| gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== | 200.69.17.158 | 200 OK | 11 kB |
URL User Request GET gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== IP 200.69.17.158:443
CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
File typeHTML document, Unicode text, UTF-8 text Hash358aebc3f608549a7e36ec5a591da5c1 cb85feabccbf6c3190a1848cd23e9d65d1e32af7 526f22cd62a3d354769828a006293a6a516972082823782f981ed7ec19a23f3b
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/7.1.33
vary: Accept-Encoding,User-Agent
content-encoding: br
content-length: 2551
content-type: text/html; charset=UTF-8
date: Wed, 07 May 2025 20:46:18 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| gulfracing.net/io/d/support/modal.jpg | 200.69.17.158 | 200 OK | 4.2 kB |
URL GET gulfracing.net/io/d/support/modal.jpg IP 200.69.17.158:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 603x337, components 3 Hash6823d7bce49dc756c0a6d3f14f68472f d508b8b1da312a9206bf013876a1ad8307b15e1a 6de4e47dc7598fd599f3d81c7a20445d4f2b5e08788b4733306c59b1661a4d8f
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /io/d/support/modal.jpg HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Wed, 18 Sep 2024 14:54:54 GMT
accept-ranges: bytes
content-length: 4184
content-type: image/jpeg
date: Wed, 07 May 2025 20:46:19 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| gulfracing.net/io/d/assets/php/policy.php | 200.69.17.158 | 200 OK | 225 B |
URL POST gulfracing.net/io/d/assets/php/policy.php IP 200.69.17.158:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
Hashc0fd7a6e5fb4f37ea8019653bc45c46e e11c12f8af83948d3b141e536b19b27f05d1932d b73ca8e1e38b9843ea7c4625a05dbf150f76e22112b83b4538b9c67648f4b449
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
POST /io/d/assets/php/policy.php HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Content-Type: application/json
Content-Length: 76
Origin: https://gulfracing.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/7.1.33
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Origin, Content-Type, X-Auth-Token
vary: Accept-Encoding,User-Agent
content-encoding: br
content-length: 160
content-type: text/html; charset=UTF-8
date: Wed, 07 May 2025 20:46:19 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| mail.army.mil/ | 0.0.0.0 | | 0 B |
IP 0.0.0.0:0
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: mail.army.mil
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| gulfracing.net/io/d/support/js/ban.js | 200.69.17.158 | 200 OK | 3.7 kB |
URL GET gulfracing.net/io/d/support/js/ban.js IP 200.69.17.158:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
File typeASCII text, with CRLF line terminators Hash5bfb54ce7479dceac44ece2a293fd135 4f849108827ff61096cfc16c4cb1eddf26fc862c 030470dd2d9f1f2ba294ef4a9110bcce186d03772cf1e423fbe721d12c3c1f9b
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /io/d/support/js/ban.js HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Wed, 18 Sep 2024 14:55:58 GMT
accept-ranges: bytes
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 1373
content-type: text/javascript
date: Wed, 07 May 2025 20:46:18 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| gulfracing.net/io/d/support/banner.jpg | 200.69.17.158 | 200 OK | 12 kB |
URL GET gulfracing.net/io/d/support/banner.jpg IP 200.69.17.158:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 120x120, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 422x71, components 3 Hash5b0c9f5f16144d656edefe2b4c471b20 866f78926112f0416515c2bd3c1c86e770ab9b74 063f7cb5471301f5296d6334fa82ddb0ed5017a7ef7ce64645a1782a1e1da585
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /io/d/support/banner.jpg HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Wed, 18 Sep 2024 14:54:44 GMT
accept-ranges: bytes
content-length: 12194
content-type: image/jpeg
date: Wed, 07 May 2025 20:46:18 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| gulfracing.net/io/d/support/signin.jpg | 200.69.17.158 | 200 OK | 3.9 kB |
URL GET gulfracing.net/io/d/support/signin.jpg IP 200.69.17.158:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 101x55, components 3 Hash565824e7f1656d389eda6c49d5bd503e 1653fa0bb739de839394862b82c6d5db9951074b afb0b6824e3a0bd79c334841f2b71f96df07c6f5baa54635a3ef6bde2c018813
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /io/d/support/signin.jpg HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Wed, 18 Sep 2024 14:55:02 GMT
accept-ranges: bytes
content-length: 3875
content-type: image/jpeg
date: Wed, 07 May 2025 20:46:19 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| gulfracing.net/io/d/support/favicon.jpg | 200.69.17.158 | 500 Internal Server Error | 0 B |
URL GET gulfracing.net/io/d/support/favicon.jpg IP 200.69.17.158:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerLet's Encrypt Subjectgulfracing.net FingerprintFE:85:23:0F:39:6E:81:39:61:48:24:0A:45:FF:69:0B:D9:D7:84:F8 ValidityMon, 28 Apr 2025 00:20:44 GMT - Sun, 27 Jul 2025 00:20:43 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /io/d/support/favicon.jpg HTTP/1.1
Host: gulfracing.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA==
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 500 Internal Server Error
x-powered-by: PHP/7.1.33
vary: Accept-Encoding,User-Agent
content-encoding: br
content-length: 1
content-type: text/html; charset=UTF-8
date: Wed, 07 May 2025 20:46:19 GMT
server: Apache
X-Firefox-Spdy: h2
|
|
| www.google.com/s2/favicons?domain=army.mil | 142.250.74.68 | 301 Moved Permanently | 726 B |
URL GET www.google.com/s2/favicons?domain=army.mil IP 142.250.74.68:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerGoogle Trust Services Subjectwww.google.com FingerprintFD:1E:8C:23:6E:3E:CE:28:8F:BB:1E:C1:87:A0:77:5D:45:20:F7:03 ValidityMon, 31 Mar 2025 08:56:21 GMT - Mon, 23 Jun 2025 08:56:20 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /s2/favicons?domain=army.mil HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gulfracing.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
location: https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://army.mil&size=16
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 07 May 2025 20:46:19 GMT
expires: Wed, 07 May 2025 21:16:19 GMT
cache-control: public, max-age=1800
server: sffe
content-length: 328
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://army.mil&size=16 | 142.250.74.36 | 404 Not Found | 726 B |
URL GET t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://army.mil&size=16 IP 142.250.74.36:443
Requested byhttps://gulfracing.net/io/d/?mxid=dXNhcm15Lndlc3Rlcm4tZmllbGQtb2ZmaWNlLmNpZEBhcm15Lm1pbA== CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint62:05:36:C2:8E:4C:CD:95:1E:1C:75:06:44:A3:57:E5:C0:17:02:80 ValidityMon, 31 Mar 2025 08:55:35 GMT - Mon, 23 Jun 2025 08:55:34 GMT
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashb8a0bf372c762e966cc99ede8682bc71 2d7c9b60d1e2b4f4726141de2e4ab738110b9287 59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://army.mil&size=16 HTTP/1.1
Host: t2.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gulfracing.net/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
cross-origin-resource-policy: cross-origin
content-type: image/png
x-content-type-options: nosniff
date: Wed, 07 May 2025 20:46:19 GMT
server: sffe
content-length: 726
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|