyYjUxYmFhOGQyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 04 May 2024 04:41:00 GMT
content-type: application/javascript; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
cache-control: max-age=14400, public
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G2hx%2FdA5oqYsaPGuRaeDuMgBhtQ3NTjLjTA%2BtIf1U6lP4CeIKbT%2F8E9TmOzGwKPSWmLLzV1xKXroPPaNCPoRtCMF%2Fzdvey2b4hmRhvccjiVO8F%2BCOqAnhuw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87e5d0e48e205687-OSL
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (17)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers