Report - hgvv.cc

Report Overview

Visitedpublic

2025-07-24 00:04:16

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
639666.cc	unknown	2025-01-03	2025-06-27	2025-07-16	3.5 kB	154 kB	38.11.156.140
hgvv.cc	unknown	2025-01-03	2025-07-24	2025-07-24	868 B	3.1 kB	0.0.0.0

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-07-24	medium	639666.cc	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	From	Size	First Seen	Last Seen
	639666.cc/site.js	ScriptElement	356 B	2025-07-19	2025-07-27
URL 639666.cc/site.js IP / ASN 38.11.156.140 #398478 PEG-HK Introduced by ScriptElement Embedded false Resource Info First Seen 2025-07-19 Last Seen 2025-07-27 Times Seen 35 Size 356 B (356 bytes) MD5 81865ced64d1b3e74dcdb0b99babbdc4 SHA1 652c232b87afd715ad707f0b38d6f78c3c658b33 SHA256 4d649224cc2c5e5d44760a22be4a5ac43d0a3b27ff10bf9bedd95b6d9cbef1c1 Format Code Loading...

	639666.cc/	ScriptElement	2.0 kB	2025-07-18	2025-08-02
URL 639666.cc/ IP / ASN 38.11.156.140 #398478 PEG-HK Introduced by ScriptElement Embedded true Resource Info First Seen 2025-07-18 Last Seen 2025-08-02 Times Seen 83 Size 2.0 kB (2044 bytes) MD5 814a85b399274e20df6d7f239e758c1d SHA1 8a28473c1e26cbcb8fb70807cba12bd7c83e62bb SHA256 946da6648d846092e8443042e93f5b888a96b027fff18b13def370bab965bee2 Format Code Loading...

HTTP Transactions (10)

URL IP Response Size

GET 639666.cc/site.js

38.11.156.140

200 OK

356 B

URL

639666.cc/site.js

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typeASCII text

First Seen2025-07-19

Last Seen2025-07-27

Times Seen35

Size356 B (356 bytes)

MD581865ced64d1b3e74dcdb0b99babbdc4

SHA1652c232b87afd715ad707f0b38d6f78c3c658b33

SHA2564d649224cc2c5e5d44760a22be4a5ac43d0a3b27ff10bf9bedd95b6d9cbef1c1

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /site.js HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:53 GMT
content-type: application/javascript
content-length: 356
last-modified: Sat, 19 Jul 2025 10:17:43 GMT
etag: "687b70c7-164"
expires: Thu, 24 Jul 2025 12:03:53 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

GET 639666.cc/images/cymdqjty.png

38.11.156.140

200 OK

79 kB

URL

639666.cc/images/cymdqjty.png

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typePNG image data, 770 x 123, 8-bit/color RGBA, non-interlaced

First Seen2023-05-11

Last Seen2025-08-02

Times Seen417

Size79 kB (79101 bytes)

MD55de59d4a688a1384642ee2a04f07d953

SHA120937b556499db737409c15cb8fb9eb6ee6f8ddd

SHA256d852bdedf0c3a36a3de95ae0bf4eefc6f7d68ee4bcb913ab62698afd83fa9005

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/cymdqjty.png HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:53 GMT
content-type: image/png
last-modified: Fri, 18 Jul 2025 17:45:33 GMT
vary: Accept-Encoding
etag: W/"687a883d-134fd"
expires: Sat, 23 Aug 2025 00:03:53 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

GET 639666.cc/images/djjr.png

38.11.156.140

200 OK

11 kB

URL

639666.cc/images/djjr.png

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typePNG image data, 162 x 64, 8-bit/color RGBA, non-interlaced

First Seen2023-05-11

Last Seen2025-08-02

Times Seen417

Size11 kB (11256 bytes)

MD5f06cafaad3c295a5c83fb8da28f4114d

SHA1cb88a01b3dbd07289448c52586733f234a1b8acb

SHA256326bd18b9d9bfe2824fb9467e76267ab0cbc0b9fc66cadb9aa49e09fb94f8e8b

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/djjr.png HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:53 GMT
content-type: image/png
last-modified: Fri, 18 Jul 2025 17:45:34 GMT
vary: Accept-Encoding
etag: W/"687a883e-2bf8"
expires: Sat, 23 Aug 2025 00:03:53 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

GET 639666.cc/favicon.ico

38.11.156.140

404 Not Found

146 B

URL

639666.cc/favicon.ico

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-03-07

Last Seen2025-08-03

Times Seen211425

Size146 B (146 bytes)

