| my.rtmark.net/img.gif?f=merge&userId=0efaae09f71441e188e872a9949dea1c |  139.45.195.8 | | 43 B |
URL my.rtmark.net/img.gif?f=merge&userId=0efaae09f71441e188e872a9949dea1c IP139.45.195.8:0
File typeGIF image data, version 89a, 1 x 1\012- data Hashb4491705564909da7f9eaf749dbbfbb1 279315d507855c6a4351e1e2c2f39dd9cd2fccd8 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
GET /img.gif?f=merge&userId=0efaae09f71441e188e872a9949dea1c HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ungroudonchan.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 25 May 2023 04:53:01 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=0efaae09f71441e188e872a9949dea1c; expires=Fri, 24 May 2024 04:53:01 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| ocsp.sectigo.com/ |  104.18.14.101 | | 471 B |
IP104.18.14.101:0
Hash235b9b790fa3b538cb70dc2d172f3786 6f46421ec1247daba6ebed9173907154e3c0c08c e7ec53551dfde3b7fc4b400369e88cc050d3bb46ddbd865b0ef2877678d3eec2
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 04:53:01 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 02:07:10 GMT
Expires: Mon, 29 May 2023 02:07:09 GMT
Etag: "6f46421ec1247daba6ebed9173907154e3c0c08c"
Cache-Control: max-age=335299,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7ccb2c1d5c671c02-OSL
|
|
| datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f |  37.48.68.71 | | 2 B |
URL datatechone.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f IP37.48.68.71:0 ASN#60781 LeaseWeb Netherlands B.V.
File typeASCII text, with no line terminators Hash444bcb3a3fcf8389296c49467f27e1d6 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f HTTP/1.1
Host: datatechone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1400
Origin: https://ungroudonchan.com
DNT: 1
Connection: keep-alive
Referer: https://ungroudonchan.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Thu, 25 May 2023 04:53:01 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
Access-Control-Allow-Origin: https://ungroudonchan.com
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
|
|
| ungroudonchan.com/?z=5423637&syncedCookie=true&rhd=false | 139.45.197.238 | | 0 B |
URL ungroudonchan.com/?z=5423637&syncedCookie=true&rhd=false IP139.45.197.238:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /?z=5423637&syncedCookie=true&rhd=false HTTP/1.1
Host: ungroudonchan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 588
Origin: https://ungroudonchan.com
DNT: 1
Connection: keep-alive
Referer: https://ungroudonchan.com/afu.php?zoneid=5423637&var=5423637&rid=BPTR34PbLD67mf1dYD5JaA%3D%3D&rhd=false
Cookie: OAID=0efaae09f71441e188e872a9949dea1c; oaidts=1684990381
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx
date: Thu, 25 May 2023 04:53:01 GMT
content-length: 0
location: https://5uxyk.rdtk.io/646d310fb6101200011de758
x-trace-id: 9c68702216a9616fc98b18ffb4ef29a5
link: <https://5uxyk.rdtk.io>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://xobr219pa.com>; rel="preconnect dns-prefetch"
referrer-policy: no-referrer
access-control-allow-origin: https://ungroudonchan.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=0efaae09f71441e188e872a9949dea1c; expires=Fri, 24 May 2024 04:53:01 GMT; path=/; secure; SameSite=None
oaidts=1684990381; expires=Fri, 24 May 2024 04:53:01 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Thu, 01 Jun 2023 04:53:01 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| ocsp.usertrust.com/ | 104.18.15.101 | | 471 B |
IP104.18.15.101:0
Hashf6ff55f98f519064127a0ccf4ee860c5 7f632f03553a79fd9d436d4fc20f6fff46185ba6 235182150246b0b69ae32e585756be4a30a9a0218156c30ddadb88295dbb68a7
POST / HTTP/1.1
Host: ocsp.usertrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 May 2023 04:53:02 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:07:34 GMT
Expires: Mon, 29 May 2023 22:07:33 GMT
Etag: "7f632f03553a79fd9d436d4fc20f6fff46185ba6"
Cache-Control: max-age=602644,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7ccb2c1f4c430afe-OSL
|
|
| 5uxyk.rdtk.io/646d310fb6101200011de758 | 37.48.87.182 | | 222 B |
URL 5uxyk.rdtk.io/646d310fb6101200011de758 IP37.48.87.182:0 ASN#60781 LeaseWeb Netherlands B.V.
File typeHTML document text\012- HTML document, ASCII text Hashf91112573c361546a19dd4e94a719b2d 16e794f1f53b147f89723449d4f750695fc039bc 721306b740eaceae7ee2f3994fa805310ba5266ffb517a65bee3f6a9a6d43aa5
GET /646d310fb6101200011de758 HTTP/1.1
Host: 5uxyk.rdtk.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Thu, 25 May 2023 04:53:02 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 222
Connection: keep-alive
Set-Cookie: redcmps=W3siaWQiOiI2NDZkMzEwZmI2MTAxMjAwMDExZGU3NTgiLCJ0IjoiMjAyMy0wNS0yNVQwNDo1MzowMi4wMzk0NTc3MzFaIn1d; Path=/; Domain=5uxyk.rdtk.io; Expires=Fri, 26 May 2023 04:53:02 GMT; Secure; SameSite=None
redhash=NjQ2ZWU5YWUzOTkzNzcwMDAxZDRlYTFhfDB8NjQ2ZDMxMGZiNjEwMTIwMDAxMWRlNzU4fHw1ZWM5OThhYS05MWVkLTRlOTgtODg1Ni00MjFiOWU1Y2M3Yzh8MTY4NDk5MDM4Mg==; Path=/; Domain=5uxyk.rdtk.io; Expires=Fri, 24 May 2024 04:53:02 GMT; Secure; SameSite=None
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
|
|
| www.highrevenuegate.com/k4fftni9?key=86e708de7bed8a39d29a67ffac85363c |  192.243.61.227 | 200 OK | 115 B |
URL User Request GET HTTP/1.1www.highrevenuegate.com/k4fftni9?key=86e708de7bed8a39d29a67ffac85363c IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjecthighrevenuegate.com FingerprintE3:83:9C:63:64:A5:46:F7:CE:7B:E1:4D:12:0F:29:C3:22:23:C0:14 ValidityTue, 02 May 2023 09:41:55 GMT - Mon, 31 Jul 2023 09:41:54 GMT
File typeASCII text, with no line terminators Hash16579cc322e9e105427ecfa57890ef69 8bb47ec30cf894ab49032d7271a45f0c778baa05 f28ce5befe08ed90a2e12b6b2a5e9fdafaa6ad173503079155260aa480c66590
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /k4fftni9?key=86e708de7bed8a39d29a67ffac85363c HTTP/1.1
Host: www.highrevenuegate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 25 May 2023 04:53:02 GMT
Content-Type: text/html
Content-Length: 115
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=19390091; expires=Fri, 26 May 2023 04:53:02 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 46b9742a086b5112328c14dc5df26887
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| www.highrevenuegate.com/favicon.ico | 192.243.61.227 | 200 OK | 0 B |
URL GET HTTP/1.1www.highrevenuegate.com/favicon.ico IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://www.highrevenuegate.com/k4fftni9?key=86e708de7bed8a39d29a67ffac85363c CertificateIssuerLet's Encrypt Subjecthighrevenuegate.com FingerprintE3:83:9C:63:64:A5:46:F7:CE:7B:E1:4D:12:0F:29:C3:22:23:C0:14 ValidityTue, 02 May 2023 09:41:55 GMT - Mon, 31 Jul 2023 09:41:54 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /favicon.ico HTTP/1.1
Host: www.highrevenuegate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.highrevenuegate.com/k4fftni9?key=86e708de7bed8a39d29a67ffac85363c
Cookie: u_pl=19390091
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 25 May 2023 04:53:02 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 957d73292cb62db1b16c59d95649c1d7
Strict-Transport-Security: max-age=0; includeSubdomains
|
|