| www.googletagmanager.com/gtag/js?id=G-RPX0GYJ7KN |  142.250.74.168 | 200 OK | 101 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=G-RPX0GYJ7KN IP142.250.74.168:443
CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52 ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT
File typeJavaScript source, ASCII text, with very long lines (5945) Size101 kB (100713 bytes) Hash6c33451ea566870b117cc208354cd5a9 356f184156b043b157788513180412a34c326772 8d5dc758804f9c92e32e9d6d53ca3fbfd5ac8d5baa42085a43f74a2b95b0f7d3
GET /gtag/js?id=G-RPX0GYJ7KN HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 10:39:40 GMT
expires: Fri, 26 Apr 2024 10:39:40 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 100713
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15744, version 1.0 Hash15d9f621c3bd1599f0169dcf0bd5e63e 7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52 f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:02:10 GMT
expires: Sat, 26 Apr 2025 06:02:10 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 16651
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| goo.by/detroitchicago/imp.gif?ez_orig=1 |  104.21.86.233 | 200 OK | 43 B |
URL POST HTTP/3goo.by/detroitchicago/imp.gif?ez_orig=1 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeGIF image data, version 89a, 1 x 1 Hashf837aa60b6fe83458f790db60d529fc9 14af87ccec7f81bb28d53c84da2fd5a9d5925cda dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /detroitchicago/imp.gif?ez_orig=1 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain
Content-Length: 873
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: image/gif
content-length: 43
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Type
access-control-allow-methods: GET, POST, PUT, OPTIONS, HEAD, PUT, POST, GET, OPTIONS
access-control-allow-origin: https://goo.by, https://goo.by
access-control-max-age: 1728000, 1728000
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
expires: Thu, 25 Apr 2024 10:39:40 GMT
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-middleton-display: imp_sol
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QhtrCU8PZ9PA97ZYvouAVI%2BTXIZr5fsJIxY5i%2Bw0H5XY%2BFBXy5%2ByfDMjjfhJJnWHmELz9aIEVw4cgqGVQEK4Mgs%2FMTH43SLikVg8g5cBpXNbaBSl1648eEs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f34a3c48569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js | 142.250.74.131 | 200 OK | 206 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js IP142.250.74.131:443
Requested byhttps://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeJavaScript source, ASCII text, with very long lines (631) Size206 kB (205803 bytes) Hashe2e79d6b927169d9e0e57e3baecc0993 1299473950b2999ba0b7f39bd5e4a60eafd1819d 231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b
GET /recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 205803
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:07:40 GMT
expires: Sat, 26 Apr 2025 06:07:40 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 16321
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| goo.by/static/frontend/libs/fontawesome/all.min.css | 104.21.86.233 | 200 OK | 26 kB |
URL GET HTTP/3goo.by/static/frontend/libs/fontawesome/all.min.css IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeASCII text, with very long lines (52276) Hash9a99091cf45671ab2ee178fc3896a494 043f09bf20c5478aaca2abb5b3f4b034a20cca6a 58fdbb37ecb0c8a4d514714e322edef085c1f9d71e703b3925b054437f446166
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/libs/fontawesome/all.min.css HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=1800
display: staticcontent_sol, orig_site_sol
etag: W/"64dbe750-18efb-gzip"
last-modified: Tue, 15 Aug 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-ezoic-cdn: Hit ds;mm;704649e0e1e9c08c53444dcbbee4545a;2-499726-3;75a9b8d7-838f-43a3-7e76-8879b8b54760
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control:
x-sol: orig
cf-cache-status: HIT
age: 1229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Omx1WWjefuvHm1GFdP12TpnzhiTBh3wQ5E0Qa6s2Ytk5P33s3ahjNN3f00tmqSOI0CkkMBQ8Zyg0t%2FTBaxUW9vnHu%2FbkrfYryZRaO8Ec1pDJk2%2FYqTYuPoo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfa6569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/detroitchicago/wichita.js?gcb=195-0&cb=12 | 104.21.86.233 | 200 OK | 9.4 kB |
URL GET HTTP/3goo.by/detroitchicago/wichita.js?gcb=195-0&cb=12 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (2642), with no line terminators Hash5400d57d3c99621a705f935a7f03be29 b1bebf7179d6fbcf789eae5bbe363e0e25245669 1d7a77f24fc31abf310ccb240b2e0a49f2582823f990eef11a3abc37f286ea12
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /detroitchicago/wichita.js?gcb=195-0&cb=12 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EJsRXsAl5jnEoXd1GoeVMTaV%2FcfZ3vjP%2FuM6qAaHIWx6pegs7Tg1yaCi4YU1RTUZ%2BFGKqFPkWqEEwuadYbdu3Ft1ZriM9ZIV202QDvM8%2FRDtAvCXRXXQ%2Fzg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3489af8569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/detroitchicago/raleigh.js?gcb=195-0&cb=7 | 104.21.86.233 | 200 OK | 16 kB |
URL GET HTTP/3goo.by/detroitchicago/raleigh.js?gcb=195-0&cb=7 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (1660), with no line terminators Hash42639702af49d736558389d95dd4790a 6deb088e5b413a086dd9a911a1661da38c006df1 9fba7686001b516b0414bef328255eca729f278c1d14d324c8567733426439a5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /detroitchicago/raleigh.js?gcb=195-0&cb=7 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=1673
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Spfc4xxJXZ4uFyFzFt5HRD%2FBP7tSgmnuaaNSH9NPvSAcynIN%2BrRjttNFAEnOMtyJweXRznk9J5HIm8hrT%2F0gQ6EVA1CD2SYX7yyqyiL0lVIM1VawUHkfVdQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3489afa569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/fonts/ProductSansBold.woff2 | 104.21.86.233 | 200 OK | 24 kB |
URL GET HTTP/3goo.by/static/frontend/fonts/ProductSansBold.woff2 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 20076, version 1.0 Hash803540b94e915a0b7f4ad98bd177b677 7b819f8de9115979cfa2d63324e21ec6467d36ce 3d0a3b3262dbd7992c0a1269e7cbc7c7a5b5fe5a237ee71ce74a3fd7948a2345
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/fonts/ProductSansBold.woff2 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://goo.by/static/frontend/css/main-style.css?127
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: font/woff2
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: "6499fc50-4e6c-gzip"
last-modified: Mon, 26 Jun 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol
x-middleton-response: 200
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rZFDBP0HwwThW6a38hO9l6l6PzLhB73vnCyvbCJ6L6kesybdOvyulkUkQy0BK7yPShdKOkRqMkQeHAwrRrcfb%2BTvOwfwJ4%2FMm8XVIetqSRqqIHkUF22txLw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3493b7b569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is | 142.250.74.164 | 200 OK | 53 kB |
URL GET HTTP/3www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is IP142.250.74.164:443
CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint01:16:A3:AE:CA:C9:AC:ED:3A:C9:AA:75:BE:C2:51:EF:65:CE:23:E1 ValidityMon, 08 Apr 2024 06:34:56 GMT - Mon, 01 Jul 2024 06:34:55 GMT
File typeHTML document, ASCII text, with very long lines (37743) Hash4d51320c7016980c0cce1caca944b38a daf6e911b9c6a540deeef2af91b3799c882183f0 260fefa23e1aae0137d9f1f887b63db76b15203ceb296a81a9f8cc691c5cdf60
GET /recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 26 Apr 2024 10:39:41 GMT
content-security-policy: script-src 'nonce-BFsWEvcYzHSMDIvkOf7LrQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js | 142.250.74.131 | 200 OK | 206 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js IP142.250.74.131:443
Requested byhttps://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeJavaScript source, ASCII text, with very long lines (631) Size206 kB (205803 bytes) Hashe2e79d6b927169d9e0e57e3baecc0993 1299473950b2999ba0b7f39bd5e4a60eafd1819d 231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b
GET /recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 205803
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:07:40 GMT
expires: Sat, 26 Apr 2025 06:07:40 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 16321
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| the.gatekeeperconsent.com/cmp/v2/main_modal_firstpage?domain=goo.by®ion=default&lang=en-US&cb=195&changeLogId=563182 | 104.21.42.32 | 200 OK | 0 B |
URL GET HTTP/3the.gatekeeperconsent.com/cmp/v2/main_modal_firstpage?domain=goo.by®ion=default&lang=en-US&cb=195&changeLogId=563182 IP104.21.42.32:443
CertificateIssuerGoogle Trust Services LLC Subjectgatekeeperconsent.com Fingerprint5C:4E:1D:E7:D3:4B:2C:22:CF:AC:5E:4A:B4:AD:5C:05:EF:BD:E1:B0 ValidityThu, 25 Apr 2024 18:00:16 GMT - Wed, 24 Jul 2024 18:00:15 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /cmp/v2/main_modal_firstpage?domain=goo.by®ion=default&lang=en-US&cb=195&changeLogId=563182 HTTP/1.1
Host: the.gatekeeperconsent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://goo.by/
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:42 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://goo.by
access-control-max-age: 1728000
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cjP7ZDn89GgcrCU1BWCMLrOvu57fYxNzOw%2FMRKHnUOCT1gRSKfMLdSY1U9i1Ox9leP3bNJONGPC8VhVvf%2FhWAqAP5t30dFKozoYP1RZB7%2Fdj18%2F%2FD3TIFB7fotmZKqf%2F4Aj73AGB79fti%2FHM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f34f8986b4ff-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/css/owl.carousel.min.css | 104.21.86.233 | 200 OK | 16 kB |
URL GET HTTP/3goo.by/static/frontend/css/owl.carousel.min.css IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeASCII text, with very long lines (3184) Hashb2752a850d44f50036628eeaef3bfcfa fba46353cf90450ef3d362a123f1e7af3e8c561e 521410e1fc44780061e09adc980275fb5ea277fd5d9e538454214ec4379ff4bc
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/css/owl.carousel.min.css HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"5fff5f50-d17-gzip"
last-modified: Wed, 13 Jan 2021 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TLGLFXsOXAyYdYelAOpT%2Fd1dNLR8DH4JsmdZ89dk%2F5dsUBfpVlzLrPnHYrh0fhak45lwbgqieHG1QAKj0g29RTQ9I5DT3MqZE0bd56SHFCriV%2BnngNpJvRU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfac569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 IP216.58.207.227:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15552, version 1.0 Hash285467176f7fe6bb6a9c6873b3dad2cc ea04e4ff5142ddd69307c183def721a160e0a64e 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 17:25:07 GMT
expires: Fri, 25 Apr 2025 17:25:07 GMT
cache-control: public, max-age=31536000
age: 62075
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m | 142.250.74.164 | 200 OK | 7.5 kB |
URL GET HTTP/3www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m IP142.250.74.164:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint01:16:A3:AE:CA:C9:AC:ED:3A:C9:AA:75:BE:C2:51:EF:65:CE:23:E1 ValidityMon, 08 Apr 2024 06:34:56 GMT - Mon, 01 Jul 2024 06:34:55 GMT
Hashfc7a74c44524ecb01fed5861379a4cf3 5d6544bcd2b6b83a8578c589283bbe92b9213db1 b95e712eb9a5e2c9fa28b75fd4d38ff014fe1a83b16653571eeb91e7d5ee8916
GET /recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: text/javascript; charset=utf-8
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 26 Apr 2024 10:39:42 GMT
date: Fri, 26 Apr 2024 10:39:42 GMT
cache-control: private, max-age=300
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.gstatic.com/recaptcha/api2/logo_48.png | 142.250.74.131 | 200 OK | 2.2 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/api2/logo_48.png IP142.250.74.131:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typePNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced Hashef9941290c50cd3866e2ba6b793f010d 4736508c795667dcea21f8d864233031223b7832 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
GET /recaptcha/api2/logo_48.png HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 2228
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 17:35:26 GMT
expires: Thu, 02 May 2024 17:35:26 GMT
cache-control: public, max-age=604800
age: 61456
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js | 142.250.74.131 | 200 OK | 206 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js IP142.250.74.131:443
Requested byhttps://www.google.com/recaptcha/api2/webworker.js?hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeJavaScript source, ASCII text, with very long lines (631) Size206 kB (205803 bytes) Hashe2e79d6b927169d9e0e57e3baecc0993 1299473950b2999ba0b7f39bd5e4a60eafd1819d 231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b
GET /recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 205803
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:07:40 GMT
expires: Sat, 26 Apr 2025 06:07:40 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 16322
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.google.com/recaptcha/api2/clr?k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw | 142.250.74.164 | 200 OK | 0 B |
URL POST HTTP/3www.google.com/recaptcha/api2/clr?k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw IP142.250.74.164:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint01:16:A3:AE:CA:C9:AC:ED:3A:C9:AA:75:BE:C2:51:EF:65:CE:23:E1 ValidityMon, 08 Apr 2024 06:34:56 GMT - Mon, 01 Jul 2024 06:34:55 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /recaptcha/api2/clr?k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-protobuf
Content-Length: 1458
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is
Cookie: _GRECAPTCHA=09AEdsM9OIKcJ9FgGlSFlyD5nn9mtWL4Shd9nbYzJmMW3LaFMqDqwNv4QX3k1B0xnYtCtyenEvaZ3NHLRMV5YU3bw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/binary
date: Fri, 26 Apr 2024 10:39:43 GMT
expires: Fri, 26 Apr 2024 10:39:43 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 0
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| goo.by/detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiIzMTgifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjQ2OSJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiMjgifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiODI1In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiODc2In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjIwMDkifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjEyMTIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6InZpZXdwb3J0X3NpemUiLCJ2YWwiOiIxMjgweDEwMjQifSx7Im5hbWUiOiJ2aWV3cG9ydF9weCIsInZhbCI6IjEzMTA3MjAifSx7Im5hbWUiOiJkb2NfcHgiLCJ2YWwiOiI0NzYxNjAwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjM3MjAifV19XQ== | 104.21.86.233 | 204 No Content | 0 B |
URL POST HTTP/3goo.by/detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiIzMTgifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjQ2OSJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiMjgifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiODI1In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiODc2In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjIwMDkifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjEyMTIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6InZpZXdwb3J0X3NpemUiLCJ2YWwiOiIxMjgweDEwMjQifSx7Im5hbWUiOiJ2aWV3cG9ydF9weCIsInZhbCI6IjEzMTA3MjAifSx7Im5hbWUiOiJkb2NfcHgiLCJ2YWwiOiI0NzYxNjAwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjM3MjAifV19XQ== IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoicGVyZl9pc190cmFja2VkIiwidmFsIjoiMSJ9LHsibmFtZSI6InBlcmZfbmF2X3RvX2Nvbm5lY3QiLCJ2YWwiOiIzMTgifSx7Im5hbWUiOiJwZXJmX2Nvbm5lY3RfdG9fcmVzcF9zdGFydCIsInZhbCI6IjQ2OSJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiMjgifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiODI1In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiODc2In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjIwMDkifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjEyMTIifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX2NvdW50IiwidmFsIjoiMCJ9LHsibmFtZSI6InZpZXdwb3J0X3NpemUiLCJ2YWwiOiIxMjgweDEwMjQifSx7Im5hbWUiOiJ2aWV3cG9ydF9weCIsInZhbCI6IjEzMTA3MjAifSx7Im5hbWUiOiJkb2NfcHgiLCJ2YWwiOiI0NzYxNjAwIn0seyJuYW1lIjoiZG9jX2hlaWdodCIsInZhbCI6IjM3MjAifV19XQ== HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0; _ga_RPX0GYJ7KN=GS1.1.1714127981.1.0.1714127981.0.0.0; _ga=GA1.1.2075027178.1714127981
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
TE: trailers
HTTP/3 204 No Content
date: Fri, 26 Apr 2024 10:39:48 GMT
access-control-allow-origin: https://goo.by
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
expires: Thu, 25 Apr 2024 10:39:48 GMT
vary: Accept-Encoding
x-middleton-display: ezp_sol
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f16Vk7OYvNm5TBd7YBi1PX4ZcS%2BUIaNUBgvzCqrLkfPRlS6u7roGXXdURFpSH8o%2BHTkR0E2XdWbqlirkvatyTtK3KDp1Mu9tiyOsZ8oIG1jRRs6fciznJ6M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3794b7c569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| the.gatekeeperconsent.com/cmp/gvl.json?v=9&lang=en-us | 104.21.42.32 | 200 OK | 79 kB |
URL GET HTTP/3the.gatekeeperconsent.com/cmp/gvl.json?v=9&lang=en-us IP104.21.42.32:443
CertificateIssuerGoogle Trust Services LLC Subjectgatekeeperconsent.com Fingerprint5C:4E:1D:E7:D3:4B:2C:22:CF:AC:5E:4A:B4:AD:5C:05:EF:BD:E1:B0 ValidityThu, 25 Apr 2024 18:00:16 GMT - Wed, 24 Jul 2024 18:00:15 GMT
Hashcaae9ab552ddb2d60cd364f1d333f309 7adb65e4128a24e736207b7935acefa037cc283b b418df310c1df3c37ededd519788d59de0a7225b787d5264a144db97127d3ff0
GET /cmp/gvl.json?v=9&lang=en-us HTTP/1.1
Host: the.gatekeeperconsent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=345600
last-modified: Mon, 22 Apr 2024 04:36:19 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 239899
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zItu8JDt8YF5AkPtliHmh6HfrDel3KLg0jR1s4Tj7H%2FeqKnYW4JoU41hb0lt6r5mn0Z%2BvBLviUawa7cXQtXwzt0mJqliKgEwTTAYw6HXalQA6y4oDjQbUZR57LEMBiGzPlZwzYk4v4cLMxlq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f34ec8f1b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoidF91bmxvYWQiLCJ2YWwiOiIxNzE0MTI4MDA2NjY0In1dfV0= | 104.21.86.233 | | 0 B |
URL goo.by/detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoidF91bmxvYWQiLCJ2YWwiOiIxNzE0MTI4MDA2NjY0In1dfV0= IP104.21.86.233:0
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoidF91bmxvYWQiLCJ2YWwiOiIxNzE0MTI4MDA2NjY0In1dfV0= HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0; _ga_RPX0GYJ7KN=GS1.1.1714127981.1.0.1714127981.0.0.0; _ga=GA1.1.2075027178.1714127981
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
TE: trailers
HTTP/3 204 No Content
date: Fri, 26 Apr 2024 10:40:06 GMT
access-control-allow-origin: https://goo.by
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
expires: Thu, 25 Apr 2024 10:40:07 GMT
vary: Accept-Encoding
x-middleton-display: ezp_sol
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2FzX7HprqskbGYTLc0dmm4b%2FSVkR3GdJWg9q3zTE0fxVQoq%2BOxR92Z6qN1nm3UisWzq9Th2TqSqYHsSK94d57lF409DRQCnBUXM%2BOA42tYBUIFx9y5VhsuE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3ea4aca569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css | 142.250.74.131 | 200 OK | 56 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css IP142.250.74.131:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeASCII text, with very long lines (56412), with no line terminators Hash2c00b9f417b688224937053cd0c284a5 17b4c18ebc129055dd25f214c3f11e03e9df2d82 1e754b107428162c65a26d399b66db3daaea09616bf8620d9de4bc689ce48eed
GET /recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/styles__ltr.css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 24617
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:04:29 GMT
expires: Sat, 26 Apr 2025 06:04:29 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
content-type: text/css
vary: Accept-Encoding
age: 16512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 15 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15344, version 1.0 Hash5d4aeb4e5f5ef754e307d7ffaef688bd 06db651cdf354c64a7383ea9c77024ef4fb4cef8 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:01:56 GMT
expires: Sat, 26 Apr 2025 06:01:56 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
age: 16666
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| goo.by/static/frontend/css/reset.css?v37 | 104.21.86.233 | 200 OK | 666 kB |
URL GET HTTP/3goo.by/static/frontend/css/reset.css?v37 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Size666 kB (666309 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/css/reset.css?v37 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"64e3d050-a2ac5-gzip"
last-modified: Mon, 21 Aug 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oL0njg%2FSRIsStbbJ3EGHE82nWGHYnvuOq8Ny46MfcLD%2F8H%2F39RQ440NVy4hSi7Qv%2FtEgfNtlG4b4604iDiygj9KT5LU8T8XoZjCgSPHzI5St1oTm%2ByjUF1o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfaa569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/detroitchicago/boise.js?gcb=195-0&cb=5 | 104.21.86.233 | 200 OK | 811 B |
URL GET HTTP/3goo.by/detroitchicago/boise.js?gcb=195-0&cb=5 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (831), with no line terminators Hashec7dc8454cd6da38d6e52db724877f67 ffd9dca1b2fc7259cf71aea56246dd39d96d4633 727c617ebd9f3c96346de779d92e2b309168d2f052a16907bb67f7b9c2f8c98a
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /detroitchicago/boise.js?gcb=195-0&cb=5 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=824
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5KGyhAtlZOQlZelQrJWb%2BSblQekSg8LcyocMzv5K52iXx1eRYpiYoi4Rp1gobxbfr87ksVqxiI4v4mSijs5tgC3Z89Jz44XDluXX5gRXcf2ok4OkKctguZg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3486ac3569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| the.gatekeeperconsent.com/v2/cmp.js?v=195 | 172.67.199.186 | 200 OK | 149 kB |
URL GET HTTP/2the.gatekeeperconsent.com/v2/cmp.js?v=195 IP172.67.199.186:443
CertificateIssuerGoogle Trust Services LLC Subjectgatekeeperconsent.com Fingerprint5C:4E:1D:E7:D3:4B:2C:22:CF:AC:5E:4A:B4:AD:5C:05:EF:BD:E1:B0 ValidityThu, 25 Apr 2024 18:00:16 GMT - Wed, 24 Jul 2024 18:00:15 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size149 kB (149131 bytes) Hash1ef1eefb3aec03ae4bb9b62d8ea293d7 19ace9960cfc61df36d52e15b5ffa435bddeb7cb f1265b079b8ad692aaa28540ab372c01a32fb5dedc8d76943375bc1797bfce3c
GET /v2/cmp.js?v=195 HTTP/1.1
Host: the.gatekeeperconsent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=15780000
cf-bgj: minify
last-modified: Tue, 02 Apr 2024 16:15:39 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 2049299
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=enljmyJ7X4OYQ6EjydZu9VYp2AGm9yJuYYnfyWyT2vpcomcngGsHtBF%2FSiGJePGLL59yB6Ibn2chDwifz2w3NML%2B6C7ea%2BL5VaKmuQnKl7HK00Xrm67EGFiXEBkBH%2FzsJKhX7LX2lV91mzdj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345df0d568e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| goo.by/static/frontend/js/app.min.js?v=1.2 | 104.21.86.233 | 200 OK | 5.9 kB |
URL GET HTTP/3goo.by/static/frontend/js/app.min.js?v=1.2 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (6152), with no line terminators Hash340b143eaf138cbe01808df36623ba17 12028e27b21f2b30dcc8bd5b348e2f9376c23f1e b814997885c4d027fedde3afd5908840303e4fe6d3bbfd9aaebf75ac8c133e4f
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/js/app.min.js?v=1.2 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"64e3d050-16fe-gzip"
last-modified: Mon, 21 Aug 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yc7EHEpjKrE4viAyDmooaAeBQDiTqNjg2k1ICWEvgJp8lAbC6U6oTpMLCDKkkGD5znByCjXJO8kcM3fqynSLxC0UTeIaDYI%2FHwVYIKiUV7M96W2RzQKHdrE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3460fef569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/server.min.js?v=1.2 | 104.21.86.233 | 200 OK | 6.6 kB |
URL GET HTTP/3goo.by/static/server.min.js?v=1.2 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (7046), with no line terminators Hash0a7bfcd3308ada0e0eb19e29427c9859 7e142a0e9b4a53ffaca9d179951d5f99595d6187 30827a3ed3786a2598f121c3a6395acc4ec2da76fe2e9678a8237c42e946fe15
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/server.min.js?v=1.2 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"65b4fe14-19f0-gzip"
last-modified: Sat, 27 Jan 2024 12:59:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gZjl4O9yJpDLdKzXt2dm4R3aM%2FCbu1jq1JrGwsa3r0vQhG9d8rnYRXyepnkvMkSnsgzFEWdt9%2FH3K%2FN9wT2DiaylouxgRN18o4uHeArYLrhHTtT94pNcERA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3461801569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/favicon.ico | 104.21.86.233 | 200 OK | 15 kB |
IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeMS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel Hashbbb398f1a44d5bddb9bf3ef50133cba4 13832932e0a46129cf7263130aaa9d8be2609689 6668e0b78f5c65698c0a3a3e48d447f4d703609a774cacabda1ef7ad143a529b
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: image/x-icon
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: W/"6230fe50-3aee-gzip"
last-modified: Tue, 15 Mar 2022 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol
x-middleton-response: 200
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V6Yr0mYeAiunibv%2FihqpsevOycn3JdHtOV8%2FtEw499Xy72t16SlpILlSKU7l6pDfdv775cgc4vgRKPBpcZlkLBsPqWDbTxwnJ%2BzL5cS8yPYo%2FAmFTdIJmS4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f34a7c76569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/content/blog/bitly-login.png | 104.21.86.233 | 200 OK | 22 kB |
URL GET HTTP/3goo.by/content/blog/bitly-login.png IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 720x300, Scaling: [none]x[none], YUV color, decoders should clamp Hash6ad3217aa17e1c0ad8717d528f330b16 20492c02c34a210724c5751de6f09787ce64e42f 317b1cca01ccb8062d197bf63dff9fe49c613e1c2f18eee0f8526eb46b7de905
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /content/blog/bitly-login.png HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: image/webp
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: "6597be08-12bf2-gzip"
last-modified: Fri, 05 Jan 2024 08:30:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,X-Ezoic-Excludewebp,Origin
x-ezoic-cdn: Hit ds;mm;590b5f82ab42c7483fbed348a9944409;2-499726-3;fe95c493-1a1d-4c92-5a34-4cddd5a4af8b
x-ezoic-excludewebp: false
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-origin-cache-control:
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Q01rnO18JMYk5yXFRo%2FF%2FrGLdzYycICtaIc6U%2BC1SFPuysCJmdl9%2BITSDOlxZwD7dMYASXvHsB3mAVtQfdTM9rIlw3A%2B2inLTeUSvpUu8TxxNpKmY1p1lI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345efd9569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/content/blog/google-link-shortener.png | 104.21.86.233 | 200 OK | 34 kB |
URL GET HTTP/3goo.by/content/blog/google-link-shortener.png IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 720x300, Scaling: [none]x[none], YUV color, decoders should clamp Hash2bb13f6e4ef18ba7229505d6e01e7a6b 69833ccd9d8cf40829e09cce6297c2ba4eecc8b3 aacfe11a71e274efc763541830dd5872deafdccb78cd79fa46bb88463839cd01
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /content/blog/google-link-shortener.png HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: image/webp
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: "6553b618-1a07b-gzip"
last-modified: Tue, 14 Nov 2023 18:02:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,X-Ezoic-Excludewebp,Origin
x-ezoic-cdn: Miss
x-ezoic-excludewebp: false
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-origin-cache-control:
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yM7UzsTSsWLOceuMRcBxrTC24IdMCigJnhz9lB59QkH5gqxW2%2FenIHDm1E%2BsxI2WR3J4w%2Bt3VBIg2KzM0Io5IrkmKdYyMMFkev9aLwPTquZrjoVgXld28Fo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345efd2569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/bundle.pack.js | 104.21.86.233 | 200 OK | 332 kB |
URL GET HTTP/3goo.by/static/bundle.pack.js IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Size332 kB (331782 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/bundle.pack.js HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
cf-bgj: minify
cf-polished: origSize=331817
display: staticcontent_sol, orig_site_sol
etag: W/"6179bdd0-51029-gzip"
last-modified: Wed, 27 Oct 2021 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: HIT
age: 264
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cca%2F%2FNBe0k8daxx70yFNeeDvgKzA2nclVmchbAQsrhwdrMW%2Bq%2FKl%2F2H7fmQqTXX8TY4Mono2jvJ%2F%2BH37jYz0ui%2Bj2LtkmEeftlFmqDQDwyJy9vJ%2B707I8Hk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3460fe8569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/libs/typedjs/typed.min.js | 104.21.86.233 | 200 OK | 12 kB |
URL GET HTTP/3goo.by/static/frontend/libs/typedjs/typed.min.js IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (11549) Hashf68641147185cbded4b38b4900a20f40 e8ce2b674a637b0c0396a3106c1aedf10186249c 39b5f0a136ac9c139981b89e2ee615ac75fed86c0761c7ebf87d827be7d86e5e
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/libs/typedjs/typed.min.js HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"63d046d0-2de9-gzip"
last-modified: Tue, 24 Jan 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dDL6%2BEOkTZ%2BF6F0WoaF80VtaY81e1XaEi5p2CPcWIf92lsR4hqvigMFBuPJ9ydG%2FG7iV5zuw5gkC5EoPpNeZeIJIVVt9ydmlAKb0cj8XF8im9ztqRTDUXtc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3460fec569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| privacy.gatekeeperconsent.com/tcf2_stub.js | 172.67.199.186 | 200 OK | 1.1 kB |
URL GET HTTP/2privacy.gatekeeperconsent.com/tcf2_stub.js IP172.67.199.186:443
CertificateIssuerGoogle Trust Services LLC Subjectgatekeeperconsent.com Fingerprint5C:4E:1D:E7:D3:4B:2C:22:CF:AC:5E:4A:B4:AD:5C:05:EF:BD:E1:B0 ValidityThu, 25 Apr 2024 18:00:16 GMT - Wed, 24 Jul 2024 18:00:15 GMT
File typeJavaScript source, ASCII text, with very long lines (1157), with no line terminators Hashd6cc308b77a4bb6f98c5a07e03a7694a 5ecf1eda60c7fca293330dfac0b1b5153d318a54 9f1532f17ac7e587162829778383145bea53311983ff85a2aed1f6b60fef6a9e
GET /tcf2_stub.js HTTP/1.1
Host: privacy.gatekeeperconsent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=15780000, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CjTepjS395UNOcVt5YwOlz7nNR0FVnci2RCWbrgmujBOMgYBy7tCXXYEmPiwS8m3rYMCHSYHs%2BWyuZTJ5QZS5Nc9yOcfoWD2%2Fsm5Hs6P9h0RTX4GLmYqgM9%2FW40egfkJvzPoSEZWcz8ROCU9lkKbNA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a5f345df03568e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| goo.by/content/blog/goo-gl-rip.png | 104.21.86.233 | 200 OK | 3.4 kB |
URL GET HTTP/3goo.by/content/blog/goo-gl-rip.png IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typePNG image data, 720 x 300, 8-bit colormap, non-interlaced Hash7ccc35751256c390b699c6bc86fc8de6 d6ee8504163ea0f1c6472ab90e69b13540ef138c 96742b2bb7cc5318e6407d55b9c5692521a3451624b5ee5f142dfec1ffd07c64
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /content/blog/goo-gl-rip.png HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: image/png
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: "652da450-d6d-gzip"
last-modified: Mon, 16 Oct 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,X-Ezoic-Excludewebp,Origin
x-ezoic-cdn: Hit ds;mm;cd0f6be4f01143779b059cb816961ba9;2-499726-3;4a25c9c7-4064-440a-70af-aa3e6caa13d0
x-ezoic-excludewebp: false
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-origin-cache-control:
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T9GmZ%2B7mhIeLMZ%2FFqnznl%2FIEXRhGaknnjGIGG9PBcKChd%2FIOmV8d3ttJlH8mhKiGT%2BjJQ9hUWylj12IbkKWgLr7qRSjeU5JaWlV0s9EB%2BsSUHorBz7fJgYE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345efd5569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/beardeddragon/drake.js?gcb=0&cb=8 | 104.21.86.233 | 200 OK | 4.2 kB |
URL GET HTTP/3goo.by/beardeddragon/drake.js?gcb=0&cb=8 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (4343), with no line terminators Hash2ac5f63959b3a062de1c5657eac749d8 f70891b42f759f423858433d4d73c9a09f30c49c 55fed09c585708ee002e8274b74dc72935fb711213fb4d8e0b48f7d05befbe5d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /beardeddragon/drake.js?gcb=0&cb=8 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=4247
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61429
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ErSC%2BwwgzIDWYVYwa5tw0kLGUdO6e9KRI%2BiX3L5CE4v%2FqYlsPmpK3Af%2BznGpmVIA3Qutplucq3vtZsg9R7jawyt%2Bzbl7R3nF36N867KPla06FkfC2JGK%2FXk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f349ec14569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| www.google.com/recaptcha/api2/reload?k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw | 142.250.74.164 | 200 OK | 12 kB |
URL POST HTTP/3www.google.com/recaptcha/api2/reload?k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw IP142.250.74.164:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint01:16:A3:AE:CA:C9:AC:ED:3A:C9:AA:75:BE:C2:51:EF:65:CE:23:E1 ValidityMon, 08 Apr 2024 06:34:56 GMT - Mon, 01 Jul 2024 06:34:55 GMT
File typeASCII text, with very long lines (11996) Hash32ae6434c9ba93863fdc9ecbea54b340 ce622060fbbc02c363893ebf3e6e973cb38ca3fa 5af6dcd6a8fbb05281b0bdb7204221c11be85532fbb99e7e2a355ec7787de293
POST /recaptcha/api2/reload?k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-protobuffer
Content-Length: 6817
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/json; charset=utf-8
content-encoding: gzip
date: Fri, 26 Apr 2024 10:39:43 GMT
expires: Fri, 26 Apr 2024 10:39:43 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
set-cookie: _GRECAPTCHA=09AEdsM9OIKcJ9FgGlSFlyD5nn9mtWL4Shd9nbYzJmMW3LaFMqDqwNv4QX3k1B0xnYtCtyenEvaZ3NHLRMV5YU3bw;Path=/recaptcha;Expires=Wed, 23-Oct-2024 10:39:43 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| goo.by/static/frontend/libs/select2/dist/css/select2.min.css | 104.21.86.233 | 200 OK | 15 kB |
URL GET HTTP/3goo.by/static/frontend/libs/select2/dist/css/select2.min.css IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeASCII text, with very long lines (14965) Hash9f54e6414f87e0d14b9e966f19a174f9 ae5735562faabd1a2d9803bbd7bf4c502b5e4f51 15d6ad4dfdb43d0affad683e70029f97a8f8fc8637a28845009ee0542dccdf81
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/libs/select2/dist/css/select2.min.css HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=1800
display: staticcontent_sol, orig_site_sol
etag: W/"639644d0-3a76-gzip"
last-modified: Sun, 11 Dec 2022 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-ezoic-cdn: Hit ds;mm;fb63da15dacdc64d2249edd7b57511c8;2-499726-3;a4f15b5c-a604-4cd5-71d5-8fe84fbf8a21
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control:
x-sol: orig
cf-cache-status: HIT
age: 1229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IVL1jjetBN9boCFOvRyZmRR79uFKI6Wm8mtxl7BZuGFNjNKpJhKx%2BvoSrHlWy4Sv7Uf4V5ncQcKHjXe0NzBQQqXNhjMTDNBGgm3eKxHpcDp2PxobgqOavJs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfa7569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/js/owl.carousel.min.js?v=1.2 | 104.21.86.233 | 200 OK | 44 kB |
URL GET HTTP/3goo.by/static/frontend/js/owl.carousel.min.js?v=1.2 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (31997), with CRLF line terminators Hash47c357c05cb99cedbac2874840319818 d8b05365de4b760618328fdeef7672e8374978e4 4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/js/owl.carousel.min.js?v=1.2 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"5fff5f50-ad3c-gzip"
last-modified: Wed, 13 Jan 2021 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HxCHxuDNqjC2uxsZ8x1mpkrrMkMm5MJkMCkhF5sSM8dE0gS%2FmHKOy1Yj2JXll0urW0fDjvhiRcOAxKZgTJWRdeuwYl51Cy9%2F5qXZnqJ2te8epKEMIKXwzU4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3460ff1569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/js/js.js?v=1.28 | 104.21.86.233 | 200 OK | 6.3 kB |
URL GET HTTP/3goo.by/static/frontend/js/js.js?v=1.28 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (7485), with no line terminators Hash62105e58d584c761114956597fcd91b8 cd691d8b519f22fe5f685552c264ccd33a2652bd 13b64700a619bafdf0243264465b9a3dc579925fb4cfd8130e790fed19ca078c
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/js/js.js?v=1.28 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"64e91650-18a8-gzip"
last-modified: Fri, 25 Aug 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b2AHdJIvl9mCOyOUWDykaK%2FMjAIw3u3Cw2%2FzD3xtchwQvXDcQAtrRW622pJLA0C64xlye0Qc%2B6H5L%2B%2FVloAOUcWjq5471EGAri6eYbTjD1q5T2dX4tmGzKg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3461fff569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| go.ezodn.com/detroitchicago/audins.js?cb=3 | 104.21.87.79 | 200 OK | 516 B |
URL GET HTTP/2go.ezodn.com/detroitchicago/audins.js?cb=3 IP104.21.87.79:443
CertificateIssuerLet's Encrypt Subjectezodn.com Fingerprint53:71:6B:52:86:61:D5:CA:EA:16:F4:D1:1B:4C:14:BC:12:FC:42:84 ValidityMon, 22 Apr 2024 23:07:38 GMT - Sun, 21 Jul 2024 23:07:37 GMT
File typeASCII text, with very long lines (536), with no line terminators Hashae781ef9a6af4dd1dc8526612c65cd2d 0cda0ef2c26aafcbb67eda3210bcf1e202fe46c3 8e79761e0006939bfeeb43175eb12d2a01bdde34d9b77d4f3dbd6627ce0d3d03
GET /detroitchicago/audins.js?cb=3 HTTP/1.1
Host: go.ezodn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 10:39:47 GMT
content-type: application/javascript
cache-control: public, max-age=31536000
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
last-modified: Mon, 15 Jan 2024 22:06:37 GMT
cf-cache-status: HIT
age: 8770830
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gohIcSfocehw6czHuNgHkE0sTb0jgaoDt9Gv7DfgfqGnHMoEUsqsdyBJcxcVVKoXuk0tKxQbB2faIAh2hvXTB4dhBhJG1FLlG3km50ijfApDlmNPRAadI7Qa%2FiZJ0B4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3706b147127-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| | 104.21.86.233 | 200 OK | 87 kB |
URL User Request GET HTTP/2IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
display: orig_site_sol
expires: Thu, 25 Apr 2024 10:39:40 GMT
pagespeed: off
pragma: no-cache
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-middleton-display: orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8AXvbkVGa%2B8xOWcgKlYO1od3wPTwC3qjSJe%2BLSQwhYSgeMFwafry8A7rjyz2SoENM27TETfWEkLa4H54sHd%2FBgvK4XI%2BvgskipGmghoynR5y1%2BmJPtO6t4k%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3435e3f5684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| goo.by/static/frontend/libs/cookieconsent/cookieconsent.css | 104.21.86.233 | 200 OK | 19 kB |
URL GET HTTP/3goo.by/static/frontend/libs/cookieconsent/cookieconsent.css IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeASCII text, with very long lines (18785), with no line terminators Hash9515c583afb986f4eabd856cbfa87366 f1e1dc181d598fbdedab2fbb9c6d78cff257eccd 55584e5df2cbee159381522d38d5e31ba145f35c69f6f8b7c1aaa8676b2c0a7e
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/libs/cookieconsent/cookieconsent.css HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=1800
cf-bgj: minify
cf-polished: origSize=18803
display: staticcontent_sol, orig_site_sol
etag: W/"639644d0-4973-gzip"
last-modified: Sun, 11 Dec 2022 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-ezoic-cdn: Hit ds;mm;f8894ffee790d36bc429430445636dfc;2-499726-3;9d5c1727-869a-472b-48ff-fc6ba8b8e573
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control:
x-sol: orig
cf-cache-status: HIT
age: 1229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AJlEU5n%2FZ7gKNAFoQ1Gza5lHXFoydPrQ%2FkkBrSSp7T4svNNg6uWkYmZQGiAwvcuAHYe69Kvfr7z%2BOjzrmpIvzySt%2FKvd0n%2F%2BSar34IrdZFPwkOhkzFZzQJU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfa9569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/parsonsmaize/chanute.js?a=a&cb=9&dcb=195-0&shcb=34 | 104.21.86.233 | 200 OK | 22 kB |
URL GET HTTP/3goo.by/parsonsmaize/chanute.js?a=a&cb=9&dcb=195-0&shcb=34 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (2958) Hash84a3496289ece71b339ecd24a76c9a56 0aa9386788c79ca2b40f4e613d578059424f7d47 8cb6666ac5ca730743eb9537dfb26940c88ffcbf6965a5122760a9d1e46a1503
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /parsonsmaize/chanute.js?a=a&cb=9&dcb=195-0&shcb=34 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=21786
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61429
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NacopBl7QAz%2BOOEbkLYCBUy1UHhR3yzw0IysqrX6Y0DblCutlFisemWQc03rlP3gM1%2FZO4RmlE%2By%2FOl4d7L7FXvSDbiWBsk7D6lOlEoTuJso0igolACut%2F4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f349fc1a569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/content/blog/notcoin.png | 104.21.86.233 | 200 OK | 6.1 kB |
URL GET HTTP/3goo.by/content/blog/notcoin.png IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typePNG image data, 720 x 300, 8-bit colormap, non-interlaced Hash306f820663f667801e68733a684b0397 fc9ce0d1301cb11acffdc64e8b9d9ab66bb8b80c dd2e9587397f5a0d572ce6d9c7b344f29badbafbeca89064bb9a574ff1e02d57
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /content/blog/notcoin.png HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: image/png
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: "659bbabc-17d0-gzip"
last-modified: Mon, 08 Jan 2024 09:05:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,X-Ezoic-Excludewebp,Origin
x-ezoic-cdn: Hit ds;mm;214a5c668dc1ac4b533840462e5ff678;2-499726-3;73b67d98-9576-45a3-59b0-bbe8fd4bec0a
x-ezoic-excludewebp: false
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-origin-cache-control:
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0TefAAudR47gTiiBXkKmgDDPPHem13dM3YaqcfisbACyN%2B%2BFa5t3My56IYPljc2KIIkf3%2FBo9zBGF2SZKEAQleLRj0ovxR2vCREcv%2Fuo0yOYnQo0YlhObzg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345efd4569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/porpoiseant/jellyfish.js?a=a&cb=15&dcb=195-0&shcb=34 | 104.21.86.233 | 200 OK | 38 kB |
URL GET HTTP/3goo.by/porpoiseant/jellyfish.js?a=a&cb=15&dcb=195-0&shcb=34 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (2865) Hash575acd36ef22dcb28388533496f65d9c 2e2409f35b19046838fe3640d7244a4054bddbf0 4a47c41cedc4fab0067250b6e4be1f7ca99f76773231f79799ac4288fbd4004f
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /porpoiseant/jellyfish.js?a=a&cb=15&dcb=195-0&shcb=34 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=37675
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61429
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uvmDPa%2BGgRUHusck4FDIHq3FoPfzFCQdyJtABwp5pwPTkOUXU5gbkvNjGRdjQOxLO2ih2SLWmrQIiMPp4BfyBlc6mbRbPytLrrKlYu8QQvp31Z7%2Buh39vQY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f349ec16569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/parsonsmaize/abilene.js?gcb=195-0&cb=33 | 104.21.86.233 | 200 OK | 6.3 kB |
URL GET HTTP/3goo.by/parsonsmaize/abilene.js?gcb=195-0&cb=33 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (6421), with no line terminators Hash7aaef6c0681e9a1e0b9aacc984e3e90c 07adf19826ada21d5b3f8515e0a0b0b469fc4722 ee9ecb0f4d88f05f6f807acbafb2902b26babd749f6f5a7b28abc6e938f65a8f
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /parsonsmaize/abilene.js?gcb=195-0&cb=33 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=6304
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nY4iuAl%2F%2BdnFAjfwFkLzJil%2B7YmXiNL2Pia4R8v%2FDPp6EbftgDDuOz%2F%2F%2F9ZoP%2FSEqQ2dM%2Bilt4Yy5%2B6Ef1sQ5LsVoek2po3fDjEQ819CU%2F%2BWc03P6iWNe%2B4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3486ac5569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/parsonsmaize/mulvane.js?gcb=195-0&cb=6 | 104.21.86.233 | 200 OK | 1.1 kB |
URL GET HTTP/3goo.by/parsonsmaize/mulvane.js?gcb=195-0&cb=6 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (1141), with no line terminators Hasheb7f0cbe050589178ce0489f2cfa1515 5ced124de3c94034ba1a80a4e352c67061cd9778 153a6181e3d9ea98bc9bfbd42c594cf6434f4469a0a489b59c75f7f86f3cbdfa
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /parsonsmaize/mulvane.js?gcb=195-0&cb=6 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=1132
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mwFragvJsoUFvsDyi6dOllWC1JV8wShYlAKWAYbyxq7dJwK%2BjsqcLmae4bZxWKs5nGmgka8yUaxS1Iw1Oey62Q6ycbeSD4EuoOCYFw3kkDQPwPKBkHYBa90%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3489af4569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| www.google.com/js/bg/tKcPQSh2okjZHiZ2jIssRExVWo45mlVHOakavsOpwK4.js | 142.250.74.164 | 200 OK | 18 kB |
URL GET HTTP/3www.google.com/js/bg/tKcPQSh2okjZHiZ2jIssRExVWo45mlVHOakavsOpwK4.js IP142.250.74.164:443
Requested byhttps://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint01:16:A3:AE:CA:C9:AC:ED:3A:C9:AA:75:BE:C2:51:EF:65:CE:23:E1 ValidityMon, 08 Apr 2024 06:34:56 GMT - Mon, 01 Jul 2024 06:34:55 GMT
File typeJavaScript source, ASCII text, with very long lines (17650) Hash042afc8f6dd96d8a86aca2f6239682fa c2321f6ccc366638b53be030076f7ae3807f9d53 b4a70f412876a248d91e26768c8b2c444c555a8e399a554739a91abec3a9c0ae
GET /js/bg/tKcPQSh2okjZHiZ2jIssRExVWo45mlVHOakavsOpwK4.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw&co=aHR0cHM6Ly9nb28uYnk6NDQz&hl=en&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=oqvcpc8s1is
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 7420
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 05:54:48 GMT
expires: Sat, 26 Apr 2025 05:54:48 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 23 Apr 2024 17:30:00 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 17094
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| | 104.21.86.233 | 301 Moved Permanently | 87 kB |
URL User Request GET HTTP/2IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /jmLeDf/redirect HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Fri, 26 Apr 2024 10:39:39 GMT
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
display: staticcontent_sol, orig_site_sol
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: /
pagespeed: off
pragma: no-cache
response: 301
set-cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0; path=/
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 301
x-sol: orig
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6l%2FW8qJ7%2BWCqGOViSN152fCKlJXhHcl8TxwDgX7VJ7rV63RiWcfgLUopIGTX%2FKQUPLzbpJ0%2FCy4vApAZVVC8ciM5wuyqvFHssaSquEAehMixGKOGX8H6umM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3421cdf5684-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| goo.by/static/frontend/css/media-queries.css?v116 | 104.21.86.233 | 200 OK | 3.4 kB |
URL GET HTTP/3goo.by/static/frontend/css/media-queries.css?v116 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeASCII text, with very long lines (3723), with no line terminators Hash0c0090a0ac39ca50d6923f028473d82f e6f40bc94f70c82a61465646d34741b922f4a364 f8d3327fdc5321538824046f3d1f19dca0540f5849805097827752fc5a978a6a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/css/media-queries.css?v116 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"64e521d0-d1d-gzip"
last-modified: Tue, 22 Aug 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGFMHnRMEXiwXtBEP52HiyJnHYJ5Oi63lIMxG4bh0Ft4U06LorAE0ecDCxcr6ee7zHSgmVmpo5XMJrUB%2Bx7ssr8Q1rLQiwCZi%2B0W7vUTI13JYlW6kNjApWY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfb0569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/content/blog/ai-vs-machine-learning.png | 104.21.86.233 | 200 OK | 194 kB |
URL GET HTTP/3goo.by/content/blog/ai-vs-machine-learning.png IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 1440x600, Scaling: [none]x[none], YUV color, decoders should clamp Size194 kB (193596 bytes) Hashf73c5ef155dc0eb61a38e332f1eb711c d202c41dc05deca25b7137ead88acb4018a46619 b633e54336a2531172e4aad5fd28b0612248ba13af5486512841179fb9f7a98c
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /content/blog/ai-vs-machine-learning.png HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: image/webp
cache-control: public, max-age=3600
display: staticcontent_sol
etag: "65522118-9fdac-gzip"
last-modified: Mon, 13 Nov 2023 13:14:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,X-Ezoic-Excludewebp,Origin
x-ezoic-cdn: Hit ds;mm;642aa4fea7366847f2d8d11ee5131c3e;2-499726-3;ff3a3839-48b3-4678-560a-24a05c8dde6d
x-ezoic-excludewebp: false
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-origin-cache-control:
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XtYOolJvGCMrh7VLvRltLTWrqCeuvksDtLlur6zYLcrLfGsjg2oN%2FstLaTkTEhIv5McrXaZTy9F%2BAT2eyvJaHP0O21znrT978x2Ey5sSsM6Cun0MI%2FDbflU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345ffda569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/fonts/icomoon.ttf?ulfgh0 | 104.21.86.233 | 200 OK | 4.6 kB |
URL GET HTTP/3goo.by/static/frontend/fonts/icomoon.ttf?ulfgh0 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeTrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, icomoon Hash2730962e9d816bcbf082ceca4c7cf5e5 28ae7090a594369f674b376423b8df3e5a813f42 357004e9ec66eab37303083efa2b4877246d779542ef28917017ab4ee5ce382f
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/fonts/icomoon.ttf?ulfgh0 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/static/frontend/css/reset.css?v37
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/octet-stream
cache-control: public, max-age=2592000
display: staticcontent_sol
etag: "648a2a50-11d8-gzip"
last-modified: Wed, 14 Jun 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol
x-middleton-response: 200
cf-cache-status: HIT
age: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RzvyBO4Slt385qw7mnRQNVPN7rm8%2FKLbnxYKQ3BkjPNBW%2BqWJMgZG5RyKG44z%2FOstYVwJwasV0DMl3jzDDdYOFZU8SHILvWcplZ%2BzcFmNDJ2eZHTsViYQ%2FA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3491b60569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTI4MCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMDI0In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZDExOWY3NTctYzM0NC00ZDI1LTRkYjktYzE1NWI3OGZkZDljIiwiZG9tYWluX2lkIjoiNDk5NzI2IiwidF9lcG9jaCI6MTcxNDEyNzk4MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjQtMDQtMjYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI1In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImQxMTlmNzU3LWMzNDQtNGQyNS00ZGI5LWMxNTViNzhmZGQ5YyIsImRvbWFpbl9pZCI6IjQ5OTcyNiIsInRfZXBvY2giOjE3MTQxMjc5ODAsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0= | 104.21.86.233 | 204 No Content | 0 B |
URL POST HTTP/3goo.by/detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTI4MCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMDI0In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZDExOWY3NTctYzM0NC00ZDI1LTRkYjktYzE1NWI3OGZkZDljIiwiZG9tYWluX2lkIjoiNDk5NzI2IiwidF9lcG9jaCI6MTcxNDEyNzk4MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjQtMDQtMjYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI1In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImQxMTlmNzU3LWMzNDQtNGQyNS00ZGI5LWMxNTViNzhmZGQ5YyIsImRvbWFpbl9pZCI6IjQ5OTcyNiIsInRfZXBvY2giOjE3MTQxMjc5ODAsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0= IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /detroitchicago/greenoaks.gif?orig=1&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTI4MCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMDI0In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZDExOWY3NTctYzM0NC00ZDI1LTRkYjktYzE1NWI3OGZkZDljIiwiZG9tYWluX2lkIjoiNDk5NzI2IiwidF9lcG9jaCI6MTcxNDEyNzk4MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjQtMDQtMjYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxMCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI1In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkMTE5Zjc1Ny1jMzQ0LTRkMjUtNGRiOS1jMTU1Yjc4ZmRkOWMiLCJkb21haW5faWQiOiI0OTk3MjYiLCJ0X2Vwb2NoIjoxNzE0MTI3OTgwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImQxMTlmNzU3LWMzNDQtNGQyNS00ZGI5LWMxNTViNzhmZGQ5YyIsImRvbWFpbl9pZCI6IjQ5OTcyNiIsInRfZXBvY2giOjE3MTQxMjc5ODAsImRhdGEiOlt7Im5hbWUiOiJuYXZpZ2F0aW9uX3R5cGUiLCJ2YWwiOiIwIn0seyJuYW1lIjoicmVkaXJlY3RfY291bnQiLCJ2YWwiOiIwIn1dfV0= HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0; _ga_RPX0GYJ7KN=GS1.1.1714127981.1.0.1714127981.0.0.0; _ga=GA1.1.2075027178.1714127981
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0
HTTP/3 204 No Content
date: Fri, 26 Apr 2024 10:39:48 GMT
access-control-allow-origin: https://goo.by
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
expires: Thu, 25 Apr 2024 10:39:49 GMT
vary: Accept-Encoding
x-middleton-display: ezp_sol
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IA1Qkk8yds%2BXi6BD9q6po%2BIJYBabsFYRgqCHqV7ZmWhY5mXvzYUnA2ayCj2Kr1jhup%2F%2Bj7nWa%2B3Y3oTn7i9G0h%2Fbi0OChilehtYveEqqYkbF2ee9OYc86vk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3794b7a569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| fonts.googleapis.com/css2?family=Roboto&display=swap | 142.250.74.106 | 200 OK | 2.3 kB |
URL GET HTTP/2fonts.googleapis.com/css2?family=Roboto&display=swap IP142.250.74.106:443
CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50 ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT
File typeASCII text, with very long lines (2379), with no line terminators Hash03278c047a3192f4a25c4644284d910b 61fc733be8553b3e6d9847d43b4bef84b5ae947d d5e8a5e5b7bfea2764abadded25ab112a034543a2315c942bb9fd3cbe7ece8fb
GET /css2?family=Roboto&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 10:39:40 GMT
date: Fri, 26 Apr 2024 10:39:40 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.google.com/recaptcha/api.js?hl=en&render=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw | 142.250.74.164 | 200 OK | 884 B |
URL GET HTTP/2www.google.com/recaptcha/api.js?hl=en&render=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw IP142.250.74.164:443
CertificateIssuerGoogle Trust Services LLC Subjectwww.google.com FingerprintF3:75:C9:48:E6:A5:11:C7:87:C8:8D:9A:C4:16:F8:09:4E:88:7C:5A ValidityMon, 08 Apr 2024 07:33:48 GMT - Mon, 01 Jul 2024 07:33:47 GMT
File typeJavaScript source, ASCII text, with very long lines (884), with no line terminators Hash8eed34ee5682cd7f973cf3c6ac9e9794 d040af8e178f3c9e370421632ecd8443f612415b 47b0bd5e1cf3922c3cef7088f09b322130325ca71206893bdd661ff6425e57c6
GET /recaptcha/api.js?hl=en&render=6LcUoOQUAAAAANHj_juVSgLjxCWAABmUxJr-DhCw HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Fri, 26 Apr 2024 10:39:40 GMT
date: Fri, 26 Apr 2024 10:39:40 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| goo.by/detroitchicago/vista.js?gcb=195-0&cb=6 | 104.21.86.233 | 200 OK | 1.1 kB |
URL GET HTTP/3goo.by/detroitchicago/vista.js?gcb=195-0&cb=6 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (1070), with no line terminators Hash70dee53459471c8436487a04351d061e 1807e95b9322344e4cdbe493f2735f55b4f77d0e 6d932a790ac9034517a43d243de6a4810c4ad9c7fafd30e474f9634027fb6e09
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /detroitchicago/vista.js?gcb=195-0&cb=6 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=1067
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CkOTQc5jJZJwVK0TkGDsL2w1xVI0OsQm4RaaDUiyU5CVoPJrfHM3hTNLz%2BiStPztoo00N4zMYHV15IlmfLo75J%2FGOdaDt0bG8yoO5EblKPBGWxu0fIaVIsI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3489afc569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| the.gatekeeperconsent.com/v2/config.json?domain=goo.by&changeLogId=563182&cb=195 | 104.21.42.32 | 200 OK | 16 kB |
URL GET HTTP/3the.gatekeeperconsent.com/v2/config.json?domain=goo.by&changeLogId=563182&cb=195 IP104.21.42.32:443
CertificateIssuerGoogle Trust Services LLC Subjectgatekeeperconsent.com Fingerprint5C:4E:1D:E7:D3:4B:2C:22:CF:AC:5E:4A:B4:AD:5C:05:EF:BD:E1:B0 ValidityThu, 25 Apr 2024 18:00:16 GMT - Wed, 24 Jul 2024 18:00:15 GMT
Hash991ef074ccf45dcd3fb7c5ae84bdc753 36bfb05680bbfa89bffecdd877056a5babbcb5c1 dac638e4ebf439abc3bfb491edce3a6bec7a7d5c488fa0e35108bd3b1a4757d0
GET /v2/config.json?domain=goo.by&changeLogId=563182&cb=195 HTTP/1.1
Host: the.gatekeeperconsent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=2592000, public
content-security-policy: default-src 'none'
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: deny
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AKBJwpvUvHu2ep%2Fx0FJa4a15bvNngpQYofXiq%2FhF635gfqDZ8s6CdAN0Y5LNbfQ2OZcit390mUpgXmN%2B%2FMqb4tcf4%2Fe7b0S%2FM8%2FhNmjXAUX2Apf9%2FIditNTCHlfw4uWieUspp6n5OlSkhN%2FH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f34a1d15b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/parsonsmaize/olathe.js?gcb=195-0&cb=24 | 104.21.86.233 | 200 OK | 2.2 kB |
URL GET HTTP/3goo.by/parsonsmaize/olathe.js?gcb=195-0&cb=24 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (2282), with no line terminators Hashd3f130771db31b17bf0d2abc5b521948 d9f2790e30bc9364d1557b90f08aecc92f1724b5 a99588d98a9eda7fa53ccd7e01f76514b314363941115b0d40f83d523b1c5ee3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /parsonsmaize/olathe.js?gcb=195-0&cb=24 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=2221
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61429
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KoHdZfa6U%2BOeHPa4eLIeI1I036TeUpv%2FB%2FL0xkc7TMRKf7I9QuV2Nswb7DsAfYEUtetjnar5bdaiJSA80BSCB%2Bj3aCKWHmLmLG68VO3gxHXkV3Di4oDtykc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f349fc17569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/porpoiseant/et.js?gcb=195-0&cb=2 | 104.21.86.233 | 200 OK | 1.1 kB |
URL GET HTTP/3goo.by/porpoiseant/et.js?gcb=195-0&cb=2 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (1089), with no line terminators Hash4d41383db566e0b6e6d0abe17c4a6325 3ae9f1bd821fb2dddd7af931d271556a434ceb1d 4199899b0b57b693dbaaae6144d79989b9562793873d748092ebf796171a6f2a
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /porpoiseant/et.js?gcb=195-0&cb=2 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61428
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=reNj%2FNioGLfhAOoh8tMyeagEGZ7TB9pPz1B9ppeZvCgizROYEuNj%2Bmr5OWWbUGyNLRyxaburDb08SaLtucuhQICAbW4XcfquH1EpxreAmyG%2FY1v%2Fkz3Vu60%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3486ac8569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/images/blog4.jpg | 104.21.86.233 | 200 OK | 16 kB |
URL GET HTTP/3goo.by/static/frontend/images/blog4.jpg IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, progressive, precision 8, 720x300, components 3 Hashb9501d6637673009855ac39d0e2cced8 0f2ef925e177e2b9815897f3bfeb10351d231031 d5c73c1bdb830080a11cfe7ff9fe89c1cba9ad1bbaa5ec7962371a99251bd4f6
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/images/blog4.jpg HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: image/jpeg
cache-control: public, max-age=3600
display: staticcontent_sol
etag: "652ef5d0-3f57-gzip"
last-modified: Tue, 17 Oct 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,X-Ezoic-Excludewebp,Origin
x-ezoic-cdn: Hit ds;mm;cbb905f40e3e9b2d43e2eedddb4f2ba1;2-499726-3;be0d7cef-9b54-4170-7629-27060f5e9c20
x-ezoic-excludewebp: false
x-middleton-display: staticcontent_sol
x-middleton-response: 200
x-origin-cache-control:
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ef7RWF1yOwtE5Rs1iACjxY%2F2DM5LM6vLSVFuc5oV5%2BhZbkPP5IJA70aLTAu5Q3rZwBJcuV3QU2N4p%2FwO5PmN4lx9JNM80%2Fo1eedGG3qkVxuudZ50%2BnLNPTg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345efc9569d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/libs/clipboard/dist/clipboard.min.js | 104.21.86.233 | 200 OK | 10 kB |
URL GET HTTP/3goo.by/static/frontend/libs/clipboard/dist/clipboard.min.js IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| PhishTank | phishing | Other | | Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/libs/clipboard/dist/clipboard.min.js HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"1dbeadd0-28d5-gzip"
last-modified: Thu, 24 Oct 1985 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ORvCoYu9GK9IItglaAZi2Gm7zKA0m4Tu%2FicagdRHgTxZfFOtDxs6%2BVGWLNj2ed806idLO9TMpyk8Q6STe2y4n26WZBSSfviTiFtDakquq3jfQTiCLSPEHZc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3460fe9569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/js/readmore.min.js?v=1.2 | 104.21.86.233 | 200 OK | 4.4 kB |
URL GET HTTP/3goo.by/static/frontend/js/readmore.min.js?v=1.2 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (4611), with no line terminators Hash4403b1ebbb9e690c33cbddf4fef4af9c c3360998542bd400146ee3a055b97bd4438eb2c9 f00bd0fd827fdfb6e2fe7e6790abb5c6313f1fa22561041d78e38420063a0658
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/js/readmore.min.js?v=1.2 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"64e91650-1155-gzip"
last-modified: Fri, 25 Aug 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QUldtXlcoRjdDgsiU2GSvAFms2LTetS05qAHvzF6P4wDcXb1cRgUFFSGRkHJ%2Bm8FLHQG%2BHqV8w5p1tLBKePIwjvPWfesyIZWy23Le9hgLZREGdfsaOrFL1g%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f3460ff2569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/tardisrocinante/vitals.js?gcb=0&cb=4 | 104.21.86.233 | 200 OK | 11 kB |
URL GET HTTP/3goo.by/tardisrocinante/vitals.js?gcb=0&cb=4 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeJavaScript source, ASCII text, with very long lines (10662) Hash2ae1c0300ec064cd7fdad1a3670fc1f6 f6a49c128f58666eacbfad69229cdda3053be197 4c2df0892b2e68fb2a1baee0cbf0ad2aac11419d49c9b97f10a81455b03e6a93
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /tardisrocinante/vitals.js?gcb=0&cb=4 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/javascript
cache-control: max-age=31536000, public
cf-bgj: minify
cf-polished: origSize=11417
vary: Accept-Encoding
x-middleton-display: sol-js
x-robots-tag: noindex
cf-cache-status: HIT
age: 61429
last-modified: Thu, 25 Apr 2024 17:35:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uYaoHg%2Fu6OTBMWW4tg67eLz%2F88pG8%2FRIe5heHBybrFiUDUli5eeGIOjZAH7d%2FSRBq5IDkDWR966JGVd3xD53G%2BP7lo1hmlKRyEMVmOCRP0kLeqkXzl6jZOc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f349fc19569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| the.gatekeeperconsent.com/cmp/gvl.json?v=9&lang=en | 104.21.42.32 | 200 OK | 610 kB |
URL GET HTTP/3the.gatekeeperconsent.com/cmp/gvl.json?v=9&lang=en IP104.21.42.32:443
CertificateIssuerGoogle Trust Services LLC Subjectgatekeeperconsent.com Fingerprint5C:4E:1D:E7:D3:4B:2C:22:CF:AC:5E:4A:B4:AD:5C:05:EF:BD:E1:B0 ValidityThu, 25 Apr 2024 18:00:16 GMT - Wed, 24 Jul 2024 18:00:15 GMT
Size610 kB (610128 bytes) Hashcaae9ab552ddb2d60cd364f1d333f309 7adb65e4128a24e736207b7935acefa037cc283b b418df310c1df3c37ededd519788d59de0a7225b787d5264a144db97127d3ff0
GET /cmp/gvl.json?v=9&lang=en HTTP/1.1
Host: the.gatekeeperconsent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goo.by
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:41 GMT
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=345600
last-modified: Sun, 21 Apr 2024 17:19:45 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 322042
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NO31sJZ3%2BUxczdRi457OQpGH6aQkOG%2F4anFHls62HQTJMxC90jjQ%2B72jSCgjjkqEZUjFri%2FCHNEOhrPjd4x2IcDcj8ROiEulQQjyYMGO%2FZJMRYpVYqtsCgBq6syyS6CQuAWIms17vWvaMnh%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f34dc83fb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| goo.by/static/frontend/css/main-style.css?127 | 104.21.86.233 | 200 OK | 18 kB |
URL GET HTTP/3goo.by/static/frontend/css/main-style.css?127 IP104.21.86.233:443
CertificateIssuerGoogle Trust Services LLC Subjectgoo.by Fingerprint03:D4:14:16:09:C7:C4:60:8A:FE:CC:5B:63:26:F3:3A:FA:A2:BF:4D ValidityThu, 14 Mar 2024 15:06:08 GMT - Wed, 12 Jun 2024 15:06:07 GMT
File typeASCII text, with CRLF line terminators Hash738f7775d45bcd2441651f430e389ba3 7684fd42bdceb9a860190622cf52391107ae2346 70ad9d89eb3b76e493729db4f8c240994ebd0851ef08c19825cc5852532c65d5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/frontend/css/main-style.css?127 HTTP/1.1
Host: goo.by
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.by/
Cookie: PHPSESSID=p3rlqj2ipnjghcqaujdnb9hpp0
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 10:39:40 GMT
content-type: text/css
cache-control: public, max-age=2592000
display: staticcontent_sol, orig_site_sol
etag: W/"65231850-44b0-gzip"
last-modified: Sun, 08 Oct 2023 21:00:00 GMT
response: 200
strict-transport-security: max-age=31536000
vary: Accept-Encoding,Origin
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-sol: orig
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FfmqoI03jg4pSKG5P5v%2BYWVq1JOAbgAVIvvrMryI25sQttbNEbXi%2Ba3AbO23yaXiyDSy6q%2BG7lUYsKGut7nXSu1tSAb5mmtBTlqtPoD%2Fhq8ePYxUMWStRe0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a5f345cfae569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|