furned-mashorses.com/887ca30b-2742-4670-961c-46596d197dc3/2
0 B URL furned-mashorses.com/887ca30b-2742-4670-961c-46596d197dc3/2
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /887ca30b-2742-4670-961c-46596d197dc3/2 HTTP/1.1
Host: furned-mashorses.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Sun, 04 Jun 2023 21:44:08 GMT
content-length: 0
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://126648123735.mytrffcmpny.com/?p=24924&wid=139963&wid_hmac=a1fb1dd72572010bc77d12297549f05d&click_id=wkm69tuq95k9557picr6b5l6
pragma: no-cache
set-cookie: 887ca30b-2742-4670-961c-46596d197dc3-v4=nzS5Ojv8AP8zRaXU3BI-P4i99us_w2Ia27ElDOG5SnE; Max-Age=86400; Expires=Mon, 05-Jun-2023 21:44:08 GMT; Domain=furned-mashorses.com; Path=/; Secure; HttpOnly;SameSite=None
cc-v4=3IZ2VvvSvT4RMpT%2F%2BCy4geq7Ol5KGMUUdhWlB4gnV%2BErrojk2pO%2BykQOTGh%2FGLyx%2BEkCBIiT%2BHaxg5EupXpSAfKEVsrv%2BQeTv2YaL2X413DvfVvLgI2eF%2FXTwfjnadWriAL1ElGlUE1BGzwGRfM61w%3D%3D; Max-Age=31536000; Expires=Mon, 03-Jun-2024 21:44:08 GMT; Domain=furned-mashorses.com; Path=/; Secure; HttpOnly;SameSite=None
X-Firefox-Spdy: h2
p.hungama.com/norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815
6 B URL p.hungama.com/norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
File type ASCII text, with CRLF line terminators
Hash ed19ca99581136d44b35bbb2240a6bf6
d0ac1626cb4713dd5e6b3ff63d818efac90ab4b3
aea52d27230b89ca1b732866afbe137a98e65100049a56b3293def8d5fe7dda0
GET /norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815 HTTP/1.1
Host: p.hungama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.19.10
Date: Sun, 04 Jun 2023 21:44:11 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 6
Connection: keep-alive
X-Powered-By: PHP/8.1.17
Set-Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: http://103.56.211.129/he_test/getHeaderForDhiragu.php?url=https%3A%2F%2Fp.hungama.com%2Fnorway_mm_play%2Findex.php%2Fpromotion%2Fpreview%2F3%3Faff_id%3D1641%26click_id%3D4653075815%2F
Access-Control-Allow-Origin: *
103.56.211.129/he_test/getHeaderForDhiragu.php?url=https%3A%2F%2Fp.hungama.com%2Fnorway_mm_play%2Findex.php%2Fpromotion%2Fpreview%2F3%3Faff_id%3D1641%26click_id%3D4653075815%2F
286 B URL 103.56.211.129/he_test/getHeaderForDhiragu.php?url=https%3A%2F%2Fp.hungama.com%2Fnorway_mm_play%2Findex.php%2Fpromotion%2Fpreview%2F3%3Faff_id%3D1641%26click_id%3D4653075815%2F
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Hash 88002476f674694897667621652cfb63
cf889207e837fa84f0fe03939fca3cd89b7802f8
b45494812082833d5d9012fae5a3e01329e49f2b0876436e6ea5de83b52a7bc9
Analyzer Verdict Alert quad9 Sinkholed
GET /he_test/getHeaderForDhiragu.php?url=https%3A%2F%2Fp.hungama.com%2Fnorway_mm_play%2Findex.php%2Fpromotion%2Fpreview%2F3%3Faff_id%3D1641%26click_id%3D4653075815%2F HTTP/1.1
Host: 103.56.211.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.19.10
Date: Sun, 04 Jun 2023 21:44:12 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 286
Connection: keep-alive
X-Powered-By: PHP/8.1.17
Location: https://p.hungama.com/norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815/&mdnreturn=WDNadlpHRnRiM289
p.hungama.com/norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815/&mdnreturn=WDNadlpHRnRiM289
6 B URL p.hungama.com/norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815/&mdnreturn=WDNadlpHRnRiM289
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
File type ASCII text, with CRLF line terminators
Hash ed19ca99581136d44b35bbb2240a6bf6
d0ac1626cb4713dd5e6b3ff63d818efac90ab4b3
aea52d27230b89ca1b732866afbe137a98e65100049a56b3293def8d5fe7dda0
GET /norway_mm_play/index.php/promotion/preview/3?aff_id=1641&click_id=4653075815/&mdnreturn=WDNadlpHRnRiM289 HTTP/1.1
Host: p.hungama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.19.10
Date: Sun, 04 Jun 2023 21:44:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 6
Connection: keep-alive
X-Powered-By: PHP/8.1.17
Set-Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: https://p.hungama.com/norway_mm_play/index.php/plan/pack_purchase/164/0/22843?aff_id=1641
Access-Control-Allow-Origin: *
p.hungama.com/norway_mm_play/index.php/plan/pack_purchase/164/0/22843?aff_id=1641
6 B URL p.hungama.com/norway_mm_play/index.php/plan/pack_purchase/164/0/22843?aff_id=1641
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
File type ASCII text, with CRLF line terminators
Hash ed19ca99581136d44b35bbb2240a6bf6
d0ac1626cb4713dd5e6b3ff63d818efac90ab4b3
aea52d27230b89ca1b732866afbe137a98e65100049a56b3293def8d5fe7dda0
GET /norway_mm_play/index.php/plan/pack_purchase/164/0/22843?aff_id=1641 HTTP/1.1
Host: p.hungama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.19.10
Date: Sun, 04 Jun 2023 21:44:15 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 6
Connection: keep-alive
X-Powered-By: PHP/8.1.17
Set-Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: http://gateway.mondiapay.com/v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
Access-Control-Allow-Origin: *
gateway.mondiapay.com/v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
2.3 kB URL gateway.mondiapay.com/v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
IP
ASN #33873 Arvato Systems GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash d830ba9ef04350770adaf2b638c546fd
c6c21c7c077a641cdbd2ade39885c8ee41dd2765
a584124d8a66de103cc676f094ad2ab9d38ca609b67aead01e2c792caf2249dd
GET /v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1 HTTP/1.1
Host: gateway.mondiapay.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Sun, 04 Jun 2023 21:44:15 GMT
Expires: 0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
X-MM-CORRELATION-ID: 2162B58E-D5EB-B245-5FA8-80E8A848E0B5, 2162B58E-D5EB-B245-5FA8-80E8A848E0B5
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Content-Language: en-US
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Server: unknown
gateway.mondiapay.com/favicon.ico
946 B URL gateway.mondiapay.com/favicon.ico
IP
ASN #33873 Arvato Systems GmbH
File type MS Windows icon resource - 1 icon, 16x13, 32 bits/pixel\012- data
Hash 0488faca4c19046b94d07c3ee83cf9d6
02fb8c5e4c3d113f310651a4d021aecc68f79d54
a3fe67e3549fdbc5819762b43c7efd93b1caea734f87a33c909a4e4b2ba4e32b
GET /favicon.ico HTTP/1.1
Host: gateway.mondiapay.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gateway.mondiapay.com/v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
X-MM-CORRELATION-ID: 3E414C47-E027-6A87-1D81-7B212AAFF1A8
Last-Modified: Thu, 13 Dec 2018 16:04:02 GMT
Accept-Ranges: bytes
Content-Type: image/x-icon
Content-Length: 946
Date: Sun, 04 Jun 2023 21:44:15 GMT
Server: unknown
gateway.mondiapay.com/v1/web/purchase/validate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
19 B URL gateway.mondiapay.com/v1/web/purchase/validate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
IP
ASN #33873 Arvato Systems GmbH
File type JSON data\012- , ASCII text, with no line terminators
Hash 7371f4549137912d2f797e976caa3f7a
a6dbc3ae0138f2a5b50371323a7d8e3744f261ef
8519ccdbef3d14c543b2079d16bcc9c10e50ca44613391b0deb904a290ebe5ee
GET /v1/web/purchase/validate/7962cd60-09ec-4877-a583-5ccb4c92dbd1 HTTP/1.1
Host: gateway.mondiapay.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://gateway.mondiapay.com/v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Sun, 04 Jun 2023 21:44:17 GMT
Expires: 0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
X-MM-CORRELATION-ID: E4FDC2F5-F2E7-FFD4-DEB3-BBE1541DC23C, E4FDC2F5-F2E7-FFD4-DEB3-BBE1541DC23C
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Server: unknown
gateway.mondiapay.com/mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1
302 0 B URL User Request GET HTTP/1.1 gateway.mondiapay.com/mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1
IP
ASN #33873 Arvato Systems GmbH
Certificate IssuerGlobalSign nv-sa
Subject*.mondiapay.com
FingerprintEB:67:E7:F3:E1:19:5D:D5:07:C4:0A:C2:9F:1C:B4:41:F7:F5:86:45
ValidityMon, 07 Nov 2022 09:37:59 GMT - Sat, 09 Dec 2023 09:37:58 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1 HTTP/1.1
Host: gateway.mondiapay.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gateway.mondiapay.com/v1/web/purchase/initiate/7962cd60-09ec-4877-a583-5ccb4c92dbd1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302
Date: Sun, 04 Jun 2023 21:44:18 GMT
X-MM-CORRELATION-ID: 1D27EA77-4FC2-A054-2CC4-4CDCF142E01C, 1D27EA77-4FC2-A054-2CC4-4CDCF142E01C
Location: https://track.greentropolo.com/g/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly
Transfer-Encoding: chunked
Server: unknown
track.greentropolo.com/l/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly&&_tdf=157&_opt8ztS3haF5InY=5f0f85bb&_m=1uc
0 B URL User Request POST track.greentropolo.com/l/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly&&_tdf=157&_opt8ztS3haF5InY=5f0f85bb&_m=1uc
IP
ASN #60781 LeaseWeb Netherlands B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /l/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly&&_tdf=157&_opt8ztS3haF5InY=5f0f85bb&_m=1uc HTTP/1.1
Host: track.greentropolo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 3668
Origin: https://track.greentropolo.com
DNT: 1
Connection: keep-alive
Referer: https://track.greentropolo.com/g/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 303 See Other
Connection: close
Date: Sun, 04 Jun 2023 21:44:18 GMT
Location: http://gateway.mondiapay.com/mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1?clickid=track_20230604214418_638db613_ae5e_4400_aff5_c7fb57641859&opt=%2BjzZ6uolRYu%2F0nRQpleD2TqFk5JVhlKtUiU58%2F7F%2BBu4kX%2BVqFiVNKf8K2CwqILdJSvFP8UN%2BLwW2ucr8YI5GzvfV454WQGzWjYjKz0EeUzdzDWzEkqtd13uQq3sDa1B%2B0QAvv%2FF46Ve3ecT707xjF4A0K%2BNB5sFX2UKW5w79Zd6ZgsgHLPg9s7WS8WEpOKAwJLsn4pi7goQTAJMsUtvubRwUt7Bo1w7wchoZYNK72m4FaL%2FNWZ7ZbGgg7XaUdrKobbXZBXPYIJFHhLj9q%2FbhONHI%2BHgHEFXBD2KQ1HaYyYlix3FydcNKETKMP6RLJltZtjx0pC9HX4rdDaOkpw1XR8Q9au3C9SOYlQ3dckdf8vJo6wi8SfH5y49zyLkAfOdZJTtp3X%2F%2FPJE2tAqVRMy1AEt3q0hVbkyccmei00vc8%2FyDTc7oli4x%2Bg3mKqsAC93CCFuAanGoPJhbR94wYWovA%3D%3D&opt-hmac=c6qneJP12Muo0LyeknGGweh%2B%2BlPsYLcowuSt%2FbR%2BXf4%3D
35.200.222.172/v2/cgredirection/cgReturnTelenorNorwayMM.php?trans_id=20230605031414503050771280&status=403&message=PERMISSION_DENIED
0 B URL User Request GET 35.200.222.172/v2/cgredirection/cgReturnTelenorNorwayMM.php?trans_id=20230605031414503050771280&status=403&message=PERMISSION_DENIED
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /v2/cgredirection/cgReturnTelenorNorwayMM.php?trans_id=20230605031414503050771280&status=403&message=PERMISSION_DENIED HTTP/1.1
Host: 35.200.222.172
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.20.1
Date: Sun, 04 Jun 2023 21:44:21 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/8.0.23
Location: https://p.hungama.com/norway_mm_play/index.php/plan/norway_mm_play_consent_return/?&mdn=99999999999&message=&rescode=H199
p.hungama.com/norway_mm_play/index.php/plan/norway_mm_play_consent_return/?&mdn=99999999999&message=&rescode=H199
6 B URL User Request GET p.hungama.com/norway_mm_play/index.php/plan/norway_mm_play_consent_return/?&mdn=99999999999&message=&rescode=H199
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
File type ASCII text, with CRLF line terminators
Hash ed19ca99581136d44b35bbb2240a6bf6
d0ac1626cb4713dd5e6b3ff63d818efac90ab4b3
aea52d27230b89ca1b732866afbe137a98e65100049a56b3293def8d5fe7dda0
GET /norway_mm_play/index.php/plan/norway_mm_play_consent_return/?&mdn=99999999999&message=&rescode=H199 HTTP/1.1
Host: p.hungama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.19.10
Date: Sun, 04 Jun 2023 21:44:22 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 6
Connection: keep-alive
X-Powered-By: PHP/8.1.17
Set-Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: https://p.hungama.com/norway_mm_play/?err_code=202
Access-Control-Allow-Origin: *
track.greentropolo.com/g/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly
200 OK 171 kB URL User Request GET HTTP/1.1 track.greentropolo.com/g/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly
IP
ASN #60781 LeaseWeb Netherlands B.V.
Certificate IssuerLet's Encrypt
Subjectadvfilternow.com
Fingerprint00:58:47:CF:D4:D4:51:F7:30:7C:11:3F:ED:C8:3B:87:9C:4A:68:C3
ValidityTue, 11 Apr 2023 13:48:49 GMT - Mon, 10 Jul 2023 13:48:48 GMT
Size 171 kB (171326 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /g/4625709cd492e17ee2?next_url=http%3A%2F%2Fgateway.mondiapay.com%2Fmondiapay-strex-no-v1%2Fweb%2Fpurchase%2Fsubscription%2F7962cd60-09ec-4877-a583-5ccb4c92dbd1%3Fclickid%3D%7Bclick_id%7D%26opt%3D%7BOPT%7D%26opt-hmac%3D%7BOPT-HMAC%7D&hmac=5-3S7azcSho5UbV6AHjAQpLfQEE0Z9MjWt5jD4xwxLY&external_id=7962cd60-09ec-4877-a583-5ccb4c92dbd1&var1=7714&var2=77140001&var3=Hungama+Play+-+Weekly HTTP/1.1
Host: track.greentropolo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gateway.mondiapay.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: close
Date: Sun, 04 Jun 2023 21:44:18 GMT
ETag: d343c99a647d05b27af9288212c7a40f--gzip
Cache-Control: private, max-age=0, no-cache, must-revalidate
Pragma: no-cache
Accept-CH: Width, Viewport-Width, Viewport-Height, Device-Memory, Content-DPR, DPR, Save-Data, Downlink, ECT, RTT, Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
Content-Type: text/html;charset=utf-8
Vary: Accept-Encoding, User-Agent
Content-Encoding: gzip
gateway.mondiapay.com/mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1?clickid=track_20230604214418_638db613_ae5e_4400_aff5_c7fb57641859&opt=%2BjzZ6uolRYu%2F0nRQpleD2TqFk5JVhlKtUiU58%2F7F%2BBu4kX%2BVqFiVNKf8K2CwqILdJSvFP8UN%2BLwW2ucr8YI5GzvfV454WQGzWjYjKz0EeUzdzDWzEkqtd13uQq3sDa1B%2B0QAvv%2FF46Ve3ecT707xjF4A0K%2BNB5sFX2UKW5w79Zd6ZgsgHLPg9s7WS8WEpOKAwJLsn4pi7goQTAJMsUtvubRwUt7Bo1w7wchoZYNK72m4FaL%2FNWZ7ZbGgg7XaUdrKobbXZBXPYIJFHhLj9q%2FbhONHI%2BHgHEFXBD2KQ1HaYyYlix3FydcNKETKMP6RLJltZtjx0pC9HX4rdDaOkpw1XR8Q9au3C9SOYlQ3dckdf8vJo6wi8SfH5y49zyLkAfOdZJTtp3X%2F%2FPJE2tAqVRMy1AEt3q0hVbkyccmei00vc8%2FyDTc7oli4x%2Bg3mKqsAC93CCFuAanGoPJhbR94wYWovA%3D%3D&opt-hmac=c6qneJP12Muo0LyeknGGweh%2B%2BlPsYLcowuSt%2FbR%2BXf4%3D
0 B URL User Request GET gateway.mondiapay.com/mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1?clickid=track_20230604214418_638db613_ae5e_4400_aff5_c7fb57641859&opt=%2BjzZ6uolRYu%2F0nRQpleD2TqFk5JVhlKtUiU58%2F7F%2BBu4kX%2BVqFiVNKf8K2CwqILdJSvFP8UN%2BLwW2ucr8YI5GzvfV454WQGzWjYjKz0EeUzdzDWzEkqtd13uQq3sDa1B%2B0QAvv%2FF46Ve3ecT707xjF4A0K%2BNB5sFX2UKW5w79Zd6ZgsgHLPg9s7WS8WEpOKAwJLsn4pi7goQTAJMsUtvubRwUt7Bo1w7wchoZYNK72m4FaL%2FNWZ7ZbGgg7XaUdrKobbXZBXPYIJFHhLj9q%2FbhONHI%2BHgHEFXBD2KQ1HaYyYlix3FydcNKETKMP6RLJltZtjx0pC9HX4rdDaOkpw1XR8Q9au3C9SOYlQ3dckdf8vJo6wi8SfH5y49zyLkAfOdZJTtp3X%2F%2FPJE2tAqVRMy1AEt3q0hVbkyccmei00vc8%2FyDTc7oli4x%2Bg3mKqsAC93CCFuAanGoPJhbR94wYWovA%3D%3D&opt-hmac=c6qneJP12Muo0LyeknGGweh%2B%2BlPsYLcowuSt%2FbR%2BXf4%3D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /mondiapay-strex-no-v1/web/purchase/subscription/7962cd60-09ec-4877-a583-5ccb4c92dbd1?clickid=track_20230604214418_638db613_ae5e_4400_aff5_c7fb57641859&opt=%2BjzZ6uolRYu%2F0nRQpleD2TqFk5JVhlKtUiU58%2F7F%2BBu4kX%2BVqFiVNKf8K2CwqILdJSvFP8UN%2BLwW2ucr8YI5GzvfV454WQGzWjYjKz0EeUzdzDWzEkqtd13uQq3sDa1B%2B0QAvv%2FF46Ve3ecT707xjF4A0K%2BNB5sFX2UKW5w79Zd6ZgsgHLPg9s7WS8WEpOKAwJLsn4pi7goQTAJMsUtvubRwUt7Bo1w7wchoZYNK72m4FaL%2FNWZ7ZbGgg7XaUdrKobbXZBXPYIJFHhLj9q%2FbhONHI%2BHgHEFXBD2KQ1HaYyYlix3FydcNKETKMP6RLJltZtjx0pC9HX4rdDaOkpw1XR8Q9au3C9SOYlQ3dckdf8vJo6wi8SfH5y49zyLkAfOdZJTtp3X%2F%2FPJE2tAqVRMy1AEt3q0hVbkyccmei00vc8%2FyDTc7oli4x%2Bg3mKqsAC93CCFuAanGoPJhbR94wYWovA%3D%3D&opt-hmac=c6qneJP12Muo0LyeknGGweh%2B%2BlPsYLcowuSt%2FbR%2BXf4%3D HTTP/1.1
Host: gateway.mondiapay.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302
Date: Sun, 04 Jun 2023 21:44:18 GMT
X-MM-CORRELATION-ID: 4BD5CB3B-7ED7-4E66-24A2-DCD837CBDF08, 4BD5CB3B-7ED7-4E66-24A2-DCD837CBDF08
Location: http://35.200.222.172/v2/cgredirection/cgReturnTelenorNorwayMM.php?trans_id=20230605031414503050771280&status=403&message=PERMISSION_DENIED
Transfer-Encoding: chunked
Server: unknown
p.hungama.com/norway_mm_play/?err_code=202
0 B URL User Request GET p.hungama.com/norway_mm_play/?err_code=202
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /norway_mm_play/?err_code=202 HTTP/1.1
Host: p.hungama.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=20f283a7ca4284ea1125dbca70db8130_545
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
18.193.235.10
62.212.87.243
35.200.222.172
0.0.0.0
0.0.0.0