Report - m.exactag.com/ai.aspx?tc=d9017252bc40b07205bbd26a23a8d2e6b6b4f9&url=http:shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20=

Report Overview

Visited public
2024-07-02 15:30:50
Tags
URL
m.exactag.com/ai.aspx?tc=d9017252bc40b07205bbd26a23a8d2e6b6b4f9&url=http:shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20=
Finishing URL
example.com/
IP / ASN
213.202.235.9
#24961 myLoc managed IT AG
Title
Example Domain

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
example.com	9944	1995-08-14	2013-07-30 17:54:12	2024-07-01 07:17:21	895 B	2.1 kB	93.184.215.14
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-01 18:12:04	1.3 kB	3.6 kB	23.36.76.226
m.exactag.com	11114	2010-08-24	2015-04-09 07:39:20	2024-07-02 14:52:49	597 B	1.0 kB	213.202.235.9
shannonsrustictreasures.net	unknown	2023-11-18	2024-01-26 12:20:59	2024-01-26 12:20:59	440 B	262 B	103.83.194.55
mmedinajbuild.com	unknown	unknown	No data	No data	506 B	179 B	185.143.223.153

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-07-02 15:30:26	low	Client IP	192.0.78.27	ETPRO INFO Referer Obfuscation/Hiding Service Domain (href .li in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (9)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash b8ee6ca153df6819132dd5d8a6ba5c76 0ed0f0f631777272bd71ba23719e71695c9d95e1 bdca7ce7bb6febd6a6afb56a828cf4422c1a8971524484e8128cafad8e6b3367 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "BDCA7CE7BB6FEBD6A6AFB56A828CF4422C1A8971524484E8128CAFAD8E6B3367" Last-Modified: Tue, 02 Jul 2024 11:47:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=14863 Expires: Tue, 02 Jul 2024 19:38:07 GMT Date: Tue, 02 Jul 2024 15:30:24 GMT Connection: keep-alive`

	m.exactag.com/ai.aspx?tc=d9017252bc40b07205bbd26a23a8d2e6b6b4f9&url=http:shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20=	213.202.235.9		0 B
URL m.exactag.com/ai.aspx?tc=d9017252bc40b07205bbd26a23a8d2e6b6b4f9&url=http:shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20= IP 213.202.235.9:0 ASN #24961 myLoc managed IT AG File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /ai.aspx?tc=d9017252bc40b07205bbd26a23a8d2e6b6b4f9&url=http:shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20= HTTP/1.1 Host: m.exactag.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 302 Found Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html; charset=iso-8859-1 Expires: Mon, 26 Jul 1997 05:00:00 GMT Last-Modified: Di, 02 Jul 2024 03:30:25 GMT Location: http:shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20= P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Max-Age: 1000 Access-Control-Allow-Headers: * X-ET-Code: 20 X-ET-Camp: 0 X-ET-Monitoring: 1 Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64 Strict-Transport-Security: max-age=31536000 Date: Tue, 02 Jul 2024 15:30:24 GMT Connection: close Content-Length: 0 cross-origin-resource-policy: cross-origin X-Xss-Protection: 0 X-Content-Type-Options: nosniff

	shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20=	103.83.194.55		0 B
URL shannonsrustictreasures.net/winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20= IP 103.83.194.55:0 ASN #393960 HOST4GEEKS-LLC File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /winner/50204//dGhlZXNvcGdyb3VwQHVicy5jb20= HTTP/1.1 Host: shannonsrustictreasures.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 15:30:25 GMT Server: Apache refresh: 0;url=https://mmedinajbuild.com/?xzxkbpul&qrc=theesopgroup@ubs.com Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 05d56c530ebd133a0b430a389c8ac9f5 646b0f2c9efa66aabb5677b451e1ed2b2e9c4ee4 3c9d967ca76496b209cfbd13ac38752c85cf4639561ce4ab7284d92b3b226831 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "3C9D967CA76496B209CFBD13AC38752C85CF4639561CE4AB7284D92B3B226831" Last-Modified: Mon, 01 Jul 2024 13:46:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=14274 Expires: Tue, 02 Jul 2024 19:28:19 GMT Date: Tue, 02 Jul 2024 15:30:25 GMT Connection: keep-alive`

	mmedinajbuild.com/?xzxkbpul&qrc=theesopgroup@ubs.com	185.143.223.153		0 B
URL mmedinajbuild.com/?xzxkbpul&qrc=theesopgroup@ubs.com IP 185.143.223.153:0 ASN #207713 Global Internet Solutions LLC File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /?xzxkbpul&qrc=theesopgroup@ubs.com HTTP/1.1 Host: mmedinajbuild.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 302 Found location: https://href.li?https://example.com Date: Tue, 02 Jul 2024 15:30:26 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked`

	example.com/	93.184.215.14	200 OK	648 B
URL User Request GET HTTP/2 example.com/ IP 93.184.215.14:443 ASN #15133 EDGECAST Certificate IssuerDigiCert Inc Subjectwww.example.org Fingerprint4D:A2:5A:6D:5E:F6:2C:5F:95:C7:BD:0A:73:EA:3C:17:7B:36:99:9D ValidityTue, 30 Jan 2024 00:00:00 GMT - Sat, 01 Mar 2025 23:59:59 GMT File type HTML document, ASCII text Size 648 B (648 bytes) Hash 84238dfc8092e5d9c0dac8ef93371a07 4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047 ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9 HTTP Headers `GET / HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK content-encoding: gzip accept-ranges: bytes age: 420499 cache-control: max-age=604800 content-type: text/html; charset=UTF-8 date: Tue, 02 Jul 2024 15:30:26 GMT etag: "3147526947" expires: Tue, 09 Jul 2024 15:30:26 GMT last-modified: Thu, 17 Oct 2019 07:18:26 GMT server: ECAcc (nyd/D13B) vary: Accept-Encoding x-cache: HIT content-length: 648 X-Firefox-Spdy: h2`

	example.com/favicon.ico	93.184.215.14	404 Not Found	648 B
URL GET HTTP/2 example.com/favicon.ico IP 93.184.215.14:443 ASN #15133 EDGECAST Requested by https://example.com/ Certificate IssuerDigiCert Inc Subjectwww.example.org Fingerprint4D:A2:5A:6D:5E:F6:2C:5F:95:C7:BD:0A:73:EA:3C:17:7B:36:99:9D ValidityTue, 30 Jan 2024 00:00:00 GMT - Sat, 01 Mar 2025 23:59:59 GMT File type HTML document, ASCII text Size 648 B (648 bytes) Hash 84238dfc8092e5d9c0dac8ef93371a07 4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047 ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9 HTTP Headers `GET /favicon.ico HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://example.com/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers` `HTTP/2 404 Not Found content-encoding: gzip accept-ranges: bytes age: 421580 cache-control: max-age=604800 content-type: text/html; charset=UTF-8 date: Tue, 02 Jul 2024 15:30:27 GMT expires: Tue, 09 Jul 2024 15:30:27 GMT last-modified: Thu, 27 Jun 2024 18:24:07 GMT server: ECAcc (nyd/D157) vary: Accept-Encoding x-cache: 404-HIT content-length: 648 X-Firefox-Spdy: h2`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash c4b71305103f33b56dd398fb1f3fa9fe 6237cf96ced2a5d69a73769180ae8250221727ea 4120fbb0536a3608210c487750025bea2ff87804924732c527207e00add13a34 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "4120FBB0536A3608210C487750025BEA2FF87804924732C527207E00ADD13A34" Last-Modified: Sun, 30 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5005 Expires: Tue, 02 Jul 2024 16:53:52 GMT Date: Tue, 02 Jul 2024 15:30:27 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash c4b71305103f33b56dd398fb1f3fa9fe 6237cf96ced2a5d69a73769180ae8250221727ea 4120fbb0536a3608210c487750025bea2ff87804924732c527207e00add13a34 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "4120FBB0536A3608210C487750025BEA2FF87804924732C527207E00ADD13A34" Last-Modified: Sun, 30 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5005 Expires: Tue, 02 Jul 2024 16:53:52 GMT Date: Tue, 02 Jul 2024 15:30:27 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (9)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers