Report - megachance1.ru/lander/survey

Report Overview

Submitted URL
megachance1.ru/lander/survey_my/index.html
IP
45.80.70.203
ASN
#198610 Beget LLC
Submitted
2023-06-14 23:16:22
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
3
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
megachance1.ru	unknown	2023-05-17	2023-05-18	2023-06-15	1.9 kB	6.4 kB	45.80.70.203
news-gevike.cc	unknown	2022-09-13	2022-09-14	2023-06-15	853 B	9.9 kB	193.108.118.14
oungimuk.net	335656	2021-02-06	2021-02-10	2023-06-14	986 B	43 kB	139.45.197.251

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-06-14 23:16:04	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-06-14 23:16:04	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-06-14 23:16:04	medium	Client IP	Internal IP	ET DNS Query for .cc TLD

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-06-14	medium	news-gevike.cc
2023-06-14	medium	news-gevike.cc

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	news-gevike.cc/code/backbtn.js	394 B	2023-03-07	2024-07-07
Pretty URL news-gevike.cc/code/backbtn.js IP 193.108.118.14 ASN #61003 GlobalTeleHost Corp. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:17:49 Last Seen2024-07-07 15:59:41 Times Seen352 Hash bc407fada9a52a36e5f8e260a6839502 7c31790842614adcf515d36608975556c41ad06d a0209849109697c52a14dbc041d1d4ff61137f04b2b09531756a03cdd48509f8 Loading...

	megachance1.ru/lander/survey_my/index.html	0 B	2023-03-07	2024-07-27
Pretty URL megachance1.ru/lander/survey_my/index.html IP 45.80.70.203 ASN #198610 Beget LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-07-27 04:10:04 Times Seen41184771 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	news-gevike.cc/code/https.js?uid=136888&site=8054216&banadu=0&sub1=NEWSrv	8.8 kB	2023-03-08	2023-09-17
Pretty URL news-gevike.cc/code/https.js?uid=136888&site=8054216&banadu=0&sub1=NEWSrv IP 193.108.118.14 ASN #61003 GlobalTeleHost Corp. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 16:00:29 Last Seen2023-09-17 08:19:53 Times Seen90 Hash dc75603ed6ab105a27593358ed47dcff e16b5033d5918236203f5a89a9815062fd334003 983cd7c4a1b7da928832f9dbb0c16c4ddc59a45f45947c521dfe7228b49cf434 Loading...

	oungimuk.net/pfe/current/micro.tag.min.js?z=4800093&sw=/sw-check-permissions-f4e9b.js	42 kB	2023-06-02	2023-10-13
Pretty URL oungimuk.net/pfe/current/micro.tag.min.js?z=4800093&sw=/sw-check-permissions-f4e9b.js IP 139.45.197.251 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-02 15:59:24 Last Seen2023-10-13 16:29:22 Times Seen1059 Hash e204f67bb8419861390e10b3622cf6d7 ab1fb1305fb4780c71b851b821d3e083f522ff1a c6f10a8ca367a8e72b3ac96138ac8d1dcaf095cdaa7c5ca0c26b7ea652263eac Loading...

	megachance1.ru/lander/survey_my/index.html	0 B	2023-03-07	2024-07-27
Pretty URL megachance1.ru/lander/survey_my/index.html IP 45.80.70.203 ASN #198610 Beget LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-07-27 04:10:04 Times Seen41184771 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (8)

URL IP Response Size

megachance1.ru/lander/survey_my/index.html

45.80.70.203

200 OK

2.3 kB

URL User Request GET HTTP/1.1
megachance1.ru/lander/survey_my/index.html
IP
45.80.70.203:443
ASN
#198610 Beget LLC

Certificate
IssuerLet's Encrypt
Subjectmegachance1.ru
FingerprintA5:62:8F:DF:F1:74:5E:47:20:AB:45:30:BF:05:A0:2F:7D:43:C7:F6
ValidityWed, 17 May 2023 12:26:46 GMT - Tue, 15 Aug 2023 12:26:45 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text
Size
2.3 kB (2322 bytes)
Hash
3f8ed8f4f420e03311337709b40ff38d
c970b96b3fb3d2c9ccb8d52251129a82416f9a16
9d884aecb1774ee0d839cdc6aef0e871fbd14477f18e2f5af71f1e16856fc81c

HTTP Headers

GET /lander/survey_my/index.html HTTP/1.1
Host: megachance1.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 14 Jun 2023 23:16:05 GMT
Content-Type: text/html
Last-Modified: Wed, 05 Apr 2023 13:04:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"642d71dc-1d3d"
X-Content-Type-Options: nosniff
Content-Encoding: gzip

megachance1.ru/lander/survey_my/index_files/logo.png

45.80.70.203

200 OK

2.2 kB

URL GET HTTP/1.1
megachance1.ru/lander/survey_my/index_files/logo.png
IP
45.80.70.203:443
ASN
#198610 Beget LLC

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerLet's Encrypt
Subjectmegachance1.ru
FingerprintA5:62:8F:DF:F1:74:5E:47:20:AB:45:30:BF:05:A0:2F:7D:43:C7:F6
ValidityWed, 17 May 2023 12:26:46 GMT - Tue, 15 Aug 2023 12:26:45 GMT

File type
PNG image data, 100 x 50, 8-bit/color RGBA, non-interlaced\012- data
Size
2.2 kB (2225 bytes)
Hash
a77bbda7c6eefb17c4e14f22834012f8
150b821c686ab726728d4160390a6f44de06741a
1578aec672dcccd66a4edc3e08c46a154799ebe9a78ae42e48050f6686779234

HTTP Headers

GET /lander/survey_my/index_files/logo.png HTTP/1.1
Host: megachance1.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/lander/survey_my/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 14 Jun 2023 23:16:05 GMT
Content-Type: image/png
Content-Length: 2225
Last-Modified: Wed, 05 Apr 2023 13:04:28 GMT
Connection: keep-alive
ETag: "642d71dc-8b1"
Expires: Sat, 24 Jun 2023 23:16:05 GMT
Cache-Control: max-age=864000
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

news-gevike.cc/code/backbtn.js

193.108.118.14

200 OK

394 B

URL GET HTTP/2
news-gevike.cc/code/backbtn.js
IP
193.108.118.14:443
ASN
#61003 GlobalTeleHost Corp.

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerZeroSSL
Subjectnews-gevike.cc
Fingerprint33:3A:41:E7:BC:F1:7D:A8:BD:9A:C3:89:ED:69:44:38:B5:75:8C:8A
ValiditySun, 14 May 2023 00:00:00 GMT - Sat, 12 Aug 2023 23:59:59 GMT

File type
ASCII text
Size
394 B (394 bytes)
Hash
bc407fada9a52a36e5f8e260a6839502
7c31790842614adcf515d36608975556c41ad06d
a0209849109697c52a14dbc041d1d4ff61137f04b2b09531756a03cdd48509f8

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /code/backbtn.js HTTP/1.1
Host: news-gevike.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 14 Jun 2023 23:16:05 GMT
content-type: application/javascript
content-length: 394
last-modified: Wed, 19 May 2021 12:34:54 GMT
etag: "60a505ee-18a"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2

news-gevike.cc/code/https.js?uid=136888&site=8054216&banadu=0&sub1=NEWSrv

193.108.118.14

200 OK

8.8 kB

URL GET HTTP/2
news-gevike.cc/code/https.js?uid=136888&site=8054216&banadu=0&sub1=NEWSrv
IP
193.108.118.14:443
ASN
#61003 GlobalTeleHost Corp.

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerZeroSSL
Subjectnews-gevike.cc
Fingerprint33:3A:41:E7:BC:F1:7D:A8:BD:9A:C3:89:ED:69:44:38:B5:75:8C:8A
ValiditySun, 14 May 2023 00:00:00 GMT - Sat, 12 Aug 2023 23:59:59 GMT

File type
ASCII text, with very long lines (8843), with no line terminators
Size
8.8 kB (8843 bytes)
Hash
dc75603ed6ab105a27593358ed47dcff
e16b5033d5918236203f5a89a9815062fd334003
983cd7c4a1b7da928832f9dbb0c16c4ddc59a45f45947c521dfe7228b49cf434

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /code/https.js?uid=136888&site=8054216&banadu=0&sub1=NEWSrv HTTP/1.1
Host: news-gevike.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 14 Jun 2023 23:16:05 GMT
content-type: application/javascript
content-length: 8843
last-modified: Mon, 14 Nov 2022 07:54:15 GMT
etag: "6371f427-228b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
X-Firefox-Spdy: h2

megachance1.ru/favicon.ico

45.80.70.203

404 Not Found

146 B

URL GET HTTP/1.1
megachance1.ru/favicon.ico
IP
45.80.70.203:443
ASN
#198610 Beget LLC

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerLet's Encrypt
Subjectmegachance1.ru
FingerprintA5:62:8F:DF:F1:74:5E:47:20:AB:45:30:BF:05:A0:2F:7D:43:C7:F6
ValidityWed, 17 May 2023 12:26:46 GMT - Tue, 15 Aug 2023 12:26:45 GMT

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: megachance1.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/lander/survey_my/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 14 Jun 2023 23:16:05 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

oungimuk.net/zone?&pub=0&zone_id=4800093&is_mobile=false&domain=megachance1.ru&var=&ymid=&var_3=&var_4=&dsig=&action=prerequest

139.45.197.251

200 OK

0 B

URL POST HTTP/2
oungimuk.net/zone?&pub=0&zone_id=4800093&is_mobile=false&domain=megachance1.ru&var=&ymid=&var_3=&var_4=&dsig=&action=prerequest
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerLet's Encrypt
Subjectoungimuk.net
FingerprintB5:D5:BF:00:7F:18:31:13:AA:49:DF:C7:2E:C9:A6:8F:6E:D3:6C:CE
ValidityMon, 17 Apr 2023 05:17:56 GMT - Sun, 16 Jul 2023 05:17:55 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /zone?&pub=0&zone_id=4800093&is_mobile=false&domain=megachance1.ru&var=&ymid=&var_3=&var_4=&dsig=&action=prerequest HTTP/1.1
Host: oungimuk.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://megachance1.ru
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 14 Jun 2023 23:16:05 GMT
content-length: 0
x-trace-id: 2203480ae793f90a2c9821d36aef4eb1
access-control-allow-origin: https://megachance1.ru
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2

megachance1.ru/sw-check-permissions-f4e9b.js

45.80.70.203

200 OK

566 B

URL GET HTTP/1.1
megachance1.ru/sw-check-permissions-f4e9b.js
IP
45.80.70.203:443
ASN
#198610 Beget LLC

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerLet's Encrypt
Subjectmegachance1.ru
FingerprintA5:62:8F:DF:F1:74:5E:47:20:AB:45:30:BF:05:A0:2F:7D:43:C7:F6
ValidityWed, 17 May 2023 12:26:46 GMT - Tue, 15 Aug 2023 12:26:45 GMT

File type
Java source, ASCII text
Size
566 B (566 bytes)
Hash
bd13116b6d51d2ac2d7666d6867ec2f5
18b47b72c8f7b2bee56260e7c53b76ca9832eff7
93e056ddfa835cfb93c472164b96fbfdc7c90a3ef92d53de2ac3cf057c78dad1

HTTP Headers

GET /sw-check-permissions-f4e9b.js HTTP/1.1
Host: megachance1.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/lander/survey_my/index.html
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 14 Jun 2023 23:16:05 GMT
Content-Type: application/javascript
Content-Length: 566
Last-Modified: Mon, 17 Jan 2022 11:31:29 GMT
Connection: keep-alive
ETag: "61e55391-236"
Expires: Sat, 24 Jun 2023 23:16:05 GMT
Cache-Control: max-age=864000
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

oungimuk.net/pfe/current/micro.tag.min.js?z=4800093&sw=/sw-check-permissions-f4e9b.js

139.45.197.251

200 OK

42 kB

URL GET HTTP/2
oungimuk.net/pfe/current/micro.tag.min.js?z=4800093&sw=/sw-check-permissions-f4e9b.js
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://megachance1.ru/lander/survey_my/index.html
Certificate
IssuerLet's Encrypt
Subjectoungimuk.net
FingerprintB5:D5:BF:00:7F:18:31:13:AA:49:DF:C7:2E:C9:A6:8F:6E:D3:6C:CE
ValidityMon, 17 Apr 2023 05:17:56 GMT - Sun, 16 Jul 2023 05:17:55 GMT

File type
C source, ASCII text, with very long lines (42013), with no line terminators
Size
42 kB (42013 bytes)
Hash
e204f67bb8419861390e10b3622cf6d7
ab1fb1305fb4780c71b851b821d3e083f522ff1a
c6f10a8ca367a8e72b3ac96138ac8d1dcaf095cdaa7c5ca0c26b7ea652263eac

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=4800093&sw=/sw-check-permissions-f4e9b.js HTTP/1.1
Host: oungimuk.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://megachance1.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 14 Jun 2023 23:16:05 GMT
content-type: application/javascript
last-modified: Tue, 13 Jun 2023 08:57:42 GMT
etag: W/"64882f86-a41d"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (8)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2