| |  64.225.91.73 | 200 OK | 336 B |
URL User Request GET HTTP/1.1IP64.225.91.73:443 ASN#14061 DIGITALOCEAN-ASN
CertificateIssuerLet's Encrypt Subjectqetyhyg.com Fingerprint59:CE:35:9F:8E:F0:E5:5F:50:6D:81:08:DB:A5:2A:D2:66:12:BA:E9 ValidityWed, 16 Oct 2024 23:46:43 GMT - Tue, 14 Jan 2025 23:46:42 GMT
File typeHTML document, ASCII text Hash3b03d93d3487806337b5c6443ce7a62d 93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0 7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login.php HTTP/1.1
Host: qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 18 Oct 2024 23:08:32 GMT
Content-Type: text/html
Last-Modified: Wed, 22 Feb 2023 21:25:52 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"63f68860-251"
Content-Encoding: gzip
|
|
| domaincntrol.com/?orighost=https://qetyhyg.com/login.php |  104.18.26.45 | 200 OK | 24 B |
URL GET HTTP/2domaincntrol.com/?orighost=https://qetyhyg.com/login.php IP104.18.26.45:443
Requested byhttps://qetyhyg.com/login.php CertificateIssuerGoogle Trust Services Subjectdomaincntrol.com FingerprintAD:57:54:53:FC:F4:AB:85:D2:AB:C4:FC:89:12:65:E8:BE:AD:D8:9B ValiditySat, 21 Sep 2024 09:39:44 GMT - Fri, 20 Dec 2024 09:39:43 GMT
File typeASCII text, with no line terminators Hashdaa2ca1aab2d1b57760492d5a647af92 21aa3c4809654d88d1eeac6a8e550a8dbcd3e240 1f34327dc0ab513263661fdc2ff50d55bc7acc731899e0f03900b4f91d36d8d1
GET /?orighost=https://qetyhyg.com/login.php HTTP/1.1
Host: domaincntrol.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://qetyhyg.com/
Origin: https://qetyhyg.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 18 Oct 2024 23:08:33 GMT
content-type: text/javascript;charset=UTF-8
content-length: 24
access-control-allow-origin: *
x_details: {"destination":"sedo","orighost":"qetyhyg.com","type":"org","finalurl":"http://ww2.qetyhyg.com","browser":"firefox","os":"linux","country":"NO","device":"desktop","isbot":false,"botscore":99}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d4c30e44d1156c6-OSL
X-Firefox-Spdy: h2
|
|
| ww2.qetyhyg.com/img.sedoparking.com/images/js_preloader.gif |  64.190.63.136 | 441 No Reason Phrase | 0 B |
URL GET HTTP/2ww2.qetyhyg.com/img.sedoparking.com/images/js_preloader.gif IP64.190.63.136:443
CertificateIssuerDigiCert Inc Subjectww2.qetyhyg.com FingerprintF8:8D:A1:6F:6D:90:6B:29:13:F4:BA:30:08:A8:58:20:67:EB:62:4C ValidityThu, 23 May 2024 00:00:00 GMT - Thu, 22 May 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img.sedoparking.com/images/js_preloader.gif HTTP/1.1
Host: ww2.qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww2.qetyhyg.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 441 No Reason Phrase
date: Fri, 18 Oct 2024 23:08:34 GMT
server: Parking/1.0
content-length: 0
X-Firefox-Spdy: h2
|
|
| ww2.qetyhyg.com/search/tsc.php?ses=ogc45CEUXZkHzTPxqxnfr7lvzyrcSuEoFamC0yoeGYj_JxoizxDgFasLu0of1Kyqawr1wJleEd9cWyiiXLUgPYnO4RPQXxXLYssTXjxAptmFm8IMr-4nQv7gyDViS_aNkVh-QJHsvKO7OXtlOcgRz_hT0X3LO3ax_CskSFS54gSV7njBJ10N1e6WB7sqVolMtti3syKm4EZUE9Hp1xfXjq1bAzRlQKAnwTXbCYs4nU-GBUnG-mRg7ow16xj8yLpywBY9VVwAiRBBMqByDEpYwC73ecauV1boz8C0FaqvmmogZnApcmJk0LyuEP__nk3TyDzc5jg5R93PHftLPUIB9_ajeSF7cdaKy6yql9GYR6lvUTcv_UV-r-E1q0pig&cv=2 | 64.190.63.136 | 200 OK | 0 B |
URL GET HTTP/2ww2.qetyhyg.com/search/tsc.php?ses=ogc45CEUXZkHzTPxqxnfr7lvzyrcSuEoFamC0yoeGYj_JxoizxDgFasLu0of1Kyqawr1wJleEd9cWyiiXLUgPYnO4RPQXxXLYssTXjxAptmFm8IMr-4nQv7gyDViS_aNkVh-QJHsvKO7OXtlOcgRz_hT0X3LO3ax_CskSFS54gSV7njBJ10N1e6WB7sqVolMtti3syKm4EZUE9Hp1xfXjq1bAzRlQKAnwTXbCYs4nU-GBUnG-mRg7ow16xj8yLpywBY9VVwAiRBBMqByDEpYwC73ecauV1boz8C0FaqvmmogZnApcmJk0LyuEP__nk3TyDzc5jg5R93PHftLPUIB9_ajeSF7cdaKy6yql9GYR6lvUTcv_UV-r-E1q0pig&cv=2 IP64.190.63.136:443
CertificateIssuerDigiCert Inc Subjectww2.qetyhyg.com FingerprintF8:8D:A1:6F:6D:90:6B:29:13:F4:BA:30:08:A8:58:20:67:EB:62:4C ValidityThu, 23 May 2024 00:00:00 GMT - Thu, 22 May 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /search/tsc.php?ses=ogc45CEUXZkHzTPxqxnfr7lvzyrcSuEoFamC0yoeGYj_JxoizxDgFasLu0of1Kyqawr1wJleEd9cWyiiXLUgPYnO4RPQXxXLYssTXjxAptmFm8IMr-4nQv7gyDViS_aNkVh-QJHsvKO7OXtlOcgRz_hT0X3LO3ax_CskSFS54gSV7njBJ10N1e6WB7sqVolMtti3syKm4EZUE9Hp1xfXjq1bAzRlQKAnwTXbCYs4nU-GBUnG-mRg7ow16xj8yLpywBY9VVwAiRBBMqByDEpYwC73ecauV1boz8C0FaqvmmogZnApcmJk0LyuEP__nk3TyDzc5jg5R93PHftLPUIB9_ajeSF7cdaKy6yql9GYR6lvUTcv_UV-r-E1q0pig&cv=2 HTTP/1.1
Host: ww2.qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww2.qetyhyg.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 23:08:34 GMT
server: Parking/1.0
x-cache-miss-from: parking-697b9cf7ff-27z2s
content-length: 0
X-Firefox-Spdy: h2
|
|
| ww2.qetyhyg.com/search/redirect.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5 | 64.190.63.136 | 302 Found | 0 B |
URL User Request GET ww2.qetyhyg.com/search/redirect.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5 IP64.190.63.136:0
CertificateIssuerDigiCert Inc Subjectww2.qetyhyg.com FingerprintF8:8D:A1:6F:6D:90:6B:29:13:F4:BA:30:08:A8:58:20:67:EB:62:4C ValidityThu, 23 May 2024 00:00:00 GMT - Thu, 22 May 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /search/redirect.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5 HTTP/1.1
Host: ww2.qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ww2.qetyhyg.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 23:08:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 18 Oct 2024 23:08:34 GMT
location: /search/tcerider.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5
pragma: no-cache
server: Parking/1.0
x-cache-miss-from: parking-697b9cf7ff-b6z57
content-length: 0
X-Firefox-Spdy: h2
|
|
| ww2.qetyhyg.com/search/tcerider.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5 | 64.190.63.136 | 302 Found | 313 B |
URL User Request GET ww2.qetyhyg.com/search/tcerider.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5 IP64.190.63.136:0
CertificateIssuerDigiCert Inc Subjectww2.qetyhyg.com FingerprintF8:8D:A1:6F:6D:90:6B:29:13:F4:BA:30:08:A8:58:20:67:EB:62:4C ValidityThu, 23 May 2024 00:00:00 GMT - Thu, 22 May 2025 23:59:59 GMT
File typeHTML document, ASCII text Hashdf84b8ad392fc0d986f3fe2a3feba293 76437adf9883d9cb609fdda96c088fb796adcc90 c26187495b257a9bc67444a16c062c04daa29417db04cd8874924ebeea1e7bfb
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /search/tcerider.php?f=https%3A%2F%2Fxml.sedodna.com%2Fclick%3Fi%3DtL4BLp0m7uM_0&v=NWU4MmY5NTFmNjI5YzVlZGI1M2RhYzdlOGExODI5MWIJMQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTU0NS42OTE5ODMxOQl3dzIucWV0eWh5Zy5jb202NzEyZWE3MWEyYTgzNS4zMjEyMzA0NwkxNzI5MjkyOTE0CWFkXzYzXzA%3D&l=ogc3VUfPvTC5jw7TAGReMeqbErY6Y83y03nW3oL3uoPlM982ViIXyqkqm4OKlA09-yw9cqSNGDcb30Dbl57SFAjSMB7eQsH87zycCZQIcn_ByUkN0MOF815CoVsRzq0LG6XhSv91Mhc088Yz1TVRoxEPiYf8jHDuGr9QoJR2Y4qn4csniVsu9WArQlwZtGaYkzbSZtyp5LTloUQfjL2a5QkwtnbX84QWn7AAw9WuK4Ccb5AT85h3wJeENLyQBiir_gOwG-O1SoLe-vMiNdViySccce1YNkpoZI-grtGngsn7mT5Q3TiBtj_Ai6nrP5Abqt8amwgvw-aAGuy4E9fQfeLK1DiUaIX-z0pYyHV9vir1r9Jh5xFjQT8__Bv5JjHssMU-_QLrQSagk56LsrKo1O8oSrZx8vJkCmi8lA5kmP7NhHw_paZ7kwbeQ2FOhghePTuWSVpc0rL1fMlLFkamMjPpRHYdhrMUtBnmhUO9gewT9HHRwcjQMXMwpfRFcXd2LySY4LzfRw2y-0Pn9BpysW7cgoBJuccFAUqbUprCTujPdEqTIObuhmCPF5hYaFJZTaEHew043R58RWD7V8kGX32f_BM9mexvuBBIdjtWUqALWVEOdfC-YTOJg780HAYqCa2fTa59ZlWCmdECbLZbmyvtBWkhVLeI1LtPpaATf3vryOr3h5xRRmc_njb1pLHqrr_Y6j_HCY5 HTTP/1.1
Host: ww2.qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ww2.qetyhyg.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 23:08:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 18 Oct 2024 23:08:34 GMT
location: https://xml.sedodna.com/click?i=tL4BLp0m7uM_0
pragma: no-cache
server: Parking/1.0
x-cache-miss-from: parking-697b9cf7ff-z9qww
X-Firefox-Spdy: h2
|
|
| | 64.190.63.136 | 200 OK | 2.9 kB |
URL User Request GET HTTP/2IP64.190.63.136:443
CertificateIssuerDigiCert Inc Subjectww2.qetyhyg.com FingerprintF8:8D:A1:6F:6D:90:6B:29:13:F4:BA:30:08:A8:58:20:67:EB:62:4C ValidityThu, 23 May 2024 00:00:00 GMT - Thu, 22 May 2025 23:59:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (2928), with no line terminators Hash681dabc5f82945161df68836d6d60e47 32c11abb1ac5083f0d067b3b0a79f53a893eda1f 393b2ff3803b239a3a107ad33511ea759d77ebb6b0d978f8ff8d0a9791fdd1b1
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: ww2.qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 23:08:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 18 Oct 2024 23:08:33 GMT
pragma: no-cache
server: Parking/1.0
vary: Accept-Encoding
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_LbJIO6BxMMauhXnG/dWHf+fiiMcbNqH8gVWtijjyzhXrCvDaKnZieb3Uu3RBlOc0vNamaDNL9zr/XAESIZ8/Dg==
x-cache-miss-from: parking-697b9cf7ff-n4brc
X-Firefox-Spdy: h2
|
|
| qetyhyg.com/favicon.ico | 0.0.0.0 | | 0 B |
IP0.0.0.0:0
Requested byhttps://qetyhyg.com/login.php CertificateIssuerLet's Encrypt Subjectqetyhyg.com Fingerprint59:CE:35:9F:8E:F0:E5:5F:50:6D:81:08:DB:A5:2A:D2:66:12:BA:E9 ValidityWed, 16 Oct 2024 23:46:43 GMT - Tue, 14 Jan 2025 23:46:42 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: qetyhyg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://qetyhyg.com/login.php
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
|
|
| xml.sedodna.com/click?i=tL4BLp0m7uM_0 | 0.0.0.0 | 302 Found | 0 B |
URL User Request GET xml.sedodna.com/click?i=tL4BLp0m7uM_0 IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?i=tL4BLp0m7uM_0 HTTP/1.1
Host: xml.sedodna.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ww2.qetyhyg.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 18 Oct 2024 23:08:35 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Location: http://q3.quotes.com/e5f9c5a4-8da5-11ef-b8ea-7d0fe64b5d23
|
|
| q3.quotes.com/e5f9c5a4-8da5-11ef-b8ea-7d0fe64b5d23 | 0.0.0.0 | | 0 B |
URL User Request GET q3.quotes.com/e5f9c5a4-8da5-11ef-b8ea-7d0fe64b5d23 IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /e5f9c5a4-8da5-11ef-b8ea-7d0fe64b5d23 HTTP/1.1
Host: q3.quotes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|