Report - www.thanigaiestates.com/uploads/go.php?1t9c

Report Overview

URL

www.thanigaiestates.com/uploads/go.php?1t9c
IP

103.14.122.111

ASN

#132322 Good Domain Registry Private Limited
Submitted

2023-05-26T04:34:29Z

Access

public
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

1
Threat Detection Systems

1

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
racetrack.top (2)	unknown	2023-04-04 11:00:47	2023-05-25 06:58:02	996	18753	185.177.92.29
www.thanigaiestates.com (1)	unknown	2017-02-17 13:29:50	2023-03-13 09:33:03	499	249	103.14.122.111

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-05-26T04:34:13Z	medium	Client IP	Internal IP	ET DNS Query to a *.top domain - Likely Hostile

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-05-26	medium	racetrack.top/go/hezwgobsmq5dinbw

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

HTTP Transactions (3)

URL IP Response Size

www.thanigaiestates.com/uploads/go.php?1t9c

India Good Domain Registry Private Limited

103.14.122.111

302 Found

URL User Request GET HTTP/2

www.thanigaiestates.com/uploads/go.php?1t9c
IP

103.14.122.111:443
ASN

#132322 Good Domain Registry Private Limited

Certificate

IssuerLet's Encrypt

Subjectadmin.thanigaiestates.com

FingerprintC3:E7:12:DB:CB:BA:A3:E6:E6:29:14:F5:C6:A8:5A:36:23:94:F6:47

ValidityFri, 12 May 2023 17:57:02 GMT - Thu, 10 Aug 2023 17:57:01 GMT

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /uploads/go.php?1t9c HTTP/1.1
Host: www.thanigaiestates.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 302 Found
x-powered-by: PHP/7.4.33
location: https://racetrack.top/go/hezwgobsmq5dinbw
vary: User-Agent
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 26 May 2023 04:31:44 GMT
server: Apache/2
X-Firefox-Spdy: h2

racetrack.top/favicon.ico

United Kingdom DataWeb Global Group B.V.

185.177.92.29

204 No Content

URL GET HTTP/2

racetrack.top/favicon.ico
IP

185.177.92.29:443
ASN

#39572 DataWeb Global Group B.V.

Requested by

https://racetrack.top/go/hezwgobsmq5dinbw
Certificate

IssuerLet's Encrypt

Subject0.racetrack.top

Fingerprint63:9A:2C:29:E6:D4:FF:6E:60:A1:A5:86:ED:CA:D7:78:DD:B3:74:F6

ValidityWed, 05 Apr 2023 22:02:06 GMT - Tue, 04 Jul 2023 22:02:05 GMT

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: racetrack.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://racetrack.top/go/hezwgobsmq5dinbw
Cookie: uuid=5ab3e755-a142-42d0-9af6-51990f5927c5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 204 No Content
server: nginx
date: Fri, 26 May 2023 04:34:13 GMT
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2

racetrack.top/go/hezwgobsmq5dinbw

185.177.92.29

200 OK

18118

URL User Request GET HTTP/2

racetrack.top/go/hezwgobsmq5dinbw
IP

185.177.92.29:443
ASN

#39572 DataWeb Global Group B.V.

Certificate

IssuerLet's Encrypt

Subject0.racetrack.top

Fingerprint63:9A:2C:29:E6:D4:FF:6E:60:A1:A5:86:ED:CA:D7:78:DD:B3:74:F6

ValidityWed, 05 Apr 2023 22:02:06 GMT - Tue, 04 Jul 2023 22:02:05 GMT

Magic

Size

18118
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /go/hezwgobsmq5dinbw HTTP/1.1
Host: racetrack.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
server: nginx
date: Fri, 26 May 2023 04:34:13 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
set-cookie: uuid=5ab3e755-a142-42d0-9af6-51990f5927c5; expires=Sun, 25-Jun-2023 04:34:13 GMT; Max-Age=2592000; path=/; domain=racetrack.top
strict-transport-security: max-age=31536000
content-security-policy: img-src https: data:; upgrade-insecure-requests
X-Firefox-Spdy: h2

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

#1 JS:Script (size: 8259)

#1 JS:Eval (size: 7860)

HTTP Transactions (3)

URL User Request GET HTTP/2

IP

ASN

Certificate

Magic

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

Magic

Size

Hash

Detections

HTTP Headers