MD58eec510e57f5f732fd2cce73df7b73ef

SHA13c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA25655f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
server: nginx
date: Thu, 24 Jul 2025 00:03:54 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2

GET hgvv.cc/

0.0.0.0

0 B

URL

hgvv.cc/

IP / ASN

0.0.0.0

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5616703

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: hgvv.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

GET 639666.cc/

38.11.156.140

200 OK

2.9 kB

URL

639666.cc/

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byN/A

Resource Info

File typeHTML document, Unicode text, UTF-8 text, with very long lines (355)

First Seen2025-07-18

Last Seen2025-08-02

Times Seen83

Size2.9 kB (2878 bytes)

MD598c0d616c39b95e29c07dd728e813db6

SHA13d2e17b5e096881de23c3e1be4579b9d4135d231

SHA256c35f72315097b8ff054c00b295d2922baf98181773987356ec1fcb9c15f673bc

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:52 GMT
content-type: text/html
last-modified: Fri, 18 Jul 2025 17:55:44 GMT
vary: Accept-Encoding
etag: W/"687a8aa0-b3e"
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

GET 639666.cc/images/qsywmyxzxbyym.png

38.11.156.140

200 OK

42 kB

URL

639666.cc/images/qsywmyxzxbyym.png

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typePNG image data, 1008 x 73, 8-bit/color RGBA, non-interlaced

First Seen2023-05-11

Last Seen2025-08-02

Times Seen417

Size42 kB (41824 bytes)

MD5743b7f58030ae861d72c14efbc3fd995

SHA156f762d13e5239bb895b3469b93ec56b5dcbeaf9

SHA256dbb90b131902fea37ade85f5d948caf92bc951f1c879d85ddd322fde279d12f2

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/qsywmyxzxbyym.png HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:53 GMT
content-type: image/png
last-modified: Fri, 18 Jul 2025 17:45:35 GMT
vary: Accept-Encoding
etag: W/"687a883f-a360"
expires: Sat, 23 Aug 2025 00:03:53 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

GET 639666.cc/images/jrsc.png

38.11.156.140

200 OK

12 kB

URL

639666.cc/images/jrsc.png

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typePNG image data, 162 x 64, 8-bit/color RGBA, non-interlaced

First Seen2023-05-11

Last Seen2025-08-02

Times Seen416

Size12 kB (11701 bytes)

MD5139dc0ff66787d565d2cdea9374be102

SHA1b7489a0c8daf0310a3436ea564de229388f0c9b9

SHA25667430dccc688fad7dd6aa698dd1e7bf785f6a5ae444c98721b2a2bcee9c374e5

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/jrsc.png HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:53 GMT
content-type: image/png
last-modified: Fri, 18 Jul 2025 17:45:35 GMT
vary: Accept-Encoding
etag: W/"687a883f-2db5"
expires: Sat, 23 Aug 2025 00:03:53 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

GET hgvv.cc/

38.11.156.139

301 Moved Permanently

2.9 kB

URL

hgvv.cc/

IP / ASN

38.11.156.139

#398478 PEG-HK

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-03

Times Seen5616703

Size2.9 kB (2878 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: hgvv.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Thu, 24 Jul 2025 00:03:51 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://639666.cc
Strict-Transport-Security: max-age=31536000

GET 639666.cc/images/jjtz.png

38.11.156.140

200 OK

4.4 kB

URL

639666.cc/images/jjtz.png

IP / ASN

38.11.156.140

#398478 PEG-HK

Requested byhttps://639666.cc/

Resource Info

File typePNG image data, 263 x 68, 8-bit/color RGBA, non-interlaced

First Seen2023-05-11

Last Seen2025-08-02

Times Seen418

Size4.4 kB (4350 bytes)

MD5296251c3bc3905a542b915496ab988d1

SHA19230449dc54f452b62141aca9eb50090564d0254

SHA256c00f92292a5fa5bf991a81735829a1b0ba3db32147efe6ba79fe10d5b6678120

Certificate Info

IssuerLet's Encrypt

Subjectwww365.ba

FingerprintE7:3C:DE:C6:32:96:C7:DA:2E:D0:AB:58:F1:0B:9E:75:DF:28:FF:64

ValidityFri, 18 Jul 2025 16:48:37 GMT - Thu, 16 Oct 2025 16:48:36 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/jjtz.png HTTP/1.1
Host: 639666.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://639666.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 24 Jul 2025 00:03:53 GMT
content-type: image/png
last-modified: Fri, 18 Jul 2025 17:45:34 GMT
vary: Accept-Encoding
etag: W/"687a883e-10fe"
expires: Sat, 23 Aug 2025 00:03:53 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2