Report - xxxbnxcvbxxxwere.work.gd/

Report Overview

Submitted URL
xxxbnxcvbxxxwere.work.gd/
IP
174.136.231.90
ASN
#40676 AS40676
Submitted
2023-05-23 00:59:50
Access
public
Website Title
Final URL
Tags
crypto phishing dyndns
urlquery detections
Phishing - Generic Crypto/Wallet
Suspicious - DynDNS domain

Detections

urlquery
87
Network Intrusion Detection
44
Threat Detection Systems
92

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
xxxbnxcvbxxxwere.work.gd	unknown	2022-06-18	2023-05-23	2023-05-23	24 kB	2.1 MB	174.136.231.90
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-05-22	1.7 kB	3.5 kB	142.250.74.131
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2023-05-23	2.2 kB	156 kB	216.58.207.227
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2023-05-23	1.8 kB	18 kB	216.58.207.202
www.gstatic.com	unknown	2008-02-11	2016-07-26	2023-05-23	3.8 kB	12 kB	142.250.74.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-05-23 00:59:30	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:30	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:30	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:30	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:31	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:32	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:43	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain
2023-05-23 00:59:44	medium	Client IP	Internal IP	ET INFO DYNAMIC_DNS Query to a *.work .gd Domain

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/
2023-05-22	medium	xxxbnxcvbxxxwere.work.gd/

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (12)

	URL	Size	First Seen	Last Seen
	xxxbnxcvbxxxwere.work.gd/meta/webflow.js.download	601 kB	2023-03-07	2024-04-12
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/webflow.js.download IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:20:36 Last Seen2024-04-12 19:27:20 Times Seen596 Hash 9758f7e3aa0c79ea7a3cadb16d10087b 07f3c4e552e28eba6172f53d6dcf981a55f42031 0bb0c326dfc33136ad88e7454f06d22398a75f57f5eef79a30b218c171136f0d Loading...

	xxxbnxcvbxxxwere.work.gd/recover	101 B	2023-03-07	2024-01-01
Pretty URL xxxbnxcvbxxxwere.work.gd/recover IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:29:10 Last Seen2024-01-01 17:30:26 Times Seen100 Hash a21f8b439e3c709f9b3beda1c78b6e68 2f78ba7561b5a579ce38a147364771cf81a317e2 c33563ce5dd8db5f49c9aa77f0168aa69dcade416932a2d40a2fb16e72c1ce7d Loading...

	xxxbnxcvbxxxwere.work.gd/meta/plx.chock.js	3.4 kB	2023-03-07	2024-04-02
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/plx.chock.js IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:29:10 Last Seen2024-04-02 06:38:24 Times Seen660 Hash 5acfeead7d13511cdef767305b87e3f8 ec5337e62f1e64d3aaba3bf41a41b5f876964922 b9417c5359a2259bb564852a1ebd2b743b79ac06efdee42dc53456f8445ad246 Loading...

	xxxbnxcvbxxxwere.work.gd/meta/webfont.js.download	13 kB	2023-03-07	2024-04-19
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/webfont.js.download IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:17 Last Seen2024-04-19 11:35:06 Times Seen22295 Hash 7c96a5f11d9741541d5e3c42ff6380d7 d3fa2564c021cf730e58ffddb138cf6b57ed126e 81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee Loading...

	xxxbnxcvbxxxwere.work.gd/meta/jsonp	278 kB	2023-03-07	2024-03-12
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/jsonp IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:29:10 Last Seen2024-03-12 06:48:21 Times Seen411 Hash 7efac8c0fa8e30db7a423500ef59abab be73717f776f24dd31498c27a1b02b784570d5bb 102411780270584690575675e14e574ef8a16cf6fdd5700d5682e68a8d2cc00d Loading...

	xxxbnxcvbxxxwere.work.gd/recover	241 B	2023-03-07	2023-11-29
Pretty URL xxxbnxcvbxxxwere.work.gd/recover IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:29:10 Last Seen2023-11-29 08:44:34 Times Seen98 Hash 080e4144f0d34b9ed798406dbe568378 c161bb59ce93d05c318c95d634671cceb11b146a 24b98b55f46e8cc2b1eaee5562ecc67a3e00a404b8166aadae00c7d85bc60176 Loading...

	xxxbnxcvbxxxwere.work.gd/recover	234 B	2023-03-08	2023-07-11
Pretty URL xxxbnxcvbxxxwere.work.gd/recover IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 03:03:15 Last Seen2023-07-11 16:51:34 Times Seen22 Hash e151792a4107384e8478b79c6c107748 c1c41af265614b40a173cdb12f393a10fd58df93 db6add705544b42351e8a8afad3b72b0ad3371cdd5e2ab4df7df9a98a04d9610 Loading...

	xxxbnxcvbxxxwere.work.gd/meta/js	92 kB	2023-03-07	2024-03-12
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/js IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:20:36 Last Seen2024-03-12 06:48:21 Times Seen508 Hash fb2ab9b8632250b0d7aa50c08150cfe1 73b3f266ac08c9fb07e1de1664fed384ccd5bc86 5d419e0ff614b331e4f8fed2ba7c1380b1f5983f98d820a6a0f7040b55f60b5b Loading...

	xxxbnxcvbxxxwere.work.gd/meta/jquery-3.5.1.min.dc5e7f18c8.js.download	90 kB	2023-03-07	2024-04-19
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/jquery-3.5.1.min.dc5e7f18c8.js.download IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-19 11:31:34 Times Seen138271 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	xxxbnxcvbxxxwere.work.gd/meta/storage.secure.min.js.download	39 kB	2023-03-07	2024-04-12
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/storage.secure.min.js.download IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:45 Last Seen2024-04-12 19:27:20 Times Seen657 Hash 3386ec5559f1ba569cf0ab6acab436cc e98e11d37c5172ee128a85f68447efb3cb0e853c 996ab3c1e26cb00ec7d3d29650e784755ba46f33613563b7173b0dab03fa3d73 Loading...

	xxxbnxcvbxxxwere.work.gd/meta/recaptcha__nl.js.download	354 kB	2023-03-07	2024-04-12
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/recaptcha__nl.js.download IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:29:10 Last Seen2024-04-12 19:27:20 Times Seen583 Hash e735084e8ffed1ad8d89df08d98d4d23 6cdab8dac12030c8bc980ec129affecc626285c3 6cde5be2d724e53c8c4a97041365d3075e3af63ec08e1712b2f831b6e2bd357b Loading...

	xxxbnxcvbxxxwere.work.gd/meta/enterprise.js.download	1.0 kB	2023-03-07	2024-04-12
Pretty URL xxxbnxcvbxxxwere.work.gd/meta/enterprise.js.download IP 174.136.231.90 ASN #40676 AS40676 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:29:10 Last Seen2024-04-12 19:27:20 Times Seen572 Hash d07e7630bc23cbdd7520d0a4f086c922 b50685923a96d55109959fdf21f369d902971b2a 15c0f679abecff8fba48dbe673343f3e0f2a07c439d3f631722fccd2af2e1df2 Loading...

HTTP Transactions (67)

URL IP Response Size

xxxbnxcvbxxxwere.work.gd/

174.136.231.90

0 B

URL
xxxbnxcvbxxxwere.work.gd/
IP
174.136.231.90:0
ASN
#40676 AS40676

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET / HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx
Date: Tue, 23 May 2023 00:59:30 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7; expires=Tue, 23-May-2023 02:59:30 GMT; Max-Age=7200; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: https://xxxbnxcvbxxxwere.work.gd/authen

xxxbnxcvbxxxwere.work.gd/authen

174.136.231.90

5.8 kB

URL
xxxbnxcvbxxxwere.work.gd/authen
IP
174.136.231.90:0
ASN
#40676 AS40676

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (523)
Size
5.8 kB (5818 bytes)
Hash
b44863579414e89cbc0d0ea511c62d47
3c86832ae6f68f9af9a638beda8b278fe6819186
473879e95472c47e289eb9d7e4ed1535be142e5994e3de2a1e5b33b62ceaeb8b

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /authen HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:31 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5818
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
8d1ffc63ece540992319c6f7637db168
b84a5580317750f11fea9fb0ca41710c88e66d38
905441c3ec5505f8196be1b4c4123cd1862bc6f03ce2bc5cf5fe37b21e07c907

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 23 May 2023 00:59:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

xxxbnxcvbxxxwere.work.gd/meta/normalize.css

174.136.231.90

200 OK

2.7 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/normalize.css
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
2.7 kB (2659 bytes)
Hash
4951cc88307c632cf285d3ba988ab283
031d58bc40b4242b27d8171a01bb0ecb5f9d22d7
5c4a6fe64efc5d07833c35af9630d0f9b3d4d09a63f9358e441374e9102c9e81

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/normalize.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:31 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-1e5c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
8d1ffc63ece540992319c6f7637db168
b84a5580317750f11fea9fb0ca41710c88e66d38
905441c3ec5505f8196be1b4c4123cd1862bc6f03ce2bc5cf5fe37b21e07c907

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 23 May 2023 00:59:31 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

xxxbnxcvbxxxwere.work.gd/meta/webflow.css

174.136.231.90

200 OK

9.3 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/webflow.css
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Unicode text, UTF-8 text, with very long lines (2587)
Size
9.3 kB (9290 bytes)
Hash
13fc860cb6eddbf469d986e1a6b6480b
6bb85ecdc704734f59d4984d202f75b02048a58d
ba6716203b5a6f128eab828aef79dcdfeab87ec1ee605392e4a9d6955de30842

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/webflow.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:31 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-98c5"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/plx.chock.js

174.136.231.90

200 OK

311 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/plx.chock.js
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
311 B (311 bytes)
Hash
5acfeead7d13511cdef767305b87e3f8
ec5337e62f1e64d3aaba3bf41a41b5f876964922
b9417c5359a2259bb564852a1ebd2b743b79ac06efdee42dc53456f8445ad246

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/plx.chock.js HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: application/javascript
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-d41"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/css.html

174.136.231.90

200 OK

684 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/css.html
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
684 B (684 bytes)
Hash
147429fb2ddc3861e2ae0f473f17d78e
f2bdce63e15b9f3b90c8c3b153deb75b28eb69e3
25d501d70fcb9835f935fd47e045502700dc5f862cd7e763a49bbc7316396f2a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/css.html HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: text/html
Content-Length: 684
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Connection: keep-alive
ETag: "646be70a-2ac"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css

174.136.231.90

200 OK

18 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
18 kB (17621 bytes)
Hash
d4ede0f1d47b3b9aac92ea8a29c2ec85
135c44809f03ce1360c7e74da033e4b4f5cfb87c
98489ee303fa850e7c3185248b30d64dfb6c7c55aa8726a98efb037525988e5a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/metamask-staging-2.webflow.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:31 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-22adb"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/webfont.js.download

174.136.231.90

200 OK

5.4 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/webfont.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (2134)
Size
5.4 kB (5415 bytes)
Hash
7c96a5f11d9741541d5e3c42ff6380d7
d3fa2564c021cf730e58ffddb138cf6b57ed126e
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/webfont.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: application/javascript
Content-Length: 5415
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "3384-5fc4f763a7df5-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/js

174.136.231.90

200 OK

35 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/js
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (1815)
Size
35 kB (35327 bytes)
Hash
fb2ab9b8632250b0d7aa50c08150cfe1
73b3f266ac08c9fb07e1de1664fed384ccd5bc86
5d419e0ff614b331e4f8fed2ba7c1380b1f5983f98d820a6a0f7040b55f60b5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/js HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Length: 35327
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "168a5-5fc4f76308b12-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/enterprise.js.download

174.136.231.90

200 OK

614 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/enterprise.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (1008), with no line terminators
Size
614 B (614 bytes)
Hash
d07e7630bc23cbdd7520d0a4f086c922
b50685923a96d55109959fdf21f369d902971b2a
15c0f679abecff8fba48dbe673343f3e0f2a07c439d3f631722fccd2af2e1df2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/enterprise.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: application/javascript
Content-Length: 614
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
ETag: "3f0-5fc4f762bc851-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/css.html

174.136.231.90

200 OK

684 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/css.html
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
684 B (684 bytes)
Hash
147429fb2ddc3861e2ae0f473f17d78e
f2bdce63e15b9f3b90c8c3b153deb75b28eb69e3
25d501d70fcb9835f935fd47e045502700dc5f862cd7e763a49bbc7316396f2a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/css.html HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: text/html
Content-Length: 684
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Connection: keep-alive
ETag: "646be70a-2ac"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
8ab94d7259411fe8a216956474b19511
48c63eaff708604c5f7af9514c3e77109a1f3f73
1dfd960074784d17f2fab64fab44d8aa41c1a794a7000980b428f6ab6392439a

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 23 May 2023 00:59:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

xxxbnxcvbxxxwere.work.gd/meta/jquery-3.5.1.min.dc5e7f18c8.js.download

174.136.231.90

200 OK

31 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/jquery-3.5.1.min.dc5e7f18c8.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (65451)
Size
31 kB (30910 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/jquery-3.5.1.min.dc5e7f18c8.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: application/javascript
Content-Length: 30910
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "15d84-5fc4f762fcf92-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
8ab94d7259411fe8a216956474b19511
48c63eaff708604c5f7af9514c3e77109a1f3f73
1dfd960074784d17f2fab64fab44d8aa41c1a794a7000980b428f6ab6392439a

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 23 May 2023 00:59:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2

216.58.207.227

200 OK

8.4 kB

URL GET HTTP/2
fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
Web Open Font Format (Version 2), TrueType, length 8404, version 1.0\012- data
Size
8.4 kB (8404 bytes)
Hash
141119ae119bf7ca75e10ef82f66e442
adebf435aa078db3c116cb9faae15f2ad81d3ac5
c6afeb967afd466210e4061473c4855684e84b7e850b248c0533e6288acfbaff

HTTP Headers

GET /s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://xxxbnxcvbxxxwere.work.gd
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 8404
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 May 2023 07:46:25 GMT
expires: Fri, 17 May 2024 07:46:25 GMT
cache-control: public, max-age=31536000
age: 407587
last-modified: Thu, 21 Apr 2022 17:15:41 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Changa+One:400,400italic

216.58.207.202

200 OK

8.2 kB

URL GET HTTP/3
fonts.googleapis.com/css?family=Changa+One:400,400italic
IP
216.58.207.202:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint9B:D0:53:C4:55:9D:41:A4:94:03:4A:2B:6A:5B:57:EB:EB:A5:F0:4A
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
gzip compressed data, max compression\012- data
Size
8.2 kB (8212 bytes)
Hash
44f615485f6f1b3c642c2823af5555fe
2eeac8aa35e7f885be8644a473a930bf4e902c59
30bc4040a6676593eb9000fa0a3ce166a3f95216e15938e251919d8c030baf35

HTTP Headers

GET /css?family=Changa+One:400,400italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 23 May 2023 00:59:32 GMT
date: Tue, 23 May 2023 00:59:32 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

xxxbnxcvbxxxwere.work.gd/meta/storage.secure.min.js.download

174.136.231.90

200 OK

13 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/storage.secure.min.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (38562), with no line terminators
Size
13 kB (13194 bytes)
Hash
3386ec5559f1ba569cf0ab6acab436cc
e98e11d37c5172ee128a85f68447efb3cb0e853c
996ab3c1e26cb00ec7d3d29650e784755ba46f33613563b7173b0dab03fa3d73

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/storage.secure.min.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: application/javascript
Content-Length: 13194
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "96a2-5fc4f763695f4-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/jsonp

174.136.231.90

200 OK

87 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/jsonp
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
87 kB (87424 bytes)
Hash
7efac8c0fa8e30db7a423500ef59abab
be73717f776f24dd31498c27a1b02b784570d5bb
102411780270584690575675e14e574ef8a16cf6fdd5700d5682e68a8d2cc00d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/jsonp HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "43f6e-5fc4f76314692-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
8ab94d7259411fe8a216956474b19511
48c63eaff708604c5f7af9514c3e77109a1f3f73
1dfd960074784d17f2fab64fab44d8aa41c1a794a7000980b428f6ab6392439a

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 23 May 2023 00:59:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

xxxbnxcvbxxxwere.work.gd/meta/mm-logo.svg

174.136.231.90

200 OK

3.4 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/mm-logo.svg
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1001)
Size
3.4 kB (3369 bytes)
Hash
51bcea2625eb2c6e9268a7377a792c86
5eeb306e6584eed1747c36c11724f193711d430e
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/mm-logo.svg HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-2ef3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/wpp.gif

174.136.231.90

3.9 kB

URL
xxxbnxcvbxxxwere.work.gd/meta/wpp.gif
IP
174.136.231.90:0
ASN
#40676 AS40676

File type
GIF image data, version 87a, 470 x 40\012- data
Size
3.9 kB (3877 bytes)
Hash
941648b845842a709da73e24652cf8a4
099e5f97e602d026c51537c9b45328dc99261d7c
2a7344e607a878f0acac7f5c9c3a65fc8a4423f00e21d3fb7a814cae051631d9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/wpp.gif HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: image/gif
Content-Length: 3877
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Connection: keep-alive
ETag: "646be70b-f25"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

xxxbnxcvbxxxwere.work.gd/meta/webflow.js.download

174.136.231.90

200 OK

147 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/webflow.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Unicode text, UTF-8 text, with very long lines (50020)
Size
147 kB (147184 bytes)
Hash
9758f7e3aa0c79ea7a3cadb16d10087b
07f3c4e552e28eba6172f53d6dcf981a55f42031
0bb0c326dfc33136ad88e7454f06d22398a75f57f5eef79a30b218c171136f0d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/webflow.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "92c10-5fc4f763b1a36-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Bold-WebXL.woff2

174.136.231.90

200 OK

44 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Bold-WebXL.woff2
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Web Open Font Format (Version 2), TrueType, length 44544, version 3.66\012- data
Size
44 kB (44544 bytes)
Hash
9024d0bf73943172297c4628d0054e20
36c3795e7b297d06589e15ef59592683d9ed0974
88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/EuclidCircularB-Bold-WebXL.woff2 HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Length: 44544
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
ETag: "ae00-5fc4f762cf131"
Accept-Ranges: bytes
Vary: Accept-Encoding

xxxbnxcvbxxxwere.work.gd/meta/hero2.4.png

174.136.231.90

590 kB

URL
xxxbnxcvbxxxwere.work.gd/meta/hero2.4.png
IP
174.136.231.90:0
ASN
#40676 AS40676

File type
PNG image data, 1752 x 1452, 8-bit/color RGBA, non-interlaced\012- data
Size
590 kB (589568 bytes)
Hash
d0ec70f4c666fbf6ad0d30a52d08c5c9
e48f0688bc4f592824840478d12c05df0dd12002
3f4bfc7c6cc471e9d95936dc109852c4f6a4bf1163b63eeabfe840565d5ad8d1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/hero2.4.png HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: image/png
Content-Length: 589568
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Connection: keep-alive
ETag: "646be70a-8ff00"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

xxxbnxcvbxxxwere.work.gd/meta/bframe.html

174.136.231.90

200 OK

4.1 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/bframe.html
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (3186)
Size
4.1 kB (4069 bytes)
Hash
ab544024d3cf8ee17b4995a04711bc92
da849c1c8b08864d499153a059e5d429b8df19ce
b9d7893f4e6f83b6dca5ec8e27e47e382f4ace81907591ab102345bef9d3bb5f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/bframe.html HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Type: text/html
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70a-2e07"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Regular-WebXL.woff2

174.136.231.90

200 OK

45 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Regular-WebXL.woff2
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Web Open Font Format (Version 2), TrueType, length 45196, version 3.66\012- data
Size
45 kB (45196 bytes)
Hash
2d75957df3bb3aa6ed84f6591b0d5a1a
906424e75625f63b0188471067065794d0348536
8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/EuclidCircularB-Regular-WebXL.woff2 HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:32 GMT
Content-Length: 45196
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
ETag: "b08c-5fc4f762e0a71"
Accept-Ranges: bytes
Vary: Accept-Encoding

xxxbnxcvbxxxwere.work.gd/meta/styles__ltr.css

174.136.231.90

24 kB

URL GET
xxxbnxcvbxxxwere.work.gd/meta/styles__ltr.css
IP
174.136.231.90:0
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (52368), with no line terminators
Size
24 kB (24092 bytes)
Hash
97c3d49b83dc004fcda822b1853b787b
a82fcfbd6b1cf4dd00f4a63d47b9119a69b40147
509bf9e83d3ca5add614196c02c8e0ce59731d3d1a10552c944b74d86019d866

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/styles__ltr.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:33 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-cc90"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/recaptcha__nl.js.download

174.136.231.90

138 kB

URL GET
xxxbnxcvbxxxwere.work.gd/meta/recaptcha__nl.js.download
IP
174.136.231.90:0
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (820)
Size
138 kB (137504 bytes)
Hash
e735084e8ffed1ad8d89df08d98d4d23
6cdab8dac12030c8bc980ec129affecc626285c3
6cde5be2d724e53c8c4a97041365d3075e3af63ec08e1712b2f831b6e2bd357b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/recaptcha__nl.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "56577-5fc4f76350f54-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/metamask.io/images/webclip.png

174.136.231.90

404 Not Found

557 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/metamask.io/images/webclip.png
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
557 B (557 bytes)
Hash
fc10f358967a59750ef6fd9a698e2d60
3fc472d167c41a4193625aff84ee6e599b302002
16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /metamask.io/images/webclip.png HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/authen
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 23 May 2023 00:59:33 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 557
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js

142.250.74.35

404 Not Found

1.6 kB

URL GET HTTP/3
www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Size
1.6 kB (1621 bytes)
Hash
c90524d6a02b27addb56c350fe6fbb2d
d713d1b53323c0169ffe0649be8c9d04a189f999
4aefd395113d052a874ac1919aed0e288835e0377683f1e71e98838d16c986e0

HTTP Headers

GET /recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://xxxbnxcvbxxxwere.work.gd
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Tue, 23 May 2023 00:59:33 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1621
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.gstatic.com/recaptcha/api2/info_2x.png

142.250.74.35

665 B

URL
www.gstatic.com/recaptcha/api2/info_2x.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced\012- data
Size
665 B (665 bytes)
Hash
07bf314aab04047b9e9a959ee6f63da3
17bef6602672e2fd9956381e01356245144003e5
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

HTTP Headers

GET /recaptcha/api2/info_2x.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 665
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 May 2023 00:56:35 GMT
expires: Thu, 25 May 2023 00:56:35 GMT
cache-control: public, max-age=604800
age: 432178
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.gstatic.com/recaptcha/api2/audio_2x.png

142.250.74.35

530 B

URL
www.gstatic.com/recaptcha/api2/audio_2x.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced\012- data
Size
530 B (530 bytes)
Hash
88e0f42c9fa4f94aa8bcd54d1685c180
5ad9d47a49b82718baa3be88550a0b3350270c42
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

HTTP Headers

GET /recaptcha/api2/audio_2x.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 530
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 20 May 2023 07:40:18 GMT
expires: Sat, 27 May 2023 07:40:18 GMT
cache-control: public, max-age=604800
age: 235155
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.gstatic.com/recaptcha/api2/refresh_2x.png

142.250.74.35

600 B

URL
www.gstatic.com/recaptcha/api2/refresh_2x.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced\012- data
Size
600 B (600 bytes)
Hash
0f2a4639b8a4cb30c76e8333c00d30a6
57e273a270bb864970d747c74b3f0a7c8e515b13
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

HTTP Headers

GET /recaptcha/api2/refresh_2x.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 600
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 17 May 2023 20:49:22 GMT
expires: Wed, 24 May 2023 20:49:22 GMT
cache-control: public, max-age=604800
age: 447011
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

fonts.googleapis.com/icon?family=Material+Icons

216.58.207.202

200 OK

897 B

URL GET HTTP/3
fonts.googleapis.com/icon?family=Material+Icons
IP
216.58.207.202:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint9B:D0:53:C4:55:9D:41:A4:94:03:4A:2B:6A:5B:57:EB:EB:A5:F0:4A
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
897 B (897 bytes)
Hash
ebebecd890788101998fbfd81718d353
987ba7d3dd33a8283a93495edd3d2407ea140356
0d62a7f121b833b78ef6282cff6646d618fa037c77f016c89dd26fcb60897964

HTTP Headers

GET /icon?family=Material+Icons HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 23 May 2023 00:59:31 GMT
date: Tue, 23 May 2023 00:59:31 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

xxxbnxcvbxxxwere.work.gd/recover

174.136.231.90

200 OK

5.7 kB

URL User Request GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/recover
IP
174.136.231.90:443
ASN
#40676 AS40676

Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (471)
Size
5.7 kB (5700 bytes)
Hash
c45b044f2cd97fdea337b5465b0e0536
75ed52e4616ae449a1c47631716f6fcd06cb122c
0f12fdd4b80ca569c79912d5200e1745159cb0ae9805497b72227ffacc84f165

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /recover HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5700
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/normalize.css

174.136.231.90

200 OK

2.7 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/normalize.css
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
2.7 kB (2659 bytes)
Hash
4951cc88307c632cf285d3ba988ab283
031d58bc40b4242b27d8171a01bb0ecb5f9d22d7
5c4a6fe64efc5d07833c35af9630d0f9b3d4d09a63f9358e441374e9102c9e81

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/normalize.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-1e5c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/webflow.css

174.136.231.90

200 OK

9.3 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/webflow.css
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Unicode text, UTF-8 text, with very long lines (2587)
Size
9.3 kB (9290 bytes)
Hash
13fc860cb6eddbf469d986e1a6b6480b
6bb85ecdc704734f59d4984d202f75b02048a58d
ba6716203b5a6f128eab828aef79dcdfeab87ec1ee605392e4a9d6955de30842

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/webflow.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-98c5"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/plx.chock.js

174.136.231.90

200 OK

311 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/plx.chock.js
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
311 B (311 bytes)
Hash
5acfeead7d13511cdef767305b87e3f8
ec5337e62f1e64d3aaba3bf41a41b5f876964922
b9417c5359a2259bb564852a1ebd2b743b79ac06efdee42dc53456f8445ad246

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/plx.chock.js HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: application/javascript
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-d41"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/css.html

174.136.231.90

200 OK

684 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/css.html
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
684 B (684 bytes)
Hash
147429fb2ddc3861e2ae0f473f17d78e
f2bdce63e15b9f3b90c8c3b153deb75b28eb69e3
25d501d70fcb9835f935fd47e045502700dc5f862cd7e763a49bbc7316396f2a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/css.html HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: text/html
Content-Length: 684
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Connection: keep-alive
ETag: "646be70a-2ac"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

xxxbnxcvbxxxwere.work.gd/meta/webfont.js.download

174.136.231.90

200 OK

5.4 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/webfont.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (2134)
Size
5.4 kB (5415 bytes)
Hash
7c96a5f11d9741541d5e3c42ff6380d7
d3fa2564c021cf730e58ffddb138cf6b57ed126e
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/webfont.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: application/javascript
Content-Length: 5415
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "3384-5fc4f763a7df5-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css

174.136.231.90

200 OK

18 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
18 kB (17621 bytes)
Hash
d4ede0f1d47b3b9aac92ea8a29c2ec85
135c44809f03ce1360c7e74da033e4b4f5cfb87c
98489ee303fa850e7c3185248b30d64dfb6c7c55aa8726a98efb037525988e5a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/metamask-staging-2.webflow.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-22adb"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/enterprise.js.download

174.136.231.90

200 OK

614 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/enterprise.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (1008), with no line terminators
Size
614 B (614 bytes)
Hash
d07e7630bc23cbdd7520d0a4f086c922
b50685923a96d55109959fdf21f369d902971b2a
15c0f679abecff8fba48dbe673343f3e0f2a07c439d3f631722fccd2af2e1df2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/enterprise.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: application/javascript
Content-Length: 614
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
ETag: "3f0-5fc4f762bc851-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/storage.secure.min.js.download

174.136.231.90

200 OK

13 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/storage.secure.min.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (38562), with no line terminators
Size
13 kB (13194 bytes)
Hash
3386ec5559f1ba569cf0ab6acab436cc
e98e11d37c5172ee128a85f68447efb3cb0e853c
996ab3c1e26cb00ec7d3d29650e784755ba46f33613563b7173b0dab03fa3d73

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/storage.secure.min.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: application/javascript
Content-Length: 13194
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "96a2-5fc4f763695f4-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/css.html

174.136.231.90

200 OK

684 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/css.html
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text
Size
684 B (684 bytes)
Hash
147429fb2ddc3861e2ae0f473f17d78e
f2bdce63e15b9f3b90c8c3b153deb75b28eb69e3
25d501d70fcb9835f935fd47e045502700dc5f862cd7e763a49bbc7316396f2a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/css.html HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: text/html
Content-Length: 684
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Connection: keep-alive
ETag: "646be70a-2ac"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

fonts.gstatic.com/s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2

216.58.207.227

200 OK

7.9 kB

URL GET HTTP/2
fonts.gstatic.com/s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7900, version 1.0\012- data
Size
7.9 kB (7900 bytes)
Hash
61e86e7a20ecf3ba181ca4b9a9a1cdbd
482a65cffc69109af26669d64accbef71db3b836
fbd0536d5b92c0dbe6ad2637800ae8da10c20755b564a3575bd12bba57f73b18

HTTP Headers

GET /s/changaone/v18/xfu00W3wXn3QLUJXhzq42AHiuQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://xxxbnxcvbxxxwere.work.gd
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7900
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 May 2023 06:19:20 GMT
expires: Fri, 17 May 2024 06:19:20 GMT
cache-control: public, max-age=31536000
age: 412823
last-modified: Thu, 21 Apr 2022 17:15:19 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2

216.58.207.227

200 OK

8.4 kB

URL GET HTTP/2
fonts.gstatic.com/s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
Web Open Font Format (Version 2), TrueType, length 8404, version 1.0\012- data
Size
8.4 kB (8404 bytes)
Hash
141119ae119bf7ca75e10ef82f66e442
adebf435aa078db3c116cb9faae15f2ad81d3ac5
c6afeb967afd466210e4061473c4855684e84b7e850b248c0533e6288acfbaff

HTTP Headers

GET /s/changaone/v18/xfu20W3wXn3QLUJXhzq42ATSu5_f.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://xxxbnxcvbxxxwere.work.gd
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 8404
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 May 2023 07:46:25 GMT
expires: Fri, 17 May 2024 07:46:25 GMT
cache-control: public, max-age=31536000
age: 407598
last-modified: Thu, 21 Apr 2022 17:15:41 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

xxxbnxcvbxxxwere.work.gd/meta/js

174.136.231.90

200 OK

35 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/js
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (1815)
Size
35 kB (35327 bytes)
Hash
fb2ab9b8632250b0d7aa50c08150cfe1
73b3f266ac08c9fb07e1de1664fed384ccd5bc86
5d419e0ff614b331e4f8fed2ba7c1380b1f5983f98d820a6a0f7040b55f60b5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/js HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Length: 35327
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "168a5-5fc4f76308b12-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/jsonp

174.136.231.90

200 OK

87 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/jsonp
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
87 kB (87424 bytes)
Hash
7efac8c0fa8e30db7a423500ef59abab
be73717f776f24dd31498c27a1b02b784570d5bb
102411780270584690575675e14e574ef8a16cf6fdd5700d5682e68a8d2cc00d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/jsonp HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "43f6e-5fc4f76314692-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

216.58.207.227

200 OK

128 kB

URL GET HTTP/3
fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
Web Open Font Format (Version 2), TrueType, length 128352, version 1.0\012- data
Size
128 kB (128352 bytes)
Hash
53436aca8627a49f4deaaa44dc9e3c05
0bc0c675480d94ec7e8609dda6227f88c5d08d2c
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

HTTP Headers

GET /s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://xxxbnxcvbxxxwere.work.gd
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 128352
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 17 May 2023 00:16:40 GMT
expires: Thu, 16 May 2024 00:16:40 GMT
cache-control: public, max-age=31536000
age: 520984
last-modified: Tue, 07 Mar 2023 19:51:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

xxxbnxcvbxxxwere.work.gd/meta/jquery-3.5.1.min.dc5e7f18c8.js.download

174.136.231.90

200 OK

31 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/jquery-3.5.1.min.dc5e7f18c8.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (65451)
Size
31 kB (30910 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/jquery-3.5.1.min.dc5e7f18c8.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: application/javascript
Content-Length: 30910
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "15d84-5fc4f762fcf92-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/mm-logo.svg

174.136.231.90

200 OK

3.4 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/mm-logo.svg
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1001)
Size
3.4 kB (3369 bytes)
Hash
51bcea2625eb2c6e9268a7377a792c86
5eeb306e6584eed1747c36c11724f193711d430e
5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/mm-logo.svg HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: image/svg+xml
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-2ef3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Regular-WebXL.woff2

174.136.231.90

200 OK

45 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Regular-WebXL.woff2
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Web Open Font Format (Version 2), TrueType, length 45196, version 3.66\012- data
Size
45 kB (45196 bytes)
Hash
2d75957df3bb3aa6ed84f6591b0d5a1a
906424e75625f63b0188471067065794d0348536
8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/EuclidCircularB-Regular-WebXL.woff2 HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Length: 45196
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
ETag: "b08c-5fc4f762e0a71"
Accept-Ranges: bytes
Vary: Accept-Encoding

xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Bold-WebXL.woff2

174.136.231.90

200 OK

44 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/EuclidCircularB-Bold-WebXL.woff2
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Web Open Font Format (Version 2), TrueType, length 44544, version 3.66\012- data
Size
44 kB (44544 bytes)
Hash
9024d0bf73943172297c4628d0054e20
36c3795e7b297d06589e15ef59592683d9ed0974
88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/EuclidCircularB-Bold-WebXL.woff2 HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Length: 44544
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
ETag: "ae00-5fc4f762cf131"
Accept-Ranges: bytes
Vary: Accept-Encoding

xxxbnxcvbxxxwere.work.gd/meta/webflow.js.download

174.136.231.90

200 OK

147 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/webflow.js.download
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
Unicode text, UTF-8 text, with very long lines (50020)
Size
147 kB (147184 bytes)
Hash
9758f7e3aa0c79ea7a3cadb16d10087b
07f3c4e552e28eba6172f53d6dcf981a55f42031
0bb0c326dfc33136ad88e7454f06d22398a75f57f5eef79a30b218c171136f0d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/webflow.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:43 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "92c10-5fc4f763b1a36-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

fonts.googleapis.com/css?family=Changa+One:400,400italic

216.58.207.202

200 OK

4.4 kB

URL GET HTTP/3
fonts.googleapis.com/css?family=Changa+One:400,400italic
IP
216.58.207.202:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint9B:D0:53:C4:55:9D:41:A4:94:03:4A:2B:6A:5B:57:EB:EB:A5:F0:4A
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (3186)
Size
4.4 kB (4381 bytes)
Hash
e52b4fb35621bba9ee90969d4ba7efad
c022e9c83aa105dc797f7c1cbd259d2680f5df3b
dcba2d79ad0b63cb9ecf958270635c31bc6fdbd6072e5cc754f98fabace6d4b4

HTTP Headers

GET /css?family=Changa+One:400,400italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 23 May 2023 00:59:43 GMT
date: Tue, 23 May 2023 00:59:43 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

fonts.googleapis.com/icon?family=Material+Icons

216.58.207.202

200 OK

2.0 kB

URL GET HTTP/3
fonts.googleapis.com/icon?family=Material+Icons
IP
216.58.207.202:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint9B:D0:53:C4:55:9D:41:A4:94:03:4A:2B:6A:5B:57:EB:EB:A5:F0:4A
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
gzip compressed data, max compression\012- data
Size
2.0 kB (1961 bytes)
Hash
d1daaccb04e87d51f3d98ba3eb3f6811
88bcfdcc80575f8a4da8ee46b60f98ac20b70c07
e229e0e35d762200172b885576462b0d942b73369414920dfaea0b51695b46ee

HTTP Headers

GET /icon?family=Material+Icons HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 23 May 2023 00:59:43 GMT
date: Tue, 23 May 2023 00:59:43 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

xxxbnxcvbxxxwere.work.gd/meta/Institutional-Illustration.png

174.136.231.90

200 OK

290 kB

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/meta/Institutional-Illustration.png
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
PNG image data, 876 x 1040, 8-bit/color RGBA, non-interlaced\012- data
Size
290 kB (289564 bytes)
Hash
85607339bb7e3cc70e1b7568ed4d29b2
7c6301d70e1ab599857be6e9795b94418cef6079
5bdf1ea203497adb942fa639a322195c744910ae8980d625d986ddead1f8ed37

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/Institutional-Illustration.png HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/metamask-staging-2.webflow.css
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: image/png
Content-Length: 289564
Last-Modified: Mon, 22 May 2023 22:04:58 GMT
Connection: keep-alive
ETag: "646be70a-46b1c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes

xxxbnxcvbxxxwere.work.gd/metamask.io/images/webclip.png

174.136.231.90

404 Not Found

557 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/metamask.io/images/webclip.png
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
557 B (557 bytes)
Hash
fc10f358967a59750ef6fd9a698e2d60
3fc472d167c41a4193625aff84ee6e599b302002
16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /metamask.io/images/webclip.png HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 557
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/metamask.io/images/favicon.png

174.136.231.90

404 Not Found

557 B

URL GET HTTP/1.1
xxxbnxcvbxxxwere.work.gd/metamask.io/images/favicon.png
IP
174.136.231.90:443
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
557 B (557 bytes)
Hash
fc10f358967a59750ef6fd9a698e2d60
3fc472d167c41a4193625aff84ee6e599b302002
16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /metamask.io/images/favicon.png HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/recover
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 557
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

xxxbnxcvbxxxwere.work.gd/meta/styles__ltr.css

174.136.231.90

24 kB

URL GET
xxxbnxcvbxxxwere.work.gd/meta/styles__ltr.css
IP
174.136.231.90:0
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (52368), with no line terminators
Size
24 kB (24092 bytes)
Hash
97c3d49b83dc004fcda822b1853b787b
a82fcfbd6b1cf4dd00f4a63d47b9119a69b40147
509bf9e83d3ca5add614196c02c8e0ce59731d3d1a10552c944b74d86019d866

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/styles__ltr.css HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: text/css
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"646be70b-cc90"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js

142.250.74.35

404 Not Found

1.6 kB

URL GET HTTP/3
www.gstatic.com/recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://xxxbnxcvbxxxwere.work.gd/recover
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1136)
Size
1.6 kB (1621 bytes)
Hash
c90524d6a02b27addb56c350fe6fbb2d
d713d1b53323c0169ffe0649be8c9d04a189f999
4aefd395113d052a874ac1919aed0e288835e0377683f1e71e98838d16c986e0

HTTP Headers

GET /recaptcha/releases/rPvs0Nyx3sANE-ZHUN-0nM85/recaptcha__nl.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://xxxbnxcvbxxxwere.work.gd
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Tue, 23 May 2023 00:59:45 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1621
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

xxxbnxcvbxxxwere.work.gd/meta/recaptcha__nl.js.download

174.136.231.90

138 kB

URL GET
xxxbnxcvbxxxwere.work.gd/meta/recaptcha__nl.js.download
IP
174.136.231.90:0
ASN
#40676 AS40676

Requested by
https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Certificate
IssuerLet's Encrypt
Subjectxxxbnxcvbxxxwere.work.gd
Fingerprint98:2B:05:2D:2D:71:6E:6E:F2:F5:21:27:C6:24:5E:3C:4E:FE:D7:E2
ValidityMon, 22 May 2023 21:03:41 GMT - Sun, 20 Aug 2023 21:03:40 GMT

File type
ASCII text, with very long lines (820)
Size
138 kB (137504 bytes)
Hash
e735084e8ffed1ad8d89df08d98d4d23
6cdab8dac12030c8bc980ec129affecc626285c3
6cde5be2d724e53c8c4a97041365d3075e3af63ec08e1712b2f831b6e2bd357b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic Crypto/Wallet
urlquery	suspicious	Suspicious - DynDNS domain
openphish	Crypto/Wallet

HTTP Headers

GET /meta/recaptcha__nl.js.download HTTP/1.1
Host: xxxbnxcvbxxxwere.work.gd
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/meta/bframe.html
Cookie: cazanova=3e11aj79kl2i90une70bio65a28dmrd7
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 23 May 2023 00:59:44 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 22 May 2023 22:04:59 GMT
ETag: "56577-5fc4f76350f54-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

www.gstatic.com/recaptcha/api2/info_2x.png

142.250.74.35

665 B

URL
www.gstatic.com/recaptcha/api2/info_2x.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced\012- data
Size
665 B (665 bytes)
Hash
07bf314aab04047b9e9a959ee6f63da3
17bef6602672e2fd9956381e01356245144003e5
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

HTTP Headers

GET /recaptcha/api2/info_2x.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 665
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 May 2023 00:56:35 GMT
expires: Thu, 25 May 2023 00:56:35 GMT
cache-control: public, max-age=604800
age: 432190
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.gstatic.com/recaptcha/api2/refresh_2x.png

142.250.74.35

600 B

URL
www.gstatic.com/recaptcha/api2/refresh_2x.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced\012- data
Size
600 B (600 bytes)
Hash
0f2a4639b8a4cb30c76e8333c00d30a6
57e273a270bb864970d747c74b3f0a7c8e515b13
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

HTTP Headers

GET /recaptcha/api2/refresh_2x.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 600
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 17 May 2023 20:49:22 GMT
expires: Wed, 24 May 2023 20:49:22 GMT
cache-control: public, max-age=604800
age: 447023
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.gstatic.com/recaptcha/api2/audio_2x.png

142.250.74.35

530 B

URL
www.gstatic.com/recaptcha/api2/audio_2x.png
IP
142.250.74.35:0
ASN
#15169 GOOGLE

Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE2:33:59:47:38:D7:4A:7A:9E:28:5D:EC:AA:94:7F:92:25:D2:B1:C4
ValidityMon, 24 Apr 2023 12:00:43 GMT - Mon, 17 Jul 2023 12:00:42 GMT

File type
PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced\012- data
Size
530 B (530 bytes)
Hash
88e0f42c9fa4f94aa8bcd54d1685c180
5ad9d47a49b82718baa3be88550a0b3350270c42
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

HTTP Headers

GET /recaptcha/api2/audio_2x.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xxxbnxcvbxxxwere.work.gd/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 530
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 20 May 2023 07:40:18 GMT
expires: Sat, 27 May 2023 07:40:18 GMT
cache-control: public, max-age=604800
age: 235167
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML