Report - goo.su/95BLid

Report Overview

Submitted URL
goo.su/95BLid
IP
172.67.139.105
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-17 03:54:07
Access
public
Website Title
Manage your Apple ID - Apple
Final URL
1.azwee.click/en/main
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
20

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
rtb.pushdom.co	244282	2018-12-28	2019-01-08	2024-04-17	509 B	158 B	31.204.132.208
st.top100.ru	27374	1999-09-30	2014-03-27	2024-04-15	418 B	12 kB	81.19.89.18
1.azwee.click	unknown	2024-01-09	2024-04-14	2024-04-16	5.1 kB	379 kB	199.21.149.68
goo.su	377451	2019-06-14	2017-05-12	2024-04-14	6.9 kB	67 kB	104.21.38.221
enduresopens.com	unknown	2023-08-31	2023-08-31	2024-03-26	399 B	1.5 kB	23.109.170.73
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-16	1.1 kB	36 kB	216.58.207.227

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	goo.su/95BLid	Apple Inc.
2024-04-15	medium	1.azwee.click/en/	Apple Inc.
2024-04-15	medium	1.azwee.click/en/main	Apple Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	goo.su	Sinkholed
2024-04-17	medium	enduresopens.com	Sinkholed
2024-04-17	medium	goo.su	Sinkholed
2024-04-17	medium	goo.su	Sinkholed
2024-04-17	medium	goo.su	Sinkholed
2024-04-17	medium	goo.su	Sinkholed
2024-04-17	medium	goo.su	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	1.azwee.click/en/assets/card.js	59 kB	2024-03-27	2024-04-29
Pretty URL 1.azwee.click/en/assets/card.js IP 199.21.149.68 ASN #7040 NETMINDERS Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-27 17:58:11 Last Seen2024-04-29 08:04:23 Times Seen426 Hash 7aa76d18dd3e3598ac9561adf01f3882 26d9fcdd2b6bee0b3f1b96b015f3703b5fbd49e0 6d5516bbbebba2d51878f1e791b642f3b2944270b8e84770f15a16376b202213 Loading...

	1.azwee.click/en/polyfills.649ac95cc0f663eb2ea5.js	46 kB	2024-03-27	2024-04-29
Pretty URL 1.azwee.click/en/polyfills.649ac95cc0f663eb2ea5.js IP 199.21.149.68 ASN #7040 NETMINDERS Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-27 17:58:12 Last Seen2024-04-29 08:04:23 Times Seen426 Hash 4794c42590c7158a1a334801f7068376 63e0e06b459566123ab988af6258369ba5b181dd 073c634b2120ecfe1b6b98e45f44d807088bd437e757eb3b049867a615e6a49d Loading...

	1.azwee.click/en/runtime.9b214d14fa4ea25c94c0.js	2.3 kB	2024-03-27	2024-04-29
Pretty URL 1.azwee.click/en/runtime.9b214d14fa4ea25c94c0.js IP 199.21.149.68 ASN #7040 NETMINDERS Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-27 17:58:11 Last Seen2024-04-29 07:13:35 Times Seen306 Hash 4ac3e6290ad24ac46b8a1970a7efb266 6f792827e5974b69c7c9a87e81f33b5ef670bff3 94f516b9d49d3b5ecf42fba742d930a0224275eedb9d19b4c33644dc8c2a3c26 Loading...

	1.azwee.click/en/main.cb307f485390a6a94066.js	839 kB	2024-03-27	2024-04-29
Pretty URL 1.azwee.click/en/main.cb307f485390a6a94066.js IP 199.21.149.68 ASN #7040 NETMINDERS Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-27 17:58:12 Last Seen2024-04-29 07:13:35 Times Seen306 Hash bc44d3824775061c25f8df88d786c3e2 111302049dc6c747ff1c06e4f71b4633c0dec9da 8e89674e3a2a98869f629ec69abaf2dc5f499b53a3ee1016c6e3fbd36ad6a4be Loading...

		Size	First Seen	Last Seen
	#1 Write - 6efc4e02ff6a1c6ea81b4dd6e2b0776f	235 B	2024-04-17	2024-04-17
Pretty Observations First Seen2024-04-17 05:54:08 Last Seen2024-04-17 05:54:08 Times Seen1 Hash 6efc4e02ff6a1c6ea81b4dd6e2b0776f e8c7cc2b857b1c00fdc0f9e863d779f77433417e aff94cd0b737a8ca2d279a070f68a1b3632fc5354dbc8b0c768298fba0f82d7c Loading...

HTTP Transactions (26)

URL IP Response Size

goo.su/frontend/js/redirect.js?id=399eaf833ac5f607b305c4ace0c25eb5

104.21.38.221

32 kB

URL
goo.su/frontend/js/redirect.js?id=399eaf833ac5f607b305c4ace0c25eb5
IP
104.21.38.221:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Size
32 kB (32113 bytes)
Hash
f152f828206d2cf93e62818f9504e023
182c57654b3f05537cd722545f8d8dd99a8e2652
237a9a5d407ec860020474b01d73aaf1ca71ba2519c8ca92dba2ec81cf479d0b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /frontend/js/redirect.js?id=399eaf833ac5f607b305c4ace0c25eb5 HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/95BLid
Cookie: XSRF-TOKEN=eyJpdiI6Ik15OUJGb2E3S3gwUzJYWmRGUFB3S1E9PSIsInZhbHVlIjoiNW9VT0V4Q0R1RkpNMjJVdHY5TU01aFRVT3IzRTh3dWdaK3pIbVVzdTN4NEd6TFU4YVk2b29jOG9qckdWZGxqKzVRR2Y4Wm1rdzYrYytIQ2Jvb3EyMCtVRitnMHlCSG5LMXEwQnRnaS9yNWVCYVEyeHJoNW4xSDNodm5qSU9IalEiLCJtYWMiOiI1OGIxNDdhNjUzNTg5ZDNjMTY5NjA0Y2E0YTI2ODAzN2QwOGE4NzNkOWMyZTNjY2M3MzI3ZDRkN2VhZmZiMzI4IiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6ImxRUUxINkQ3bGY1bnBDM3U0ZTFSeEE9PSIsInZhbHVlIjoieW9vTEE4Y0EzamM5MmVSdUNFeTkrem4xc2l1YkhPcXNiL2VaeVV6MjNod3NuVlNZalB3aW9OQUtBVXBPUmZqaGJ2dlRGODM3aERnL1RrWHExcWMxa2NKL3poY3JBaHE2THlBWEVaandWNzhtRGZIb0J0Y2dDQVZGWUZrT2FXK2YiLCJtYWMiOiJiNWFmYjczZDBmYTUzZmNmZjdmMmI5ZTM2ZDJlNjE5NjE0ODc0YTk1OTA3Y2IxMDEzZTNjZmY3Yjg3YzcwMDVmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 03:53:41 GMT
content-type: application/javascript
cache-control: max-age=604800
cf-bgj: minify
cf-polished: origSize=87787
etag: W/"65896ec2-156eb"
expires: Wed, 17 Apr 2024 06:06:53 GMT
last-modified: Mon, 25 Dec 2023 12:00:02 GMT
cf-cache-status: HIT
age: 596808
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mj%2B66Ay%2BqT1aCsSgOSXTbHg%2BsszzCdfxX%2BiMlCR8CwzreT57jGwCdvPF3nrK8snxE4MLHzKAzIIxo2IITO3JtZJU8XsryDxVIIShD70b9X9l14lXnOw4KPQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875978350f2f7129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

enduresopens.com/ttkXIvunodY/69489

23.109.170.73

25 B

URL
enduresopens.com/ttkXIvunodY/69489
IP
23.109.170.73:0
ASN
#7979 SERVERS-COM

File type
ASCII text, with no line terminators
Size
25 B (25 bytes)
Hash
f7a2939527fd9e68723da600e96d76bd
a9e717b6364d2895ee0a716050db32ca0ef1bb42
d810f5146f4cd1517512a6e31946e764a73c58fb01427aae88d42cc2ae28718a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /ttkXIvunodY/69489 HTTP/1.1
Host: enduresopens.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 17 Apr 2024 03:53:41 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://goo.su
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Frame-Options: SAMEORIGIN
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Thu, 18-Apr-2024 03:53:41 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Thu, 18-Apr-2024 03:53:41 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

goo.su/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.38.221

0 B

URL
goo.su/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.38.221:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ik15OUJGb2E3S3gwUzJYWmRGUFB3S1E9PSIsInZhbHVlIjoiNW9VT0V4Q0R1RkpNMjJVdHY5TU01aFRVT3IzRTh3dWdaK3pIbVVzdTN4NEd6TFU4YVk2b29jOG9qckdWZGxqKzVRR2Y4Wm1rdzYrYytIQ2Jvb3EyMCtVRitnMHlCSG5LMXEwQnRnaS9yNWVCYVEyeHJoNW4xSDNodm5qSU9IalEiLCJtYWMiOiI1OGIxNDdhNjUzNTg5ZDNjMTY5NjA0Y2E0YTI2ODAzN2QwOGE4NzNkOWMyZTNjY2M3MzI3ZDRkN2VhZmZiMzI4IiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6ImxRUUxINkQ3bGY1bnBDM3U0ZTFSeEE9PSIsInZhbHVlIjoieW9vTEE4Y0EzamM5MmVSdUNFeTkrem4xc2l1YkhPcXNiL2VaeVV6MjNod3NuVlNZalB3aW9OQUtBVXBPUmZqaGJ2dlRGODM3aERnL1RrWHExcWMxa2NKL3poY3JBaHE2THlBWEVaandWNzhtRGZIb0J0Y2dDQVZGWUZrT2FXK2YiLCJtYWMiOiJiNWFmYjczZDBmYTUzZmNmZjdmMmI5ZTM2ZDJlNjE5NjE0ODc0YTk1OTA3Y2IxMDEzZTNjZmY3Yjg3YzcwMDVmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 302 Found
date: Wed, 17 Apr 2024 03:53:42 GMT
content-length: 0
cache-control: max-age=300, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sminH1IUTnEHJiJYVbTxDl3nnrmw7YqpMvAQmuRqgDd0g5Lb0OIUZK6%2FNcdYzkkKCiX%2FtoQj8MjB42sx9PicyiS8WOJlZYXNksdzkNtpt2ckYp3JQkIaRg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875978367fca7129-OSL
alt-svc: h3=":443"; ma=86400

goo.su/95BLid

104.21.38.221

11 kB

URL
goo.su/95BLid
IP
104.21.38.221:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, Unicode text, UTF-8 text, with very long lines (7391)
Size
11 kB (11243 bytes)
Hash
8d9c7c8d3f451713a7311efcc3cd2006
5cd0fed7423a44bf350020a1eaf52848584ed1e0
37904df527e07d6bb698f84a44cadc41aa40a4f883772ac3f24c95d5a2500f84

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Apple Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /95BLid HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 17 Apr 2024 03:53:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-powered-by: PHP/8.2.13
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
set-cookie: XSRF-TOKEN=eyJpdiI6Ik15OUJGb2E3S3gwUzJYWmRGUFB3S1E9PSIsInZhbHVlIjoiNW9VT0V4Q0R1RkpNMjJVdHY5TU01aFRVT3IzRTh3dWdaK3pIbVVzdTN4NEd6TFU4YVk2b29jOG9qckdWZGxqKzVRR2Y4Wm1rdzYrYytIQ2Jvb3EyMCtVRitnMHlCSG5LMXEwQnRnaS9yNWVCYVEyeHJoNW4xSDNodm5qSU9IalEiLCJtYWMiOiI1OGIxNDdhNjUzNTg5ZDNjMTY5NjA0Y2E0YTI2ODAzN2QwOGE4NzNkOWMyZTNjY2M3MzI3ZDRkN2VhZmZiMzI4IiwidGFnIjoiIn0%3D; expires=Wed, 17 Apr 2024 22:33:41 GMT; Max-Age=67200; path=/; secure; samesite=lax
goosu_session=eyJpdiI6ImxRUUxINkQ3bGY1bnBDM3U0ZTFSeEE9PSIsInZhbHVlIjoieW9vTEE4Y0EzamM5MmVSdUNFeTkrem4xc2l1YkhPcXNiL2VaeVV6MjNod3NuVlNZalB3aW9OQUtBVXBPUmZqaGJ2dlRGODM3aERnL1RrWHExcWMxa2NKL3poY3JBaHE2THlBWEVaandWNzhtRGZIb0J0Y2dDQVZGWUZrT2FXK2YiLCJtYWMiOiJiNWFmYjczZDBmYTUzZmNmZjdmMmI5ZTM2ZDJlNjE5NjE0ODc0YTk1OTA3Y2IxMDEzZTNjZmY3Yjg3YzcwMDVmIiwidGFnIjoiIn0%3D; expires=Wed, 17 Apr 2024 22:33:41 GMT; Max-Age=67200; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KrezJIAR1cNB%2Bfvp238MqESxQ4Df7XqAEgZSSUcyl28LUK56am%2FhwyDy8uVDISMi7qCYiqfTqY45gu7RMmN1v8eA6ehQnmzM8GeQHDzF7lTYGAov%2FYcW1sg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 875978335b96b50f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

216.58.207.227

16 kB

URL
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
216.58.207.227:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Size
16 kB (15744 bytes)
Hash
15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

HTTP Headers

GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goo.su
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 16 Apr 2024 16:27:38 GMT
expires: Wed, 16 Apr 2025 16:27:38 GMT
cache-control: public, max-age=31536000
age: 41164
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

216.58.207.227

19 kB

URL
fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
IP
216.58.207.227:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Size
19 kB (18668 bytes)
Hash
8655d20bbcc8cdbfab17b6be6cf55df3
90edbfa9a7dabb185487b4774076f82eb6412270
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

HTTP Headers

GET /s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goo.su
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18668
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 02:34:50 GMT
expires: Fri, 11 Apr 2025 02:34:50 GMT
cache-control: public, max-age=31536000
age: 523132
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

rtb.pushdom.co/pb/st?sctp=content-locker&m=ht&pid=883146&sid=330256&dm=goo.su&c1=https&c2=1&c3=https://rtb.pushdom.co/pb/st

31.204.132.208

0 B

URL
rtb.pushdom.co/pb/st?sctp=content-locker&m=ht&pid=883146&sid=330256&dm=goo.su&c1=https&c2=1&c3=https://rtb.pushdom.co/pb/st
IP
31.204.132.208:0
ASN
#49544 i3D.net B.V

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /pb/st?sctp=content-locker&m=ht&pid=883146&sid=330256&dm=goo.su&c1=https&c2=1&c3=https://rtb.pushdom.co/pb/st HTTP/1.1
Host: rtb.pushdom.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.21.4.1
date: Wed, 17 Apr 2024 03:53:42 GMT
content-type: text/html;charset=UTF-8
content-length: 0
X-Firefox-Spdy: h2

goo.su/img/favicons/apple-touch-icon.png

104.21.38.221

11 kB

URL
goo.su/img/favicons/apple-touch-icon.png
IP
104.21.38.221:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced
Size
11 kB (10926 bytes)
Hash
dc1648f034a8879145ce2db071bdc305
28dfdc4f3f97f00e54528685427a83974cb04a81
7c51dc3139a5a8a07e00884f6558ed62511359803bcb4123668b8e0ccab896c7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/favicons/apple-touch-icon.png HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/95BLid
Cookie: XSRF-TOKEN=eyJpdiI6Ik15OUJGb2E3S3gwUzJYWmRGUFB3S1E9PSIsInZhbHVlIjoiNW9VT0V4Q0R1RkpNMjJVdHY5TU01aFRVT3IzRTh3dWdaK3pIbVVzdTN4NEd6TFU4YVk2b29jOG9qckdWZGxqKzVRR2Y4Wm1rdzYrYytIQ2Jvb3EyMCtVRitnMHlCSG5LMXEwQnRnaS9yNWVCYVEyeHJoNW4xSDNodm5qSU9IalEiLCJtYWMiOiI1OGIxNDdhNjUzNTg5ZDNjMTY5NjA0Y2E0YTI2ODAzN2QwOGE4NzNkOWMyZTNjY2M3MzI3ZDRkN2VhZmZiMzI4IiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6ImxRUUxINkQ3bGY1bnBDM3U0ZTFSeEE9PSIsInZhbHVlIjoieW9vTEE4Y0EzamM5MmVSdUNFeTkrem4xc2l1YkhPcXNiL2VaeVV6MjNod3NuVlNZalB3aW9OQUtBVXBPUmZqaGJ2dlRGODM3aERnL1RrWHExcWMxa2NKL3poY3JBaHE2THlBWEVaandWNzhtRGZIb0J0Y2dDQVZGWUZrT2FXK2YiLCJtYWMiOiJiNWFmYjczZDBmYTUzZmNmZjdmMmI5ZTM2ZDJlNjE5NjE0ODc0YTk1OTA3Y2IxMDEzZTNjZmY3Yjg3YzcwMDVmIiwidGFnIjoiIn0%3D; cf_clearance=aPnedVVPNFJ0jo4XqxBSK2BM9P2FQb52QEZQeiDvy2E-1713326022-1.0.1.1-TcFMOilsprqSvdfnkWtihu2YrhmWF9DubYs3___XPFo5H1wpZmOgy4zaOUoMD57JFz1iWfet7Ha8y0_36qEhrA; adtech_uid=63c3aaa4-12ef-4ad5-b82a-2032ece01ca4%3Agoo.su; top100_id=t1.6673155.518373077.1713326022450; t3_sid_6673155=s1.1364999207.1713326022452.1713326022452.1.1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 03:53:42 GMT
content-type: image/png
content-length: 10926
last-modified: Sun, 24 Dec 2023 16:31:41 GMT
etag: "65885ced-2aae"
expires: Fri, 19 Apr 2024 14:06:25 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 395237
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ll%2FGzZDfwMtYuKPxOmFv5UA742a%2B85ytBUq9muXpzPb8AXH9E5YLnTU4GSyohbBbk32bo7HKWWa2EBDHgxwQFWKVKK0JE2bq7N9dznn9vGRz3L1%2BC3vBnfg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87597838b8a37129-OSL
alt-svc: h3=":443"; ma=86400

goo.su/img/favicons/favicon-16x16.png

104.21.38.221

1.6 kB

URL
goo.su/img/favicons/favicon-16x16.png
IP
104.21.38.221:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Size
1.6 kB (1567 bytes)
Hash
2b201347b6d90e0ad2bbad3be209db73
ae5de3e7f779cf33aefd5dc738f2126633bb7824
df0a5932ec719656fd8f147bcc0c14312e53e52c2df13f5f815d72833de9c852

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/favicons/favicon-16x16.png HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/95BLid
Cookie: XSRF-TOKEN=eyJpdiI6Ik15OUJGb2E3S3gwUzJYWmRGUFB3S1E9PSIsInZhbHVlIjoiNW9VT0V4Q0R1RkpNMjJVdHY5TU01aFRVT3IzRTh3dWdaK3pIbVVzdTN4NEd6TFU4YVk2b29jOG9qckdWZGxqKzVRR2Y4Wm1rdzYrYytIQ2Jvb3EyMCtVRitnMHlCSG5LMXEwQnRnaS9yNWVCYVEyeHJoNW4xSDNodm5qSU9IalEiLCJtYWMiOiI1OGIxNDdhNjUzNTg5ZDNjMTY5NjA0Y2E0YTI2ODAzN2QwOGE4NzNkOWMyZTNjY2M3MzI3ZDRkN2VhZmZiMzI4IiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6ImxRUUxINkQ3bGY1bnBDM3U0ZTFSeEE9PSIsInZhbHVlIjoieW9vTEE4Y0EzamM5MmVSdUNFeTkrem4xc2l1YkhPcXNiL2VaeVV6MjNod3NuVlNZalB3aW9OQUtBVXBPUmZqaGJ2dlRGODM3aERnL1RrWHExcWMxa2NKL3poY3JBaHE2THlBWEVaandWNzhtRGZIb0J0Y2dDQVZGWUZrT2FXK2YiLCJtYWMiOiJiNWFmYjczZDBmYTUzZmNmZjdmMmI5ZTM2ZDJlNjE5NjE0ODc0YTk1OTA3Y2IxMDEzZTNjZmY3Yjg3YzcwMDVmIiwidGFnIjoiIn0%3D; cf_clearance=aPnedVVPNFJ0jo4XqxBSK2BM9P2FQb52QEZQeiDvy2E-1713326022-1.0.1.1-TcFMOilsprqSvdfnkWtihu2YrhmWF9DubYs3___XPFo5H1wpZmOgy4zaOUoMD57JFz1iWfet7Ha8y0_36qEhrA; adtech_uid=63c3aaa4-12ef-4ad5-b82a-2032ece01ca4%3Agoo.su; top100_id=t1.6673155.518373077.1713326022450; t3_sid_6673155=s1.1364999207.1713326022452.1713326022452.1.1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 03:53:42 GMT
content-type: image/png
content-length: 1567
last-modified: Sun, 24 Dec 2023 16:31:41 GMT
etag: "65885ced-61f"
expires: Tue, 23 Apr 2024 17:48:03 GMT
cache-control: max-age=604800
cf-cache-status: HIT
age: 36339
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bk0VQv8ci3GMAYOvS%2Fp%2F5FdejRjGOKimUnTxXF682tRBOpKANt7jtd3HWGFYMk60wD76AO%2FIQea58iZcV7Hj%2F0tBxUQbwj2QeWs9rA3f%2FQlNXOTB%2F5p610Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87597838b8a67129-OSL
alt-svc: h3=":443"; ma=86400

st.top100.ru/top100/3.16.3/usability.js

81.19.89.18

11 kB

URL
st.top100.ru/top100/3.16.3/usability.js
IP
81.19.89.18:0
ASN
#24638 Rambler Internet Holding LLC

File type
gzip compressed data, from Unix
Size
11 kB (10931 bytes)
Hash
c0415e485d7be2e4d220d158f5a0ee30
bfbe6f20e3648d651e55092f4149e783d86fae31
b76fce41f70a433b579d3543928cdd9cbdce7455ab1478028d07dc469201d3ba

HTTP Headers

GET /top100/3.16.3/usability.js HTTP/1.1
Host: st.top100.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://goo.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 17 Apr 2024 03:53:42 GMT
content-type: application/javascript
vary: Accept-Encoding
x-obs-request-id: 0000018EEA286B39A8052A1942556AF8
etag: W/"c36ada7e993bed0165b7127d977750fa"
last-modified: Thu, 11 Apr 2024 09:09:15 GMT
x-obs-meta-s3cmd-attrs: atime:1712825941/ctime:1712825934/gid:0/gname:root/md5:c36ada7e993bed0165b7127d977750fa/mode:33188/mtime:1712825931/uid:0/uname:root
x-obs-tagging-count: 0
x-obs-id-2: 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSKQ/HG73wZYaS+qMifhvaVggbV6IFYS
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
set-cookie: proto_uid=1CIAAMZHH2beTuiPAcd2SAB=; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.rambler.ru; path=/
p3p: CP="NON DSP NID ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-encoding: gzip
X-Firefox-Spdy: h2

goo.su/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

104.21.38.221

6.6 kB

URL
goo.su/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
IP
104.21.38.221:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (7810), with no line terminators
Size
6.6 kB (6595 bytes)
Hash
503432cfa96bae92e7602f67131847c3
44fadddaa7244b4e77fe9d01f2014a318c6b7a98
cf8b86e129a0c2d4c06074b3d632ea2468ace500b92e14b1a0c1029aed3bafdc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js HTTP/1.1
Host: goo.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ik15OUJGb2E3S3gwUzJYWmRGUFB3S1E9PSIsInZhbHVlIjoiNW9VT0V4Q0R1RkpNMjJVdHY5TU01aFRVT3IzRTh3dWdaK3pIbVVzdTN4NEd6TFU4YVk2b29jOG9qckdWZGxqKzVRR2Y4Wm1rdzYrYytIQ2Jvb3EyMCtVRitnMHlCSG5LMXEwQnRnaS9yNWVCYVEyeHJoNW4xSDNodm5qSU9IalEiLCJtYWMiOiI1OGIxNDdhNjUzNTg5ZDNjMTY5NjA0Y2E0YTI2ODAzN2QwOGE4NzNkOWMyZTNjY2M3MzI3ZDRkN2VhZmZiMzI4IiwidGFnIjoiIn0%3D; goosu_session=eyJpdiI6ImxRUUxINkQ3bGY1bnBDM3U0ZTFSeEE9PSIsInZhbHVlIjoieW9vTEE4Y0EzamM5MmVSdUNFeTkrem4xc2l1YkhPcXNiL2VaeVV6MjNod3NuVlNZalB3aW9OQUtBVXBPUmZqaGJ2dlRGODM3aERnL1RrWHExcWMxa2NKL3poY3JBaHE2THlBWEVaandWNzhtRGZIb0J0Y2dDQVZGWUZrT2FXK2YiLCJtYWMiOiJiNWFmYjczZDBmYTUzZmNmZjdmMmI5ZTM2ZDJlNjE5NjE0ODc0YTk1OTA3Y2IxMDEzZTNjZmY3Yjg3YzcwMDVmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 03:53:42 GMT
content-type: application/javascript; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
vary: accept-encoding
cache-control: max-age=14400, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k9Utr1c%2FyAvrbDKcA%2F3W%2F34hGKDNOy1DrETOWMlc5Z%2FJ539znQMpbC1y0bqufuwU7e41WY59L75hAHL1qNZvYY35JaO7D8tqmtB3HBvPcE79BZC8KLvOVuM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 875978368fd07129-OSL
alt-svc: h3=":443"; ma=86400

1.azwee.click/

199.21.149.68

0 B

URL
1.azwee.click/
IP
199.21.149.68:0
ASN
#7040 NETMINDERS

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Content-Length: 0
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Location: /en/
X-Rate-Limit-Limit: 24h
X-Rate-Limit-Remaining: 1810
X-Rate-Limit-Reset: 2024-04-17T04:02:49.0114664Z

1.azwee.click/en/

199.21.149.68

520 B

URL
1.azwee.click/en/
IP
199.21.149.68:0
ASN
#7040 NETMINDERS

File type
HTML document, ASCII text
Size
520 B (520 bytes)
Hash
fb8b9d9bf56c5251a14ad8cf217df902
87852731aa55f66ce221f4d2379712c341f7bf00
3074a00c33a6892ee549ced168872d8ffb9c78fe10f47cea0921aed8ac60d6ee

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Apple Inc.

HTTP Headers

GET /en/ HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d9fe46cfb43625"
Last-Modified: Sat, 14 Oct 2023 02:33:27 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Rate-Limit-Limit: 24h
X-Rate-Limit-Remaining: 1809
X-Rate-Limit-Reset: 2024-04-17T04:02:49.0114664Z

1.azwee.click/en/main

199.21.149.68

520 B

URL User Request GET
1.azwee.click/en/main
IP
199.21.149.68:0
ASN
#7040 NETMINDERS

File type
HTML document, ASCII text
Size
520 B (520 bytes)
Hash
fb8b9d9bf56c5251a14ad8cf217df902
87852731aa55f66ce221f4d2379712c341f7bf00
3074a00c33a6892ee549ced168872d8ffb9c78fe10f47cea0921aed8ac60d6ee

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Apple Inc.

HTTP Headers

GET /en/main HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d9fe46cfb43625"
Last-Modified: Sat, 14 Oct 2023 02:33:27 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Rate-Limit-Limit: 24h
X-Rate-Limit-Remaining: 1808
X-Rate-Limit-Reset: 2024-04-17T04:02:49.0114664Z

1.azwee.click/en/assets/card.css

199.21.149.68

200 OK

5.0 kB

URL GET HTTP/1.1
1.azwee.click/en/assets/card.css
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
Unicode text, UTF-8 text, with very long lines (27071)
Size
5.0 kB (4977 bytes)
Hash
8c10638062fc10e7800b5f041d66cbe1
94a8f282dc29814af277016d8741fc857b49304d
96712b90b0eb91764af520996a42c0bff93e823e5e825e2544d1ef4723d625d3

HTTP Headers

GET /en/assets/card.css HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d7d7f36c04bfc4"
Last-Modified: Fri, 12 Nov 2021 18:30:52 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding

1.azwee.click/en/runtime.9b214d14fa4ea25c94c0.js

199.21.149.68

200 OK

1.2 kB

URL GET HTTP/1.1
1.azwee.click/en/runtime.9b214d14fa4ea25c94c0.js
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
JavaScript source, ASCII text, with very long lines (2278), with no line terminators
Size
1.2 kB (1160 bytes)
Hash
4ac3e6290ad24ac46b8a1970a7efb266
6f792827e5974b69c7c9a87e81f33b5ef670bff3
94f516b9d49d3b5ecf42fba742d930a0224275eedb9d19b4c33644dc8c2a3c26

HTTP Headers

GET /en/runtime.9b214d14fa4ea25c94c0.js HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d9fe46cdea7ae6"
Last-Modified: Sat, 14 Oct 2023 02:33:24 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding

1.azwee.click/en/assets/card.js

199.21.149.68

200 OK

16 kB

URL GET HTTP/1.1
1.azwee.click/en/assets/card.js
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (51786)
Size
16 kB (16275 bytes)
Hash
7aa76d18dd3e3598ac9561adf01f3882
26d9fcdd2b6bee0b3f1b96b015f3703b5fbd49e0
6d5516bbbebba2d51878f1e791b642f3b2944270b8e84770f15a16376b202213

HTTP Headers

GET /en/assets/card.js HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d7d7f3614aa44b"
Last-Modified: Fri, 12 Nov 2021 18:30:34 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding

1.azwee.click/en/styles.2b2408b28c6b13bb450e.css

199.21.149.68

200 OK

28 kB

URL GET HTTP/1.1
1.azwee.click/en/styles.2b2408b28c6b13bb450e.css
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
ASCII text, with very long lines (65536), with no line terminators
Size
28 kB (27832 bytes)
Hash
c739cee2deb86082090e380beec5b7a0
f54b118cf0b048e09c70ad1ecf661a21b1a47406
0697729b655b3fadc015ce16eecd8cbd3b48a9e34e3c2a3e8b6ad0f8053887d2

HTTP Headers

GET /en/styles.2b2408b28c6b13bb450e.css HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d9fe46cde87d4f"
Last-Modified: Sat, 14 Oct 2023 02:33:24 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding

1.azwee.click/en/polyfills.649ac95cc0f663eb2ea5.js

199.21.149.68

200 OK

17 kB

URL GET HTTP/1.1
1.azwee.click/en/polyfills.649ac95cc0f663eb2ea5.js
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
JavaScript source, ASCII text, with very long lines (45945), with no line terminators
Size
17 kB (16801 bytes)
Hash
4794c42590c7158a1a334801f7068376
63e0e06b459566123ab988af6258369ba5b181dd
073c634b2120ecfe1b6b98e45f44d807088bd437e757eb3b049867a615e6a49d

HTTP Headers

GET /en/polyfills.649ac95cc0f663eb2ea5.js HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d9fe46cdeac179"
Last-Modified: Sat, 14 Oct 2023 02:33:24 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding

1.azwee.click/en/main.cb307f485390a6a94066.js

199.21.149.68

200 OK

243 kB

URL GET HTTP/1.1
1.azwee.click/en/main.cb307f485390a6a94066.js
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
JavaScript source, ASCII text, with very long lines (63865)
Size
243 kB (242917 bytes)
Hash
bc44d3824775061c25f8df88d786c3e2
111302049dc6c747ff1c06e4f71b4633c0dec9da
8e89674e3a2a98869f629ec69abaf2dc5f499b53a3ee1016c6e3fbd36ad6a4be

HTTP Headers

GET /en/main.cb307f485390a6a94066.js HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/javascript
Date: Wed, 17 Apr 2024 03:53:49 GMT
Server: Kestrel
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d9fe46cf17512f"
Last-Modified: Sat, 14 Oct 2023 02:33:26 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding

1.azwee.click/en/assets/menu.png

199.21.149.68

200 OK

687 B

URL GET HTTP/1.1
1.azwee.click/en/assets/menu.png
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
PNG image data, 49 x 48, 8-bit/color RGBA, non-interlaced
Size
687 B (687 bytes)
Hash
da0b0fdd44746082b7f978a5f70f0e78
69a6755ecad7defee0b3de296d1352dae7cae626
00543da96852706a4d679197d06a00385869a5ce868c2687e7ab23a5f83fe4e4

HTTP Headers

GET /en/assets/menu.png HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 687
Content-Type: image/png
Date: Wed, 17 Apr 2024 03:53:50 GMT
Server: Kestrel
Accept-Ranges: bytes
ETag: "1d9ab7df8593f2f"
Last-Modified: Fri, 30 Jun 2023 18:09:11 GMT

1.azwee.click/en/assets/logo.png

199.21.149.68

200 OK

34 kB

URL GET HTTP/1.1
1.azwee.click/en/assets/logo.png
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
PNG image data, 720 x 721, 8-bit colormap, non-interlaced
Size
34 kB (34355 bytes)
Hash
4852c60ddb8653928e43fa9d24b911b3
e037ce421215511dbce720d6f6503e8fa9b8ea9d
07126b04b6559c56df43d120f4c5487f1ca9e335428b3d82c2d2d24459990561

HTTP Headers

GET /en/assets/logo.png HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 34355
Content-Type: image/png
Date: Wed, 17 Apr 2024 03:53:50 GMT
Server: Kestrel
Accept-Ranges: bytes
ETag: "1d9ab83779dc633"
Last-Modified: Fri, 30 Jun 2023 18:48:32 GMT

1.azwee.click/en/assets/jt.png

199.21.149.68

200 OK

4.1 kB

URL GET HTTP/1.1
1.azwee.click/en/assets/jt.png
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
Size
4.1 kB (4129 bytes)
Hash
a64f3508282fa585f502c7283cfc853a
c266d5102a4fd1d5d9980799a51a345390b5d533
ff3323d9098ef10b0d36ef5c9219481d03afb2d307a5144a6ff3f509b31110f4

HTTP Headers

GET /en/assets/jt.png HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 4129
Content-Type: image/png
Date: Wed, 17 Apr 2024 03:53:50 GMT
Server: Kestrel
Accept-Ranges: bytes
ETag: "1d5318f817f9521"
Last-Modified: Wed, 03 Jul 2019 11:07:30 GMT

1.azwee.click/en/apple.f843c50675ae358ea181.svg

199.21.149.68

200 OK

1.5 kB

URL GET HTTP/1.1
1.azwee.click/en/apple.f843c50675ae358ea181.svg
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
SVG Scalable Vector Graphics image
Size
1.5 kB (1484 bytes)
Hash
26cbb4bfb27dd56b0ed09a961f28145b
b8e84ed32f81f41251c815e0132fed0fba3489f1
c21d714e92269a3dcf05c24db9aec96171671d0dcd59b867c2acb953d3cb551a

HTTP Headers

GET /en/apple.f843c50675ae358ea181.svg HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 1484
Content-Type: image/svg+xml
Date: Wed, 17 Apr 2024 03:53:50 GMT
Server: Kestrel
Accept-Ranges: bytes
ETag: "1d9fe46cdea77cc"
Last-Modified: Sat, 14 Oct 2023 02:33:24 GMT

1.azwee.click/en/image_small.1771014580291c90faaa.svg

199.21.149.68

200 OK

898 B

URL GET HTTP/1.1
1.azwee.click/en/image_small.1771014580291c90faaa.svg
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
SVG Scalable Vector Graphics image
Size
898 B (898 bytes)
Hash
4dc220ff2f9395c2cd7c34de8776a6e7
9dfcb00873e24be99f2965c6447e393b71cd6fc1
c18d99c87523f8ef73e5dc2e86aa5917da37e5564a7f591cb43bc32049f76d88

HTTP Headers

GET /en/image_small.1771014580291c90faaa.svg HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 898
Content-Type: image/svg+xml
Date: Wed, 17 Apr 2024 03:53:50 GMT
Server: Kestrel
Accept-Ranges: bytes
ETag: "1d9fe46cdea7182"
Last-Modified: Sat, 14 Oct 2023 02:33:24 GMT

1.azwee.click/en/favicon.ico

199.21.149.68

200 OK

22 kB

URL GET HTTP/1.1
1.azwee.click/en/favicon.ico
IP
199.21.149.68:80
ASN
#7040 NETMINDERS

Requested by
http://1.azwee.click/en/main

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
22 kB (22382 bytes)
Hash
891e510219786f543ca998282ed99f45
19fe2ff6a2418bcb44b02308b998cef84199ee08
e4bdf72e2f803f7e19907c12f407ac7f7cd5f1f94bfd730b9be24b0d49191b48

HTTP Headers

GET /en/favicon.ico HTTP/1.1
Host: 1.azwee.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://1.azwee.click/en/main
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 22382
Content-Type: image/x-icon
Date: Wed, 17 Apr 2024 03:53:50 GMT
Server: Kestrel
Accept-Ranges: bytes
ETag: "1d71ee1f8b7af6e"
Last-Modified: Mon, 22 Mar 2021 06:09:52 GMT

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (26)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections