Report - megaup.net/2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar

Report Overview

URL

megaup.net/2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar
IP

91.209.70.182

ASN

#43317 FNK LLC
Submitted

2023-02-08T22:01:50Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

5
Threat Detection Systems

5

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
prebid-eu.creativecdn.com (2)	5570	2018-01-27T13:14:32Z	2023-03-13T05:53:08Z	906	498	185.184.8.90
b1rdr39imszw.n4.adsco.re (1)	unknown			442	462	38.132.109.186
ocsp.sectigo.com (5)	487	2019-11-29T12:50:24Z	2023-03-13T08:22:43Z	1700	4625	104.18.32.68
www.googletagmanager.com (1)	75	2013-05-22T04:07:37Z	2023-03-13T08:28:24Z	380	44702	142.250.74.168
www.facebook.com (1)	99	2012-05-21T02:23:41Z	2021-02-04T00:31:35Z	438	13909	31.13.72.36
mp.4dex.io (3)	2629	2019-01-03T14:51:11Z	2023-03-13T07:41:12Z	1288	1368	104.18.2.114
prebid.a-mo.net (3)	1148	2020-07-14T19:45:55Z	2023-03-13T05:36:44Z	1294	933	147.75.85.234
theharityhild.buzz (3)	unknown	2022-10-20T09:00:21Z	2023-03-13T04:18:18Z	1560	174	54.162.51.18
ocsp.sca1b.amazontrust.com (1)	1015	2017-03-03T16:20:51Z	2019-03-27T05:05:54Z	350	944	54.230.245.39
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
dmmzkfd82wayn.cloudfront.net (7)	unknown	2021-03-18T18:00:47Z	2023-03-13T04:18:18Z	3960	196132	54.230.245.58
ocsp.digicert.com (7)	86	2012-05-21T09:02:23Z	2023-03-13T06:00:13Z	2387	4691	93.184.220.29
platform.bidgear.com (2)	30367	2016-07-27T13:51:48Z	2023-03-13T05:53:06Z	815	2047	104.26.3.107
ad.a-ads.com (1)	26970	2013-04-19T23:54:57Z	2023-03-13T08:21:25Z	476	5116	136.243.22.74
4.adsco.re (1)	19179	2021-01-04T17:47:52Z	2023-03-13T05:15:45Z	365	443	162.252.214.5
ocsp.pki.goog (10)	175	2018-07-01T08:43:07Z	2023-03-13T05:09:47Z	3486	7044	142.250.74.163
cdn.psdn.xyz (2)	unknown	2019-12-23T01:05:16Z	2023-02-28T01:14:15Z	753	209450	205.185.216.42
pogothere.xyz (5)	unknown	2022-09-04T21:11:25Z	2023-03-13T05:42:24Z	2052	127520	172.64.132.29
script.4dex.io (6)	2135	2018-07-23T12:04:27Z	2023-03-13T08:12:37Z	2620	28345	104.26.8.169
static.a-ads.com (1)	34827	2013-06-01T18:47:05Z	2023-03-13T07:24:56Z	431	500163	136.243.22.74
r3.o.lencr.org (13)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	4394	11522	23.36.76.226
narenrosrow.com (10)	unknown	2023-01-31T11:25:37Z	2023-03-02T04:55:43Z	7172	21226	54.230.111.47
img-getpocket.cdn.mozilla.net (3)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	1623	31233	34.120.237.76
parrecleftne.xyz (1)	unknown	2022-12-18T10:40:16Z	2023-03-13T04:18:18Z	416	673	54.230.111.111
prebid.admanmedia.com (4)	unknown	2022-11-10T22:14:04Z	2023-02-20T16:13:17Z	1714	940	8.2.109.168
sheetvibe.com (2)	unknown	2022-11-29T19:50:33Z	2023-03-09T04:15:31Z	3609	7782	172.64.205.20
api.purpleads.io (9)	146037	2020-02-18T07:59:38Z	2023-03-13T05:53:07Z	6628	8217	44.198.85.128
megaup.net (54)	179052	2017-09-01T20:45:15Z	2023-03-13T06:51:39Z	28292	1423454	91.209.70.182
firefox.settings.services.mozilla.com (2)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782	2374	35.241.9.150
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	35.162.110.205
altowriestwispy.com (2)	951913	2021-02-24T11:44:10Z	2023-03-13T04:18:18Z	1341	1992	172.255.6.149
keydawnawe.com (2)	586690	2020-10-08T16:33:32Z	2023-03-13T04:18:18Z	1331	1936	172.255.6.120
landupoatouwe.xyz (2)	unknown	2023-02-01T17:51:19Z	2023-03-07T05:20:34Z	1048	1146	172.67.190.113
cdn.purpleads.io (2)	185817	2020-02-18T07:59:36Z	2023-03-13T05:53:07Z	1064	36602	54.230.111.91
b1rdr39imszw.l4.adsco.re (1)	unknown			442	462	185.200.118.90
adsco.re (1)	8541	2017-04-03T05:11:30Z	2023-03-13T05:15:45Z	387	496	162.252.214.5
tlx.3lift.com (1)	598	2017-01-30T04:22:26Z	2023-03-13T05:46:10Z	568	719	18.194.8.142
eb2.3lift.com (2)	402	2014-09-24T17:03:42Z	2023-03-13T05:28:06Z	938	412	76.223.111.18
c.adsco.re (1)	16577	2017-11-29T19:42:15Z	2023-03-13T05:15:45Z	341	1302	104.17.167.186
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
imp9.bidgear.com (1)	34078	2021-03-15T12:09:09Z	2023-03-13T05:53:07Z	476	1129	104.26.3.107
e1.o.lencr.org (5)	6159	2021-08-20T09:36:30Z	2023-03-13T05:21:46Z	1690	3645	23.36.77.32
accounts.google.com (3)	81	2016-03-20T13:44:49Z	2023-03-13T07:05:07Z	1620	5836	216.58.207.237
6.adsco.re (1)	17812	2018-01-15T05:15:29Z	2023-03-13T05:15:45Z	365	470	104.17.166.186
ib.adnxs.com (18)	241	2012-05-20T21:01:49Z	2023-03-13T05:28:06Z	7035	16740	185.89.210.46
prebid.media.net (4)	1256	2018-02-14T18:41:07Z	2023-03-13T05:36:39Z	1818	19417	34.107.148.139
www.google-analytics.com (2)	40	2012-10-03T03:04:21Z	2023-03-13T07:36:03Z	1220	21128	142.250.74.110
imasdk.googleapis.com (1)	11661	2014-10-30T18:42:18Z	2023-03-13T06:05:04Z	372	126554	142.250.74.74
ocsp.godaddy.com (1)	698	2012-05-20T21:28:57Z	2023-03-13T05:12:19Z	340	2285	192.124.249.41
cs.admanmedia.com (4)	2357	2017-05-05T13:54:47Z	2023-03-13T07:29:10Z	1928	652	80.77.87.166

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-08T22:02:37Z	high	Client IP	185.200.118.90	ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2023-02-08T22:02:38Z	high	Client IP	38.132.109.186	ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2023-02-08T22:02:38Z	high	Client IP	185.200.116.90	ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2023-02-08T22:02:38Z	high	Client IP	185.200.118.90	ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2023-02-08T22:02:38Z	high	Client IP	38.132.109.186	ET INFO Session Traversal Utilities for NAT (STUN Binding Request)

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-02-08	medium	pogothere.xyz	Sinkholed
2023-02-08	medium	pogothere.xyz	Sinkholed
2023-02-08	medium	pogothere.xyz	Sinkholed
2023-02-08	medium	pogothere.xyz	Sinkholed
2023-02-08	medium	pogothere.xyz	Sinkholed

ThreatFox

No alerts detected

HTTP Transactions (217)

	URL	IP	Response	Size
	megaup.net/2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar	91.209.70.182	301 Moved Permanently	162
Search urlquery URL megaup.net/2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar DOMAIN megaup.net FQDN megaup.net IP 91.209.70.182 Hash 4f8e702cc244ec5d4de32740c0ecbd97 External sources Mnemonic PDNS FQDN megaup.net DOMAIN megaup.net IP 91.209.70.182 VirusTotal HASH 3adb1f02d5b6054de0046e367c1d687b6cdf7aff FQDN megaup.net DOMAIN megaup.net IP 91.209.70.182 crt.sh FQDN megaup.net DOMAIN megaup.net URL HTTP/1.1 megaup.net/2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar IP 91.209.70.182:0 ASN #43317 FNK LLC Magic HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size 162 Hash 4f8e702cc244ec5d4de32740c0ecbd97 3adb1f02d5b6054de0046e367c1d687b6cdf7aff 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a HTTP Headers `GET /2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar HTTP/1.1 Host: megaup.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1` `HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 08 Feb 2023 22:01:38 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://megaup.net/2y22z/Hogwarts.Legacy.Digital.Deluxe.Edition.part01.rar X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: no-referrer, strict-origin-when-cross-origin X-Download-Options: noopen`

	r3.o.lencr.org/	23.36.76.226	200 OK	503
Search urlquery URL r3.o.lencr.org/ DOMAIN lencr.org FQDN r3.o.lencr.org IP 23.36.76.226 Hash dca68db7aea32f6683ce8d542c078f04 External sources Mnemonic PDNS FQDN r3.o.lencr.org DOMAIN lencr.org IP 23.36.76.226 VirusTotal HASH 19c495238df74fca680e21f18627ff94de5dd2e5 FQDN r3.o.lencr.org DOMAIN lencr.org IP 23.36.76.226 crt.sh FQDN r3.o.lencr.org DOMAIN lencr.org URL HTTP/1.1 r3.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. Magic data Size 503 Hash dca68db7aea32f6683ce8d542c078f04 19c495238df74fca680e21f18627ff94de5dd2e5 35cab3987fc0e4a41b305cb208c1e33fa38ce8bdfd9f386c3dc0411dd4d5ac61 HTTP Headers `POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 503 ETag: "35CAB3987FC0E4A41B305CB208C1E33FA38CE8BDFD9F386C3DC0411DD4D5AC61" Last-Modified: Mon, 06 Feb 2023 17:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=13146 Expires: Thu, 09 Feb 2023 01:40:44 GMT Date: Wed, 08 Feb 2023 22:01:38 GMT Connection: keep-alive`

	r3.o.lencr.org/	23.36.76.226	200 OK	503
Search urlquery URL r3.o.lencr.org/ DOMAIN lencr.org FQDN r3.o.lencr.org IP 23.36.76.226 Hash 565c1bbc5c1c40be1988b3bf6fd9dc1a External sources Mnemonic PDNS FQDN r3.o.lencr.org DOMAIN lencr.org IP 23.36.76.226 VirusTotal HASH cfdba5bc597130461dd67bf6cda53183be592493 FQDN r3.o.lencr.org DOMAIN lencr.org IP 23.36.76.226 crt.sh FQDN r3.o.lencr.org DOMAIN lencr.org URL HTTP/1.1 r3.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. Magic data Size 503 Hash 565c1bbc5c1c40be1988b3bf6fd9dc1a cfdba5bc597130461dd67bf6cda53183be592493 60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d HTTP Headers `POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 503 ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D" Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12041 Expires: Thu, 09 Feb 2023 01:22:19 GMT Date: Wed, 08 Feb 2023 22:01:38 GMT Connection: keep-alive`

	r3.o.lencr.org/	23.36.76.226	200 OK	503
Search urlquery URL r3.o.lencr.org/ DOMAIN lencr.org FQDN r3.o.lencr.org IP 23.36.76.226 Hash cc14b0d2f7c451f6431dc87ba54d1d60 External sources Mnemonic PDNS FQDN r3.o.lencr.org DOMAIN lencr.org IP 23.36.76.226 VirusTotal HASH bab8bfda6fa3e2f17125353f5147211787dc25d0 FQDN r3.o.lencr.org DOMAIN lencr.org IP 23.36.76.226 crt.sh FQDN r3.o.lencr.org DOMAIN lencr.org URL HTTP/1.1 r3.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. Magic data Size 503 Hash cc14b0d2f7c451f6431dc87ba54d1d60 bab8bfda6fa3e2f17125353f5147211787dc25d0 b58fe18a5cc8fe5aaf49ba7eadd0ef34692892e68e9c52eb5bb56ea27e1300ad HTTP Headers `POST / HTTP/1.1 Host: r3.o.lencr.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 503 ETag: "B58FE18A5CC8FE5AAF49BA7EADD0EF34692892E68E9C52EB5BB56EA27E1300AD" Last-Modified: Mon, 06 Feb 2023 20:00:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6961 Expires: Wed, 08 Feb 2023 23:57:39 GMT Date: Wed, 08 Feb 2023 22:01:38 GMT Connection: keep-alive`

	firefox.settings.services.mozilla.com/v1/	35.241.9.150	200 OK	939
Search urlquery URL firefox.settings.services.mozilla.com/v1/ DOMAIN mozilla.com FQDN firefox.settings.services.mozilla.com IP 35.241.9.150 Hash ff250d3ef3fa45322bf05039a0122a9f External sources Mnemonic PDNS FQDN firefox.settings.services.mozilla.com DOMAIN mozilla.com IP 35.241.9.150 VirusTotal HASH b3e7a2c383bce1bab807dbe1a03c375258b51f1d FQDN firefox.settings.services.mozilla.com DOMAIN

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (212)

#1 JS:Script (size: 435844)

#2 JS:Script (size: 103036)

#3 JS:Script (size: 112850)

#4 JS:Script (size: 2968)

#5 JS:Script (size: 587)

#6 JS:Script (size: 971)

#7 JS:Script (size: 1478)

#8 JS:Script (size: 1821)

#9 JS:Script (size: 197554)

#10 JS:Script (size: 1032)

#11 JS:Script (size: 155)

#12 JS:Script (size: 52943)

#13 JS:Script (size: 56276)

#14 JS:Script (size: 4074)

#15 JS:Script (size: 5961)

#16 JS:Script (size: 544)

#17 JS:Script (size: 2975)

#18 JS:Script (size: 820)

#19 JS:Script (size: 5152)

#20 JS:Script (size: 5362)

#21 JS:Script (size: 46597)

#22 JS:Script (size: 25)

#23 JS:Script (size: 5302)

#24 JS:Script (size: 25071)

#25 JS:Script (size: 9255)

#26 JS:Script (size: 29110)

#27 JS:Script (size: 5447)

#28 JS:Script (size: 3417)

#29 JS:Script (size: 77868)

#30 JS:Script (size: 15314)

#31 JS:Script (size: 306)

#32 JS:Script (size: 50234)

#33 JS:Script (size: 371567)

#34 JS:Script (size: 1914)

#35 JS:Script (size: 0)

#36 JS:Script (size: 1326)

#37 JS:Script (size: 2942)

#38 JS:Script (size: 595)

#39 JS:Script (size: 464)

#40 JS:Script (size: 822)

#41 JS:Script (size: 620775)

#42 JS:Script (size: 189)

#43 JS:Script (size: 375740)

#44 JS:Script (size: 25)

#45 JS:Script (size: 25)

#46 JS:Script (size: 69604)

#47 JS:Script (size: 8063)

#48 JS:Script (size: 63744)

#49 JS:Script (size: 2969)

#50 JS:Script (size: 2204)

#51 JS:Script (size: 25)

#52 JS:Script (size: 25)

#53 JS:Script (size: 7391)

#54 JS:Script (size: 58718)

#55 JS:Script (size: 850)

#56 JS:Script (size: 69780)