Report - ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183

Report Overview

Visited public
2023-11-04 12:35:50
Tags
URL
ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183
Finishing URL
ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
IP / ASN
199.59.243.225
#16509 AMAZON-02
Title
gdmhost.ga - gdmhost Ressurser og informasjon

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ww25.vps3.gdmhost.ga	unknown	unknown	No data	No data	2.0 kB	36 kB	199.59.243.225
ww01.gdmhost.ga	unknown	unknown	No data	No data	628 B	443 B	103.224.182.210
ww16.gdmhost.ga	unknown	unknown	No data	No data	1.8 kB	8.2 kB	64.190.63.136
img.sedoparking.com	54200	2001-09-18	2013-04-23 00:23:29	2023-11-04 05:10:38	724 B	29 kB	205.234.175.175
www.google.com	7	1997-09-15	2015-05-10 13:11:19	2023-11-04 02:18:07	2.3 kB	59 kB	142.250.74.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-04 12:35:32	low	Client IP	Internal IP	ET INFO DNS Query for Suspicious .ga Domain
2023-11-04 12:35:33	low	Client IP	199.59.243.225	ET INFO Suspicious Domain (*.ga) in TLS SNI
2023-11-04 12:35:33	medium	Client IP	199.59.243.225	ET INFO HTTP Request to a *.ga domain
2023-11-04 12:35:33	medium	Client IP	199.59.243.225	ET INFO HTTP Request to a *.ga domain
2023-11-04 12:35:33	medium	Client IP	199.59.243.225	ET INFO HTTP POST Request to Suspicious *.ga Domain
2023-11-04 12:35:33	medium	Client IP	199.59.243.225	ET INFO HTTP Request to a *.ga domain
2023-11-04 12:35:35	medium	Client IP	64.190.63.136	ET INFO HTTP Request to a *.ga domain
2023-11-04 12:35:35	medium	Client IP	64.190.63.136	ET INFO HTTP Request to a *.ga domain
2023-11-04 12:35:36	medium	Client IP	64.190.63.136	ET INFO HTTP Request to a *.ga domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30	ScriptElement	2.9 kB	2024-08-20	2024-08-20
Pretty URL ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30 IP 64.190.63.136 ASN #47846 SEDO GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-20 20:57 Last Seen2024-08-20 20:57 Times Seen1 Hash 2f3ac49c238c4150d6603b93703c3790 124e5593e84f77a30a7833f3e98f965326771c4e be53b8edeebb009accc35136387ea5dd829aabf0430ebda275348b941116f3b8 Loading...

	www.google.com/afs/ads?adsafe=low&adtest=off&psid=9618345430&channel=exp-0051%2Cauxa-control-1%2C445328&client=dp-sedo92_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fww16.gdmhost.ga%2Fcaf%2F%3Fses%3DY3JlPTE2OTkxMDEzMzUmdGNpZD13dzE2LmdkbWhvc3QuZ2E2NTQ2M2E5NzlmNDQ0MC45Nzc3MjUyMCZ0YXNrPXNlYXJjaCZkb21haW49Z2RtaG9zdC5nYSZhX2lkPTMmc2Vzc2lvbj14NFFvUXZMbVhNY2o2RG5JcnBQTA%3D%3D&type=3&uiopt=false&swp=as-drid-2777688820344496&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003&format=r3%7Cs&nocache=3421699101335909&num=0&output=afd_ads&domain_name=ww16.gdmhost.ga&v=3&bsl=8&pac=0&u_his=3&u_tz=0&dt=1699101335926&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=944&frm=0&cl=578165713&uio=--&cont=rb-default&jsid=caf&jsv=578165713&rurl=http%3A%2F%2Fww16.gdmhost.ga%2F%3Fpid%3D9POT3387I%26pbsubid%3Dfb7149e7-c2c0-4ff0-8c3b-c30cde41865a%26noads%3Dhttp%253A%252F%252Fww01.gdmhost.ga%252F%253Fskipskenzo%253Dtrue%26sub1%3D20231104-2335-3549-9aad-a9d96de1ed30&referer=http%3A%2F%2Fww25.vps3.gdmhost.ga%2F	ScriptElement	849 B	2024-08-20	2024-08-20
Pretty URL www.google.com/afs/ads?adsafe=low&adtest=off&psid=9618345430&channel=exp-0051%2Cauxa-control-1%2C445328&client=dp-sedo92_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fww16.gdmhost.ga%2Fcaf%2F%3Fses%3DY3JlPTE2OTkxMDEzMzUmdGNpZD13dzE2LmdkbWhvc3QuZ2E2NTQ2M2E5NzlmNDQ0MC45Nzc3MjUyMCZ0YXNrPXNlYXJjaCZkb21haW49Z2RtaG9zdC5nYSZhX2lkPTMmc2Vzc2lvbj14NFFvUXZMbVhNY2o2RG5JcnBQTA%3D%3D&type=3&uiopt=false&swp=as-drid-2777688820344496&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003&format=r3%7Cs&nocache=3421699101335909&num=0&output=afd_ads&domain_name=ww16.gdmhost.ga&v=3&bsl=8&pac=0&u_his=3&u_tz=0&dt=1699101335926&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=944&frm=0&cl=578165713&uio=--&cont=rb-default&jsid=caf&jsv=578165713&rurl=http%3A%2F%2Fww16.gdmhost.ga%2F%3Fpid%3D9POT3387I%26pbsubid%3Dfb7149e7-c2c0-4ff0-8c3b-c30cde41865a%26noads%3Dhttp%253A%252F%252Fww01.gdmhost.ga%252F%253Fskipskenzo%253Dtrue%26sub1%3D20231104-2335-3549-9aad-a9d96de1ed30&referer=http%3A%2F%2Fww25.vps3.gdmhost.ga%2F IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-20 20:57 Last Seen2024-08-20 20:57 Times Seen1 Hash 1406ec4acd9da3e9aa990b9be31a9d36 8edddc905089345f674cf2361fccac6a6d2afe3c 890a49cdec2144124162388004f68ddee7872095157039911e50222322f71264 Loading...

	www.google.com/afs/ads/i/iframe.html	ScriptElement	1.3 kB	2023-04-05	2025-03-02
Pretty URL www.google.com/afs/ads/i/iframe.html IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-05 04:36 Last Seen2025-03-02 05:25 Times Seen67768 Hash 33839cb72649c81ab58b763c95b4a163 0c9b62881e660fded013cee58439ae287690065a cdded269406c9b2b49a3066d12e75913abf338cdd7fa00e31fff299efef1cb76 Loading...

	www.google.com/adsense/domains/caf.js	ScriptElement	150 kB	2023-11-02	2024-08-20
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-02 23:17 Last Seen2024-08-20 21:20 Times Seen126 Hash fb6bf254d812327311ff102553a6831f db3fb042ac8ef93b0ecc3aaabfcb98e45882321b 6de005c99f6033822fcf12d952219ef6798ad0536637f38d281f16cbc0c2cf46 Loading...

	ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30	ScriptElement	622 B	2023-03-08	2025-01-29
Pretty URL ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30 IP 64.190.63.136 ASN #47846 SEDO GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 22:20 Last Seen2025-01-29 07:06 Times Seen3041 Hash 7092a8d1b298a7bf4ee7eea987b0526b 6402a42f627c9d747b1fbb40289398491188b534 cb876f47b991283892edcb04daa58aae2e223eb174699f8b6d8ffc59e7bf1405 Loading...

	www.google.com/adsense/domains/caf.js	ScriptElement	150 kB	2023-11-02	2023-11-08
Pretty URL www.google.com/adsense/domains/caf.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-02 20:14 Last Seen2023-11-08 14:34 Times Seen519 Hash 1fba78ce96f3d7e77e83f18b95dcc546 b43c5b00d173b801e53b802baf63c05c62f0193b 44f9c4b912c05833f27bd1aa03399d4a9d3841a54e9ee536e5b0074afff86379 Loading...

	ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30	ScriptElement	5.5 kB	2023-03-07	2024-08-21
Pretty URL ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30 IP 64.190.63.136 ASN #47846 SEDO GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:43 Times Seen9041 Hash ea441a4ad9bf148e5d8180a531b57c2b f825c0d4c39d7f50bc74188a695903ba8cb5ef20 50cc8ac8f50cdef0641f8c14ac12268a1930df9781ecf751d4d10aa1a3b772f5 Loading...

HTTP Transactions (13)

URL IP Response Size

ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183

199.59.243.225

1.2 kB

URL
ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (450)
Size
1.2 kB (1153 bytes)
Hash
a5be257c4b4a21e3516bfb8378b20c43
62b3dd6188d3efd4854825022fada7b9e8a9dc5c
655d4340d6295f03982dc5043dd161f7840e1f48470b8850953bfad60143bb5a

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

GET /?subid1=20231104-2335-133c-a736-ccb0c3a41183 HTTP/1.1
Host: ww25.vps3.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Sat, 04 Nov 2023 12:35:33 GMT
content-type: text/html; charset=utf-8
content-length: 1153
x-request-id: fb7149e7-c2c0-4ff0-8c3b-c30cde41865a
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ap5rJsX7Q0dn6iFX5BuOJZZv5J9LjGDkhR8nztXgXQy68zrb3pM/T27VNiLt3v+s/zm+53ZRj+XFwtmoWHEycw==
set-cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a; expires=Sat, 04 Nov 2023 12:50:33 GMT; path=/

ww25.vps3.gdmhost.ga/bGasHwHYm.js

199.59.243.225

32 kB

URL
ww25.vps3.gdmhost.ga/bGasHwHYm.js
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
Unicode text, UTF-8 text, with very long lines (32099)
Size
32 kB (32102 bytes)
Hash
6ebd59b2d273cf49366bb4c4cd13faf0
36c1815062aeb1a99220b1abe338e5aaf02dd2ba
7b599318da054f1d77c5b0882c18aa908234c5a32c79b28c791ffafdca11516e

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

GET /bGasHwHYm.js HTTP/1.1
Host: ww25.vps3.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183
Cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Sat, 04 Nov 2023 12:35:33 GMT
content-type: application/javascript; charset=utf-8
content-length: 32102
x-request-id: df2298a3-1fa2-4608-b1c5-65e0975c75e2
set-cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a; expires=Sat, 04 Nov 2023 12:50:33 GMT

ww25.vps3.gdmhost.ga/_fd?subid1=20231104-2335-133c-a736-ccb0c3a41183

199.59.243.225

429 B

URL
ww25.vps3.gdmhost.ga/_fd?subid1=20231104-2335-133c-a736-ccb0c3a41183
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (549), with no line terminators
Size
429 B (429 bytes)
Hash
b491f8763bc73326a5ef160fca331d8f
7081efecc35c91f1849ee844eb0411aced322536
d7bd5ff6d7087dca4df6f0fa48ebe720e346ff7674cb298eac81aff441d8884c

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP POST Request to Suspicious *.ga Domain
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

POST /_fd?subid1=20231104-2335-133c-a736-ccb0c3a41183 HTTP/1.1
Host: ww25.vps3.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183
Content-Type: application/json
Origin: http://ww25.vps3.gdmhost.ga
DNT: 1
Connection: keep-alive
Cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0

HTTP/1.1 200 OK
server: openresty
date: Sat, 04 Nov 2023 12:35:33 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 429
x-version: 2.110.2
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a; expires=Sat, 04 Nov 2023 12:50:33 GMT; Max-Age=900; path=/; httponly

ww25.vps3.gdmhost.ga/_zc

199.59.243.225

159 B

URL
ww25.vps3.gdmhost.ga/_zc
IP
199.59.243.225:0
ASN
#16509 AMAZON-02

File type
ASCII text, with no line terminators
Size
159 B (159 bytes)
Hash
55086debc8b8fb79baea748142f180ab
bf126dd58a204e9578fe063742a3ebea0ad3b464
bf4c03487f5b95e9da16a976d745a07a3d6c57b6ba9eb2f2331a8e916963a6ee

HTTP Headers

POST /_zc HTTP/1.1
Host: ww25.vps3.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.vps3.gdmhost.ga/?subid1=20231104-2335-133c-a736-ccb0c3a41183
Content-Type: application/json
Content-Length: 1737
Origin: http://ww25.vps3.gdmhost.ga
DNT: 1
Connection: keep-alive
Cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
server: openresty
date: Sat, 04 Nov 2023 12:35:34 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
content-length: 159
x-version: 2.110.2
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
set-cookie: parking_session=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a; expires=Sat, 04 Nov 2023 12:50:34 GMT; Max-Age=900; path=/; httponly

ww01.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue

103.224.182.210

302 Found

2 B

URL User Request GET HTTP/1.1
ww01.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue
IP
103.224.182.210:443
ASN
#133618 Trellian Pty. Limited

Certificate
IssuerLet's Encrypt
Subjectcyjxint.com
FingerprintD0:34:12:92:E2:7F:3F:63:AD:FF:20:F2:39:C7:B3:18:A6:61:1F:5C
ValidityWed, 11 Oct 2023 23:19:08 GMT - Tue, 09 Jan 2024 23:19:07 GMT

File type
ASCII text
Size
2 B (2 bytes)
Hash
e1c06d85ae7b8b032bef47e42e4c08f9
71853c6197a6a7f222db0f1978c7cb232b87c5ee
75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070

HTTP Headers

GET /?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue HTTP/1.1
Host: ww01.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://ww25.vps3.gdmhost.ga/
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
date: Sat, 04 Nov 2023 12:35:35 GMT
server: Apache
set-cookie: __tad=1699101335.3792168; expires=Tue, 01-Nov-2033 12:35:35 GMT; Max-Age=315360000
location: http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
content-length: 2
content-type: text/html; charset=UTF-8
connection: close

ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30

64.190.63.136

200 OK

7.0 kB

URL User Request GET HTTP/1.1
ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
IP
64.190.63.136:80
ASN
#47846 SEDO GmbH

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (10263)
Size
7.0 kB (6980 bytes)
Hash
065fc85d18606b2a9a78913ce96dac08
615986410addbff58b95007e8b27fdf0aa836610
98a1632abfb9d8017931e7ce4801e486916200c0306378a53f45048086c51f27

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

GET /?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30 HTTP/1.1
Host: ww16.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww25.vps3.gdmhost.ga/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Sat, 04 Nov 2023 12:35:35 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.17
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_DzI1GIAj2vkWNTjhZdnzDSFeM5n344FNHz7LgegRs1xPE56nDuhx/WFvq+K3F9m2UFvwaH6sZcXJ5xyt+9OI0g==
last-modified: Sat, 04 Nov 2023 12:35:35 GMT
x-cache-miss-from: parking-697977dd84-lqf6d
server: NginX
content-encoding: gzip

img.sedoparking.com/templates/bg/arrows.png

205.234.175.175

200 OK

13 kB

URL GET HTTP/1.1
img.sedoparking.com/templates/bg/arrows.png
IP
205.234.175.175:80
ASN
#30081 CACHENETWORKS

Requested by
http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30

File type
PNG image data, 426 x 475, 8-bit/color RGBA, non-interlaced\012- data
Size
13 kB (12642 bytes)
Hash
6dc0bad9aa452ff871b282dabd47131e
01411e6726e033240caa3926141a6adbc18a2d73
3059fbd6cd3550047483dca4071c93e5cf4cc79ce8bafc4388166fbc5279644b

HTTP Headers

GET /templates/bg/arrows.png HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 04 Nov 2023 12:35:35 GMT
Content-Type: image/png
Content-Length: 12642
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Expires: Sat, 11 Nov 2023 12:35:35 GMT
X-CFHash: "6dc0bad9aa452ff871b282dabd47131e"
X-CFF: B
Last-Modified: Mon, 11 Oct 2021 05:39:44 GMT
X-CF3: H
CF4Age: 0
x-cf-tsc: 1697358617
CF4ttl: 31536000.000
X-CF2: H
Server: CFS 0215
X-CF-ReqID: b43563cd5eab879eaa5f8aec142583f9
X-CF1: 11696:fA.arn1:cf:cacheN.arn1-01:H
Accept-Ranges: bytes

www.google.com/adsense/domains/caf.js

142.250.74.132

200 OK

54 kB

URL GET HTTP/3
www.google.com/adsense/domains/caf.js
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://www.google.com/afs/ads?adsafe=low&adtest=off&psid=9618345430&channel=exp-0051%2Cauxa-control-1%2C445328&client=dp-sedo92_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fww16.gdmhost.ga%2Fcaf%2F%3Fses%3DY3JlPTE2OTkxMDEzMzUmdGNpZD13dzE2LmdkbWhvc3QuZ2E2NTQ2M2E5NzlmNDQ0MC45Nzc3MjUyMCZ0YXNrPXNlYXJjaCZkb21haW49Z2RtaG9zdC5nYSZhX2lkPTMmc2Vzc2lvbj14NFFvUXZMbVhNY2o2RG5JcnBQTA%3D%3D&type=3&uiopt=false&swp=as-drid-2777688820344496&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003&format=r3%7Cs&nocache=3421699101335909&num=0&output=afd_ads&domain_name=ww16.gdmhost.ga&v=3&bsl=8&pac=0&u_his=3&u_tz=0&dt=1699101335926&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=944&frm=0&cl=578165713&uio=--&cont=rb-default&jsid=caf&jsv=578165713&rurl=http%3A%2F%2Fww16.gdmhost.ga%2F%3Fpid%3D9POT3387I%26pbsubid%3Dfb7149e7-c2c0-4ff0-8c3b-c30cde41865a%26noads%3Dhttp%253A%252F%252Fww01.gdmhost.ga%252F%253Fskipskenzo%253Dtrue%26sub1%3D20231104-2335-3549-9aad-a9d96de1ed30&referer=http%3A%2F%2Fww25.vps3.gdmhost.ga%2F
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintFD:EE:45:21:A2:3C:95:82:9B:BA:3F:7A:59:3C:F6:C2:7B:C7:84:8F
ValidityMon, 16 Oct 2023 08:02:35 GMT - Mon, 08 Jan 2024 08:02:34 GMT

File type
ASCII text, with very long lines (2067)
Size
54 kB (54481 bytes)
Hash
1fba78ce96f3d7e77e83f18b95dcc546
b43c5b00d173b801e53b802baf63c05c62f0193b
44f9c4b912c05833f27bd1aa03399d4a9d3841a54e9ee536e5b0074afff86379

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Sat, 04 Nov 2023 12:35:35 GMT
Expires: Sat, 04 Nov 2023 12:35:35 GMT
Cache-Control: private, max-age=3600
ETag: "3916193533960630796"
X-Content-Type-Options: nosniff
Link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0

www.google.com/afs/ads/i/iframe.html

142.250.74.132

200 OK

729 B

URL GET HTTP/3
www.google.com/afs/ads/i/iframe.html
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintFD:EE:45:21:A2:3C:95:82:9B:BA:3F:7A:59:3C:F6:C2:7B:C7:84:8F
ValidityMon, 16 Oct 2023 08:02:35 GMT - Mon, 08 Jan 2024 08:02:34 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1559)
Size
729 B (729 bytes)
Hash
f97daee40e17851a8c730f107e27d101
1db95dcf93c82a03666634f38181d39b91d62042
16dfa1e59d7f45816f263387a9a14c5f098ca27c0c9f031ae4cac4699f1d2a34

HTTP Headers

GET /afs/ads/i/iframe.html HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy: script-src 'nonce-jzFtjhCFDw5dB630HH0sVg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui; base-uri 'none'
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-length: 729
date: Sat, 04 Nov 2023 12:35:35 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Tue, 24 Oct 2023 06:00:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

ww16.gdmhost.ga/search/tsc.php?200=NTA3OTIzNzIy&21=OTEuOTAuNDIuMTU0&681=MTY5OTEwMTMzNWQ0MzVkMjIzZDk2NWZhNTNjYmRmYTZjZTYxZGQwZGEy&crc=83ad1d5fb4351f6bdec4d54117af227f856d49e3&cv=1

64.190.63.136

200 OK

0 B

URL GET HTTP/1.1
ww16.gdmhost.ga/search/tsc.php?200=NTA3OTIzNzIy&21=OTEuOTAuNDIuMTU0&681=MTY5OTEwMTMzNWQ0MzVkMjIzZDk2NWZhNTNjYmRmYTZjZTYxZGQwZGEy&crc=83ad1d5fb4351f6bdec4d54117af227f856d49e3&cv=1
IP
64.190.63.136:80
ASN
#47846 SEDO GmbH

Requested by
http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

GET /search/tsc.php?200=NTA3OTIzNzIy&21=OTEuOTAuNDIuMTU0&681=MTY5OTEwMTMzNWQ0MzVkMjIzZDk2NWZhNTNjYmRmYTZjZTYxZGQwZGEy&crc=83ad1d5fb4351f6bdec4d54117af227f856d49e3&cv=1 HTTP/1.1
Host: ww16.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Sat, 04 Nov 2023 12:35:35 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-powered-by: PHP/8.1.17
x-cache-miss-from: parking-697977dd84-lqf6d
server: NginX

www.google.com/afs/ads?adsafe=low&adtest=off&psid=9618345430&channel=exp-0051%2Cauxa-control-1%2C445328&client=dp-sedo92_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fww16.gdmhost.ga%2Fcaf%2F%3Fses%3DY3JlPTE2OTkxMDEzMzUmdGNpZD13dzE2LmdkbWhvc3QuZ2E2NTQ2M2E5NzlmNDQ0MC45Nzc3MjUyMCZ0YXNrPXNlYXJjaCZkb21haW49Z2RtaG9zdC5nYSZhX2lkPTMmc2Vzc2lvbj14NFFvUXZMbVhNY2o2RG5JcnBQTA%3D%3D&type=3&uiopt=false&swp=as-drid-2777688820344496&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003&format=r3%7Cs&nocache=3421699101335909&num=0&output=afd_ads&domain_name=ww16.gdmhost.ga&v=3&bsl=8&pac=0&u_his=3&u_tz=0&dt=1699101335926&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=944&frm=0&cl=578165713&uio=--&cont=rb-default&jsid=caf&jsv=578165713&rurl=http%3A%2F%2Fww16.gdmhost.ga%2F%3Fpid%3D9POT3387I%26pbsubid%3Dfb7149e7-c2c0-4ff0-8c3b-c30cde41865a%26noads%3Dhttp%253A%252F%252Fww01.gdmhost.ga%252F%253Fskipskenzo%253Dtrue%26sub1%3D20231104-2335-3549-9aad-a9d96de1ed30&referer=http%3A%2F%2Fww25.vps3.gdmhost.ga%2F

142.250.74.132

200 OK

611 B

URL GET HTTP/3
www.google.com/afs/ads?adsafe=low&adtest=off&psid=9618345430&channel=exp-0051%2Cauxa-control-1%2C445328&client=dp-sedo92_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fww16.gdmhost.ga%2Fcaf%2F%3Fses%3DY3JlPTE2OTkxMDEzMzUmdGNpZD13dzE2LmdkbWhvc3QuZ2E2NTQ2M2E5NzlmNDQ0MC45Nzc3MjUyMCZ0YXNrPXNlYXJjaCZkb21haW49Z2RtaG9zdC5nYSZhX2lkPTMmc2Vzc2lvbj14NFFvUXZMbVhNY2o2RG5JcnBQTA%3D%3D&type=3&uiopt=false&swp=as-drid-2777688820344496&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003&format=r3%7Cs&nocache=3421699101335909&num=0&output=afd_ads&domain_name=ww16.gdmhost.ga&v=3&bsl=8&pac=0&u_his=3&u_tz=0&dt=1699101335926&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=944&frm=0&cl=578165713&uio=--&cont=rb-default&jsid=caf&jsv=578165713&rurl=http%3A%2F%2Fww16.gdmhost.ga%2F%3Fpid%3D9POT3387I%26pbsubid%3Dfb7149e7-c2c0-4ff0-8c3b-c30cde41865a%26noads%3Dhttp%253A%252F%252Fww01.gdmhost.ga%252F%253Fskipskenzo%253Dtrue%26sub1%3D20231104-2335-3549-9aad-a9d96de1ed30&referer=http%3A%2F%2Fww25.vps3.gdmhost.ga%2F
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
FingerprintFD:EE:45:21:A2:3C:95:82:9B:BA:3F:7A:59:3C:F6:C2:7B:C7:84:8F
ValidityMon, 16 Oct 2023 08:02:35 GMT - Mon, 08 Jan 2024 08:02:34 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (657)
Size
611 B (611 bytes)
Hash
ee56b1f1743636711fe309e018d7a78d
f1e50d4a4a268b0176b4c0082a308e7c4cc7376f
7f5eb9402a656988ef9023bb8b2d342e90041c45d7656ed4d72ab3e8fd087781

HTTP Headers

GET /afs/ads?adsafe=low&adtest=off&psid=9618345430&channel=exp-0051%2Cauxa-control-1%2C445328&client=dp-sedo92_3ph&r=m&hl=no&rpbu=http%3A%2F%2Fww16.gdmhost.ga%2Fcaf%2F%3Fses%3DY3JlPTE2OTkxMDEzMzUmdGNpZD13dzE2LmdkbWhvc3QuZ2E2NTQ2M2E5NzlmNDQ0MC45Nzc3MjUyMCZ0YXNrPXNlYXJjaCZkb21haW49Z2RtaG9zdC5nYSZhX2lkPTMmc2Vzc2lvbj14NFFvUXZMbVhNY2o2RG5JcnBQTA%3D%3D&type=3&uiopt=false&swp=as-drid-2777688820344496&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003&format=r3%7Cs&nocache=3421699101335909&num=0&output=afd_ads&domain_name=ww16.gdmhost.ga&v=3&bsl=8&pac=0&u_his=3&u_tz=0&dt=1699101335926&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=944&frm=0&cl=578165713&uio=--&cont=rb-default&jsid=caf&jsv=578165713&rurl=http%3A%2F%2Fww16.gdmhost.ga%2F%3Fpid%3D9POT3387I%26pbsubid%3Dfb7149e7-c2c0-4ff0-8c3b-c30cde41865a%26noads%3Dhttp%253A%252F%252Fww01.gdmhost.ga%252F%253Fskipskenzo%253Dtrue%26sub1%3D20231104-2335-3549-9aad-a9d96de1ed30&referer=http%3A%2F%2Fww25.vps3.gdmhost.ga%2F HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sat, 04 Nov 2023 12:35:35 GMT
expires: Sat, 04 Nov 2023 12:35:35 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-xbDY2IPkbqW_Qlj1CnbQbQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 611
x-xss-protection: 0
set-cookie: CONSENT=PENDING+679; expires=Mon, 03-Nov-2025 12:35:35 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

img.sedoparking.com/templates/logos/sedo_logo.png

205.234.175.175

200 OK

15 kB

URL GET HTTP/1.1
img.sedoparking.com/templates/logos/sedo_logo.png
IP
205.234.175.175:80
ASN
#30081 CACHENETWORKS

Requested by
http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30

File type
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
15 kB (15086 bytes)
Hash
def00c11b1596db4efee6a9fbe64fc27
bd298981e6d8d7e4ffa18abcf687041f4246672d
95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4

HTTP Headers

GET /templates/logos/sedo_logo.png HTTP/1.1
Host: img.sedoparking.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 04 Nov 2023 12:35:36 GMT
Content-Type: image/png
Content-Length: 15086
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Expires: Sat, 11 Nov 2023 12:35:36 GMT
X-CFHash: "def00c11b1596db4efee6a9fbe64fc27"
X-CFF: B
Last-Modified: Mon, 11 Jan 2021 07:44:34 GMT
X-CF3: H
CF4Age: 0
x-cf-tsc: 1696677940
CF4ttl: 31536000.000
X-CF2: H
Server: CFS 0215
X-CF-ReqID: f72c7a23884f5d6fa5c93cf3b258751a
X-CF1: 11696:fA.arn1:cf:cacheN.arn1-01:H
Accept-Ranges: bytes

ww16.gdmhost.ga/search/fb.php?ses=e9ac13b8b68914ef01699101335262cfd17246e606&ec=23

64.190.63.136

403 Forbidden

82 B

URL GET HTTP/1.1
ww16.gdmhost.ga/search/fb.php?ses=e9ac13b8b68914ef01699101335262cfd17246e606&ec=23
IP
64.190.63.136:80
ASN
#47846 SEDO GmbH

Requested by
http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30

File type
exported SGML document, ASCII text
Size
82 B (82 bytes)
Hash
b8c4d1fac45db0a65d6b29a24cd03b98
cbfef348d832c6f9314bcf2d769134de3f780bdf
6b83ac6820cafb971566055f48729373b4be5a9743eb6bbc12b40fc568d2f9c3

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.ga domain

HTTP Headers

GET /search/fb.php?ses=e9ac13b8b68914ef01699101335262cfd17246e606&ec=23 HTTP/1.1
Host: ww16.gdmhost.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww16.gdmhost.ga/?pid=9POT3387I&pbsubid=fb7149e7-c2c0-4ff0-8c3b-c30cde41865a&noads=http%3A%2F%2Fww01.gdmhost.ga%2F%3Fskipskenzo%3Dtrue&sub1=20231104-2335-3549-9aad-a9d96de1ed30
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
date: Sat, 04 Nov 2023 12:35:36 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.17
x-cache-miss-from: parking-697977dd84-k4d52
server: NginX
content-encoding: gzip

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL