WEBSITE ANALYSIS REPORT

http://sha.work.gd/

03 Jul 2026 · 05:04:44.000 UTCpublic

Report tags: dyndns
Submit tags

Request review

Suspicious activity

13 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

05:04:20.851 GET No response document 0 B 0 ms 4 alerts

05:04:21.140 GET 200 document 68.3 KB 1432 ms 4 alerts

05:04:22.730 GET 200 stylesheet 30.3 KB 428 ms 1 alerts

05:04:22.732 GET 200 stylesheet 80.8 KB 601 ms 1 alerts

05:04:22.734 GET 200 stylesheet 10.5 KB 87 ms —

05:04:22.736 GET 200 script 85.5 KB 582 ms 1 alerts

05:04:22.737 GET 200 script 13.3 KB 412 ms 1 alerts

05:04:22.738 GET 403 script 0 B 506 ms 1 alerts

05:04:22.748 GET 200 img 9.6 KB 1599 ms 1 alerts

05:04:22.750 GET 200 img 13.5 KB 727 ms 1 alerts

05:04:22.751 GET 200 img 18.0 KB 734 ms 1 alerts

Transaction #16

Request / response

URL

GET HTTP

http://shaa.hair/wp-content/uploads/2026/05/jolies-libertines-prises-en-partouze.jpg

IP / ASN

70.36.99.213

AS22439 · PERFECT-INTERNATIONAL

Requested by: http://sha.work.gd/

Resource information

File type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 288x162, components 3
MIME type: image/jpeg
First seen (UTC): 17 Jun 2026 · 11:54:22.272 UTC
Last seen (UTC): 03 Jul 2026 · 05:04:50.884 UTC
Times seen: 3

Size: 18.0 KB (18445 bytes)
MD5: 9225369f30e3146fd39a84079c809178
SHA1: 01511d031d49663bae626e316454ecf1b48b0570
SHA256: 1b2257b2b0502da8e56e51d3f8157157080daf02fe09ddfe625002afdacc69f3

Certificate information

Certificate and TLS information not recorded.

Technology fingerprints

Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
OpenDNS Content Category / Application Block	medium	Suspicious

HTTP headers

Request headers

GET /wp-content/uploads/2026/05/jolies-libertines-prises-en-partouze.jpg HTTP/1.1
Host: shaa.hair
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate
Sec-GPC: 1
Connection: keep-alive
Referer: http://sha.work.gd/
Priority: u=5, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 03 Jul 2026 05:04:23 GMT
Content-Type: image/jpeg
Last-Modified: Fri, 22 May 2026 15:31:46 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6a1076e2-480d"
Expires: Sun, 02 Aug 2026 05:04:23 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip

05:04:22.753 GET 200 img 13.7 KB 733 ms 1 alerts

05:04:22.754 GET 200 img 22.5 KB 906 ms 1 alerts

05:04:22.755 GET 200 img 13.0 KB 729 ms 1 alerts

05:04:22.756 GET 200 img 22.6 KB 893 ms 1 alerts

05:04:22.757 GET 200 img 23.2 KB 734 ms 1 alerts

05:04:22.758 GET 200 img 17.4 KB 897 ms 1 alerts

05:04:22.759 GET 200 img 21.1 KB 907 ms 1 alerts

05:04:22.760 GET 200 img 17.2 KB 905 ms 1 alerts

05:04:22.761 GET 200 img 18.0 KB 906 ms 1 alerts

05:04:22.761 GET 200 img 17.2 KB 1060 ms 1 alerts

05:04:22.762 GET 200 img 14.6 KB 1065 ms 1 alerts

05:04:22.764 GET 200 img 11.3 KB 1078 ms 1 alerts

05:04:22.764 GET 200 img 21.1 KB 1078 ms 1 alerts

05:04:22.765 GET 200 img 16.5 KB 1078 ms 1 alerts

05:04:22.766 GET 200 img 20.6 KB 1078 ms 1 alerts

05:04:22.767 GET 200 img 18.8 KB 1226 ms 1 alerts

05:04:22.768 GET 200 img 21.3 KB 1234 ms 1 alerts

05:04:22.769 GET 200 img 23.4 KB 1250 ms 1 alerts

05:04:22.779 GET 403 script 0 B 792 ms 4 alerts

05:04:22.780 GET 403 script 0 B 398 ms 4 alerts

05:04:22.781 GET 200 script 41.0 KB 378 ms 1 alerts

05:04:22.783 GET 200 script 683 B 375 ms 1 alerts

05:04:22.788 GET 403 script 0 B 491 ms 1 alerts

05:04:22.789 GET 403 script 0 B 414 ms 1 alerts

05:04:22.791 GET 200 img 13.5 KB 1222 ms 1 alerts

05:04:22.792 GET 200 img 18.4 KB 1222 ms 1 alerts

05:04:22.793 GET 200 img 17.2 KB 1222 ms 1 alerts

05:04:22.794 GET 200 img 14.2 KB 1365 ms 1 alerts

05:04:22.795 GET 200 img 18.6 KB 1394 ms 1 alerts

05:04:22.795 GET 200 img 16.6 KB 1373 ms 1 alerts

05:04:22.796 GET 200 img 17.5 KB 1394 ms 1 alerts

05:04:22.797 GET 200 img 17.6 KB 1395 ms 1 alerts

05:04:22.798 GET 200 img 14.7 KB 1395 ms 1 alerts

05:04:22.799 GET 200 img 17.9 KB 1542 ms 1 alerts

05:04:22.800 GET 200 img 18.1 KB 1566 ms 1 alerts

05:04:22.801 GET 200 img 9.4 KB 1566 ms 1 alerts

05:04:23.360 GET 403 script 0 B 104 ms 1 alerts

05:04:23.441 GET 200 font 13.1 KB 333 ms 1 alerts

05:04:23.443 GET 200 font 42.1 KB 80 ms —

http://sha.work.gd/

Domain graph

Hostnames

Connections

Network requests

Transaction #16

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://sha.work.gd/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #16

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://sha.work.gd/

Domain graph

Network requests