Report - network-jordan.com/et-animi/nihil.zip

Report Overview

Visited public
2023-09-07 01:31:00
Tags
Submit Tags
URL
network-jordan.com/et-animi/nihil.zip
Finishing URL
about:neterror?e=dnsNotFound&u=https%3A//arklangr.com.me/%3Fwm%3D6276958&c=UTF-8&d=We%20can%E2%80%99t%20connect%20to%20the%20server%20at%20arklangr.com.me.
IP / ASN
192.185.77.28
#46606 UNIFIEDLAYER-AS-1
Title
Server Not Found

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
bncotheuz.xyz	unknown	2023-03-06	2023-03-06 18:38:19	2023-09-05 19:23:19	2.0 kB	3.0 kB	5.61.55.142
network-jordan.com	unknown	2014-08-07	2018-01-21 11:56:58	2023-09-04 12:54:12	956 B	592 B	192.185.77.28
trace.stratosbody.com	unknown	2023-07-13	2023-08-30 17:50:35	2023-09-06 14:32:31	522 B	1.5 kB	88.151.192.253
bcuiaw.com	unknown	2023-07-31	2023-07-31 21:17:58	2023-09-06 09:05:01	536 B	184 B	185.162.85.1
intepigo.com	unknown	2023-07-25	2023-07-26 10:01:04	2023-09-06 18:41:58	1.5 kB	7.3 kB	139.45.195.5
arklangr.com.me	329618	unknown	No data	No data	517 B	0 B	0.0.0.0
apis.stratosbody.com	unknown	2023-07-13	2023-08-28 19:19:43	2023-09-06 15:00:19	456 B	1.9 kB	88.151.192.253
get.linestoget.com	unknown	2023-06-02	2023-07-14 10:41:40	2023-09-06 08:09:40	415 B	1.1 kB	2.59.222.119
ecrwqu.com	577459	2021-11-09	2021-11-09 21:59:02	2023-09-06 14:25:00	551 B	416 B	185.162.85.20

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-09-07	medium	bcuiaw.com	Sinkholed
2023-09-07	medium	ecrwqu.com	Sinkholed
2023-09-06	medium	intepigo.com	Sinkholed
2023-09-06	medium	intepigo.com	Sinkholed
2023-09-07	medium	com.me	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (12)

URL IP Response Size

network-jordan.com/et-animi/nihil.zip

192.185.77.28

100 B

URL
network-jordan.com/et-animi/nihil.zip
IP
192.185.77.28:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (1106)
Size
100 B (100 bytes)
Hash
d3c176d42bd77b7598c888f9be5ee433
97b08cf345b97a43c476961b49771c3bf0d5b805
10c50c5fdd5a4932e55d5036241fee350df592f4db52da561896068ec00ab43e

HTTP Headers

GET /et-animi/nihil.zip HTTP/1.1
Host: network-jordan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-length: 100
content-type: text/html; charset=UTF-8
date: Thu, 07 Sep 2023 01:30:43 GMT
server: Apache
X-Firefox-Spdy: h2

network-jordan.com/favicon.ico

192.185.77.28

100 B

URL
network-jordan.com/favicon.ico
IP
192.185.77.28:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text, with very long lines (1106)
Size
100 B (100 bytes)
Hash
d3c176d42bd77b7598c888f9be5ee433
97b08cf345b97a43c476961b49771c3bf0d5b805
10c50c5fdd5a4932e55d5036241fee350df592f4db52da561896068ec00ab43e

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: network-jordan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://network-jordan.com/et-animi/nihil.zip
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-length: 100
content-type: text/html; charset=UTF-8
date: Thu, 07 Sep 2023 01:30:44 GMT
server: Apache
X-Firefox-Spdy: h2

apis.stratosbody.com/api?_cid=93a58f2c-2d65-25e1-4266-40f5ade35aa8&frm=script

88.151.192.253

1.2 kB

URL
apis.stratosbody.com/api?_cid=93a58f2c-2d65-25e1-4266-40f5ade35aa8&frm=script
IP
88.151.192.253:0
ASN
#400377 AS-DC

File type
ASCII text, with very long lines (3330), with no line terminators
Size
1.2 kB (1249 bytes)
Hash
e0189ab7269861c8cceec019dc486d6b
2e3121af98f34e59ff0823ca5b7500722ea25c53
0e946f8307b88209011a615e0f811e9f90e3b713c72f1a5312e2aa837783c744

HTTP Headers

GET /api?_cid=93a58f2c-2d65-25e1-4266-40f5ade35aa8&frm=script HTTP/1.1
Host: apis.stratosbody.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://network-jordan.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 07 Sep 2023 01:30:44 GMT
Content-Type: application/javascript
Content-Length: 1249
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Expires: 0
Pragma: no-cache
Set-Cookie: _subid=1sisi1ajen5q; expires=Sun, 08 Oct 2023 01:30:44 GMT; path=/
65f8f=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjJcIjoxNjk0MDUwMjQ0fSxcImNhbXBhaWduc1wiOntcIjFcIjoxNjk0MDUwMjQ0fSxcInRpbWVcIjoxNjk0MDUwMjQ0fSJ9.dxUO6d75h--eJ3d9XMc26Z-Q_AXfrC-gzksibdDvdgU; expires=Fri, 14 May 2077 03:01:28 GMT; path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *

get.linestoget.com/scripts/global.js

2.59.222.119

724 B

URL
get.linestoget.com/scripts/global.js
IP
2.59.222.119:0
ASN
#209155 Onehostplanet s.r.o.

File type
ASCII text, with very long lines (1583), with no line terminators
Size
724 B (724 bytes)
Hash
0777eb42195a01257105d84ef945f4b5
916cee45e81a194aa054bb821568010dc8ba029f
f7d8d6ab0733f10547e3e1e77234aebdeac8007e3f9160cf5638f9774db3914a

HTTP Headers

GET /scripts/global.js HTTP/1.1
Host: get.linestoget.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://network-jordan.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 07 Sep 2023 01:30:44 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 30 Aug 2023 08:51:56 GMT
vary: Accept-Encoding
etag: W/"64ef032c-62f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
strict-transport-security: max-age=15768000;
content-encoding: gzip
X-Firefox-Spdy: h2

trace.stratosbody.com/locate

88.151.192.253

842 B

URL
trace.stratosbody.com/locate
IP
88.151.192.253:0
ASN
#400377 AS-DC

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Size
842 B (842 bytes)
Hash
16f34417722e0409bddc6455ddb16cba
ae2b27fd4b84286a3f6c2dcda8535abe5171fbf1
8d420be53cd5f61656dd56b8979a99d4a9836833ef923768368c663d91864a4a

HTTP Headers

GET /locate HTTP/1.1
Host: trace.stratosbody.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://network-jordan.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 07 Sep 2023 01:30:45 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 842
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Pragma: no-cache
Set-Cookie: _subid=1sisi1ajen62; expires=Sun, 08 Oct 2023 01:30:45 GMT; path=/
65f8f=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjVcIjoxNjk0MDUwMjQ1fSxcImNhbXBhaWduc1wiOntcIjNcIjoxNjk0MDUwMjQ1fSxcInRpbWVcIjoxNjk0MDUwMjQ1fSJ9.9cqkK-3YGhRvtOtHlJo2ciyww3w4PxnokBHtlFVssCM; expires=Fri, 14 May 2077 03:01:30 GMT; path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *

bcuiaw.com/rpe?a=1&s=1&act=17&src=2&p=1054030&st=1262214&wd=477409&d=evrbtd.com&tpl=44&rnd=0.6643003231531247&sbid=&sbid2=dclancy

185.162.85.1

0 B

URL
bcuiaw.com/rpe?a=1&s=1&act=17&src=2&p=1054030&st=1262214&wd=477409&d=evrbtd.com&tpl=44&rnd=0.6643003231531247&sbid=&sbid2=dclancy
IP
185.162.85.1:0
ASN
#39572 DataWeb Global Group B.V.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rpe?a=1&s=1&act=17&src=2&p=1054030&st=1262214&wd=477409&d=evrbtd.com&tpl=44&rnd=0.6643003231531247&sbid=&sbid2=dclancy HTTP/1.1
Host: bcuiaw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://mzj92.evrbtd.com
DNT: 1
Connection: keep-alive
Referer: https://mzj92.evrbtd.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Thu, 07 Sep 2023 01:30:46 GMT
content-length: 0
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2

ecrwqu.com/cuclc?aid=9066036782351729158&t=1694050246&s=235

185.162.85.20

184 B

URL
ecrwqu.com/cuclc?aid=9066036782351729158&t=1694050246&s=235
IP
185.162.85.20:0
ASN
#39572 DataWeb Global Group B.V.

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with no line terminators
Size
184 B (184 bytes)
Hash
405c6636d57d5e509fc12a82eb43b041
91cf723d7a7da551021a5ea0758f660a73e1e0d5
d5759af1c913c8754d9c841232576257d8e0f83c8777665b93415318004e0ca8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cuclc?aid=9066036782351729158&t=1694050246&s=235 HTTP/1.1
Host: ecrwqu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mzj92.evrbtd.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx/1.18.0
date: Thu, 07 Sep 2023 01:30:46 GMT
content-type: text/html; charset=utf-8
content-length: 184
location: http://bncotheuz.xyz/go?h=0501e91f-efb5-4af3-8561-70eeda57dd76
X-Firefox-Spdy: h2

bncotheuz.xyz/go?h=0501e91f-efb5-4af3-8561-70eeda57dd76

5.61.55.142

1.8 kB

URL
bncotheuz.xyz/go?h=0501e91f-efb5-4af3-8561-70eeda57dd76
IP
5.61.55.142:0
ASN
#58061 Scalaxy B.V.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1206)
Size
1.8 kB (1768 bytes)
Hash
9bebd9d26538a78bb8cbd64e9fd4bc52
b4d10282951f196838e603b9a53467bc222e16be
b475f6eb34db90534f1baaf18232c772972dd0e168db6945b9864abe10def09d

HTTP Headers

GET /go?h=0501e91f-efb5-4af3-8561-70eeda57dd76 HTTP/1.1
Host: bncotheuz.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 07 Sep 2023 01:30:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
ETag: W/"1318-tNECgpUfGWg45gO5pTRnvCIuFr4"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH
Content-Encoding: gzip

bncotheuz.xyz/dp?h=660b4e4ccc0c5d39e7aa83a9f8adea4438902821f2be77695631f75d1602d94db6dc58e2181476cd26858f3c3aa033d5de16fadfb2ec552eb4f1ec4fca25eb35490b33d43d55844db4bcab36cef29cfe1010569af6cf7f5b4b6acfb2f16dbee7e82b1275af5bd32b528ec665e710cd814970e3778b5023a67184fa37db5d596d199d067960451fa3424238af82c9cff230c81a208b1dbaf054198c1c63ab325911a5d453ad63e232059b83e216e740d85c54cb2beab8789ce768588ec9fb335e76bc30b6c8d2a837158691db54cf1211f0eb42d9cc1025ec974dc4b129751c8c2afdbcc5ad3e0191059050d7bb1f8f034a03c07e45e9bf04aa4b7aec0a1e7aef30773678049220f1fe50ec1957f7ab19f212f3e452061f3802d38318bdc74c48f659373e59e0ca43a3a8f8f0048666ee2904024e536611de0cb498fd0b3fd6cfd6c4f16fe2ab1f084109e8b4a53a23681ad046779452fe43ed1fb1576987d7fc6b6864faa230c139d69de4dd22067ca5fd73ad50b4a15a4750f0ceb14061dad0efcd0c1e0b2d4cc96631e4d7ab1a9abd6223b2acf687e7a49df0bbdf3b05c8e66bec08d3c6e1869c33e3cc4eed6b6b6aaabb81ae221f3b72096e402f6b22612cb318ac2f50faeacf4f5db0314c377b43f5ad5ccfd59deec8134956772be0d9d20b5ad0eb9b72da5cc827a75a07eae825241af0dc55bbd6404932bcce7f80f5282c7ffc7d7e55cc59d9edf394820083da45de0678dd68b8b55f64b54f89b2335b7a39cc810d37e53f17e53850b5500af31436c06f6ebe480073666106ac0dc504

5.61.55.142

35 B

URL
bncotheuz.xyz/dp?h=660b4e4ccc0c5d39e7aa83a9f8adea4438902821f2be77695631f75d1602d94db6dc58e2181476cd26858f3c3aa033d5de16fadfb2ec552eb4f1ec4fca25eb35490b33d43d55844db4bcab36cef29cfe1010569af6cf7f5b4b6acfb2f16dbee7e82b1275af5bd32b528ec665e710cd814970e3778b5023a67184fa37db5d596d199d067960451fa3424238af82c9cff230c81a208b1dbaf054198c1c63ab325911a5d453ad63e232059b83e216e740d85c54cb2beab8789ce768588ec9fb335e76bc30b6c8d2a837158691db54cf1211f0eb42d9cc1025ec974dc4b129751c8c2afdbcc5ad3e0191059050d7bb1f8f034a03c07e45e9bf04aa4b7aec0a1e7aef30773678049220f1fe50ec1957f7ab19f212f3e452061f3802d38318bdc74c48f659373e59e0ca43a3a8f8f0048666ee2904024e536611de0cb498fd0b3fd6cfd6c4f16fe2ab1f084109e8b4a53a23681ad046779452fe43ed1fb1576987d7fc6b6864faa230c139d69de4dd22067ca5fd73ad50b4a15a4750f0ceb14061dad0efcd0c1e0b2d4cc96631e4d7ab1a9abd6223b2acf687e7a49df0bbdf3b05c8e66bec08d3c6e1869c33e3cc4eed6b6b6aaabb81ae221f3b72096e402f6b22612cb318ac2f50faeacf4f5db0314c377b43f5ad5ccfd59deec8134956772be0d9d20b5ad0eb9b72da5cc827a75a07eae825241af0dc55bbd6404932bcce7f80f5282c7ffc7d7e55cc59d9edf394820083da45de0678dd68b8b55f64b54f89b2335b7a39cc810d37e53f17e53850b5500af31436c06f6ebe480073666106ac0dc504
IP
5.61.55.142:0
ASN
#58061 Scalaxy B.V.

File type
GIF image data, version 89a, 1 x 1\012- data
Size
35 B (35 bytes)
Hash
c2196de8ba412c60c22ab491af7b1409
5fbd472222feb8a22cf5b8aa5dc5b8e13af88e2b
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

HTTP Headers

GET /dp?h=660b4e4ccc0c5d39e7aa83a9f8adea4438902821f2be77695631f75d1602d94db6dc58e2181476cd26858f3c3aa033d5de16fadfb2ec552eb4f1ec4fca25eb35490b33d43d55844db4bcab36cef29cfe1010569af6cf7f5b4b6acfb2f16dbee7e82b1275af5bd32b528ec665e710cd814970e3778b5023a67184fa37db5d596d199d067960451fa3424238af82c9cff230c81a208b1dbaf054198c1c63ab325911a5d453ad63e232059b83e216e740d85c54cb2beab8789ce768588ec9fb335e76bc30b6c8d2a837158691db54cf1211f0eb42d9cc1025ec974dc4b129751c8c2afdbcc5ad3e0191059050d7bb1f8f034a03c07e45e9bf04aa4b7aec0a1e7aef30773678049220f1fe50ec1957f7ab19f212f3e452061f3802d38318bdc74c48f659373e59e0ca43a3a8f8f0048666ee2904024e536611de0cb498fd0b3fd6cfd6c4f16fe2ab1f084109e8b4a53a23681ad046779452fe43ed1fb1576987d7fc6b6864faa230c139d69de4dd22067ca5fd73ad50b4a15a4750f0ceb14061dad0efcd0c1e0b2d4cc96631e4d7ab1a9abd6223b2acf687e7a49df0bbdf3b05c8e66bec08d3c6e1869c33e3cc4eed6b6b6aaabb81ae221f3b72096e402f6b22612cb318ac2f50faeacf4f5db0314c377b43f5ad5ccfd59deec8134956772be0d9d20b5ad0eb9b72da5cc827a75a07eae825241af0dc55bbd6404932bcce7f80f5282c7ffc7d7e55cc59d9edf394820083da45de0678dd68b8b55f64b54f89b2335b7a39cc810d37e53f17e53850b5500af31436c06f6ebe480073666106ac0dc504 HTTP/1.1
Host: bncotheuz.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://bncotheuz.xyz/go?h=0501e91f-efb5-4af3-8561-70eeda57dd76
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 07 Sep 2023 01:30:47 GMT
Content-Type: image/gif
Content-Length: 35
Connection: keep-alive
X-Powered-By: Express
Set-Cookie: reqid=0501e91f-efb5-4af3-8561-70eeda57dd76; Path=/; Expires=Thu, 07 Sep 2023 01:30:50 GMT; HttpOnly
ETag: W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH

intepigo.com/api/submit_form_request?p=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&ts=1694050246&z=6276958

139.45.195.5

6.8 kB

URL
intepigo.com/api/submit_form_request?p=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&ts=1694050246&z=6276958
IP
139.45.195.5:0
ASN
#9002 RETN Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5726)
Size
6.8 kB (6810 bytes)
Hash
4c9eca735b7d5ffad1aef14dde4022a5
6989916db774808c4b02ce99ecd6eff15b870b87
0a7ea5dd1076a51235205409475fea725086bdf3d3d24c0fc88c9bdc9d59af93

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /api/submit_form_request?p=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&ts=1694050246&z=6276958 HTTP/1.1
Host: intepigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 07 Sep 2023 01:30:47 GMT
Content-Type: text/html; charset=utf8
Content-Length: 6810
Connection: keep-alive
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET intepigo.com/api/win_request?ad_scheme=1&p=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&hil=1&ng=1&ix=0&pt=0&np=1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fintepigo.com%2Fapi%2Fsubmit_form_request%3Fp%3Dd7ee4c14-72c3-4d8e-874a-c3cef2fd944a%26ts%3D1694050246%26z%3D6276958&wy=-1&wx=-1&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=0&sah=1024&navlng=en-US&rf=&wgl=

139.45.195.5

301 Moved Permanently

0 B

URL User Request GET HTTP/1.1
intepigo.com/api/win_request?ad_scheme=1&p=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&hil=1&ng=1&ix=0&pt=0&np=1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fintepigo.com%2Fapi%2Fsubmit_form_request%3Fp%3Dd7ee4c14-72c3-4d8e-874a-c3cef2fd944a%26ts%3D1694050246%26z%3D6276958&wy=-1&wx=-1&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=0&sah=1024&navlng=en-US&rf=&wgl=
IP
139.45.195.5:443
ASN
#9002 RETN Limited

Certificate
IssuerLet's Encrypt
Subjectintepigo.com
FingerprintED:7E:EC:D4:E7:97:A7:2A:AB:77:65:1A:F3:91:01:10:3C:1D:D3:28
ValidityTue, 25 Jul 2023 11:37:52 GMT - Mon, 23 Oct 2023 11:37:51 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /api/win_request?ad_scheme=1&p=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&hil=1&ng=1&ix=0&pt=0&np=1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fintepigo.com%2Fapi%2Fsubmit_form_request%3Fp%3Dd7ee4c14-72c3-4d8e-874a-c3cef2fd944a%26ts%3D1694050246%26z%3D6276958&wy=-1&wx=-1&ww=1280&wh=1024&cw=1280&wiw=1280&wih=1024&wfc=0&sah=1024&navlng=en-US&rf=&wgl= HTTP/1.1
Host: intepigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://intepigo.com/api/reverse?var=6276958&feedId=977&ymid=d7ee4c14-72c3-4d8e-874a-c3cef2fd944a&var_3=300004
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 07 Sep 2023 01:30:47 GMT
Content-Length: 0
Connection: keep-alive
Location: https://arklangr.com.me/?wm=6276958
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

GET arklangr.com.me/?wm=6276958

0.0.0.0

0 B

URL User Request GET
arklangr.com.me/?wm=6276958
IP
0.0.0.0:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?wm=6276958 HTTP/1.1
Host: arklangr.com.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://intepigo.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (12)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL