Report - dale.ulitron.ru/

Report Overview

Submitted URL
dale.ulitron.ru/
IP
31.31.205.31
ASN
#197695 Domain names registrar REG.RU, Ltd
Submitted
2024-04-18 10:38:04
Access
public
Website Title
rape.su
Final URL
rape.su/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
5
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
c.parkingcrew.net	70582	2011-01-24	2017-01-29	2024-04-18	322 B	1.0 kB	185.53.178.30
d38psrni17bvxu.cloudfront.net	unknown	2008-04-25	2022-09-22	2024-04-17	817 B	24 kB	54.230.241.34
www.google.com	7	1997-09-15	2015-05-10	2024-03-23	340 B	75 kB	142.250.74.164
www.adsensecustomsearchads.com	unknown	2011-01-28	2015-09-02	2024-04-17	3.3 kB	80 kB	216.58.211.14
afs.googleusercontent.com	12123	2008-11-17	2013-05-06	2024-04-17	995 B	2.1 kB	142.250.74.97
dale.ulitron.ru	unknown	unknown	No data	No data	386 B	148 B	31.31.205.31
rape.su	unknown	2023-07-18	2017-11-19	2024-02-23	2.0 kB	9.2 kB	185.53.178.7

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 10:37:39	medium	Client IP	185.53.178.7	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2024-04-18 10:37:40	medium	Client IP	185.53.178.7	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2024-04-18 10:37:40	medium	Client IP	185.53.178.7	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2024-04-18 10:37:40	medium	Client IP	185.53.178.7	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2024-04-18 10:37:41	medium	Client IP	185.53.178.7	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	rape.su/	968 B	2023-03-08	2024-04-30
Pretty URL rape.su/ IP 185.53.178.7 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 02:24:08 Last Seen2024-04-30 17:12:57 Times Seen27795 Hash c77554570ae0fa8e4fb31747dc213058 e989fbde07e6a68975c7a31e1d4df76afd90b96f c3f831fe1717c6d76a8950ac5e7dc88ceee7440d079b11584be5c6c5b3269e77 Loading...

	rape.su/	8.0 kB	2024-04-18	2024-04-18
Pretty URL rape.su/ IP 185.53.178.7 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 12:38:11 Last Seen2024-04-18 12:38:11 Times Seen1 Hash 5be52b05e03784e16eca6568256353d0 b063f58dfe680608b47c5929d0fd73c7925d0b59 7e19be94918e2ffe41b5ec11ac3bc569148fbb6fcc7a39c50d77f554a8a80e7b Loading...

	www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F	864 B	2024-04-18	2024-04-18
Pretty URL www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F IP 216.58.211.14 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 12:38:11 Last Seen2024-04-18 12:38:11 Times Seen1 Hash 452c5b176527cb43b588b189deca6ff9 50c98061e0cc9411ba0359996cefb6416394baaf a0f81bb6e97ccda76063ae15b9628b9dea4be493aa3686ebef7c38db1dffa499 Loading...

	www.adsensecustomsearchads.com/adsense/domains/caf.js	191 kB	2024-04-17	2024-04-18
Pretty URL www.adsensecustomsearchads.com/adsense/domains/caf.js IP 216.58.211.14 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-17 20:32:04 Last Seen2024-04-18 13:28:22 Times Seen15 Hash b7914b65f9b80ff7f03ffe7521a3907c 5948baada53a8c51680a439eb7bf1fbf2f0820b5 cf8c1d53a288d973fc7e78acc71b0709acc4ed846b68cd1d9f347b44b999394a Loading...

	rape.su/	669 B	2024-04-18	2024-04-18
Pretty URL rape.su/ IP 185.53.178.7 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 12:38:11 Last Seen2024-04-18 12:38:11 Times Seen1 Hash 0bb783abe0e098ebf7960ee3f435cdf4 574b7b35af55c60126cc8c7169142225b9da1258 797c3f4f46ece38691220c27aab048d5e2fec0b4c71e5fd7b9ebb3f4ae2e850b Loading...

	rape.su/	40 B	2023-08-09	2024-04-30
Pretty URL rape.su/ IP 185.53.178.7 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML true Observations First Seen2023-08-09 10:52:17 Last Seen2024-04-30 17:12:57 Times Seen9021 Hash fca3e6a61d4a07440e4f10c4dbaad8e3 41480802bf872b2d15f9cbcadba025fe326eac03 dfe5c5e10934e7abf7903d4ede3b8fa091c11bef63d675808e6314ec763185ee Loading...

	rape.su/	483 B	2024-01-04	2024-04-30
Pretty URL rape.su/ IP 185.53.178.7 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML true Observations First Seen2024-01-04 10:26:15 Last Seen2024-04-30 17:12:57 Times Seen2835 Hash 18f2edc58d8a7b9e6b82454e8658c157 e5dfdd0fa61b3a5ef68dab382a0ba93e9e7b67fb 2d9b07a0704d92dda4deae88bc582aeb659923c8d44d0e7362e13cb28d88d250 Loading...

	rape.su/	50 B	2024-01-04	2024-04-30
Pretty URL rape.su/ IP 185.53.178.7 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML true Observations First Seen2024-01-04 10:26:15 Last Seen2024-04-30 17:12:57 Times Seen2797 Hash 1b334e0123cf0cb113092022fb726782 45abb42a6680499daa10d83d2859329de1843de2 42591f96b9a41a7e2e5ecd0240dd7fecdcf03ef8454b57c68f08697474a4b579 Loading...

	www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true	191 kB	2024-04-15	2024-04-18
Pretty URL www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-15 21:06:31 Last Seen2024-04-18 12:40:11 Times Seen43 Hash fbd2cb89822f8b4f34948a03ca7c9700 b2d8856563b497d7bb98bc1ceb24ad2fe0981233 e6dbac2c743a7857f49f82c4d7093765f34a140848abfdd18f11ff26a8425a36 Loading...

	c.parkingcrew.net/scripts/sale_form.js	761 B	2023-03-07	2024-04-30
Pretty URL c.parkingcrew.net/scripts/sale_form.js IP 185.53.178.30 ASN #61969 Team Internet AG Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:27 Last Seen2024-04-30 09:43:56 Times Seen10945 Hash 64f809e06446647e192fce8d1ec34e09 5b7ced07da42e205067afa88615317a277a4a82c f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3 Loading...

HTTP Transactions (16)

URL IP Response Size

dale.ulitron.ru/

31.31.205.31

302 Found

0 B

URL User Request GET HTTP/1.1
dale.ulitron.ru/
IP
31.31.205.31:80
ASN
#197695 Domain names registrar REG.RU, Ltd

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: dale.ulitron.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx/1.18.0
Date: Thu, 18 Apr 2024 10:37:39 GMT
Content-Length: 0
Connection: keep-alive
Location: http://rape.su

rape.su/

185.53.178.7

200 OK

6.6 kB

URL User Request GET HTTP/1.1
rape.su/
IP
185.53.178.7:80
ASN
#61969 Team Internet AG

File type
HTML document, Unicode text, UTF-8 text, with very long lines (8010)
Size
6.6 kB (6604 bytes)
Hash
c1d41036130146a4283ef268d1074dc7
53e83321ffd62ade658b60e237cdddc467c5be52
6f71b0e18373714439bb19262e9e32a91e17e3582b014f09c5302542a6780388

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET / HTTP/1.1
Host: rape.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 10:37:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Buckets: bucket102
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_BFu0b3zVSBNvQzHyXVWKe0M7J7faneMobYBJZBSJc5OPoyBIEMVrDWe96DnKEdaVfoouPvqTVaSSZyU6mE88Sw==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: rape.su
X-Subdomain: 
Content-Encoding: gzip

c.parkingcrew.net/scripts/sale_form.js

185.53.178.30

200 OK

761 B

URL GET HTTP/1.1
c.parkingcrew.net/scripts/sale_form.js
IP
185.53.178.30:80
ASN
#61969 Team Internet AG

Requested by
http://rape.su/

File type
ASCII text
Size
761 B (761 bytes)
Hash
64f809e06446647e192fce8d1ec34e09
5b7ced07da42e205067afa88615317a277a4a82c
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3

HTTP Headers

GET /scripts/sale_form.js HTTP/1.1
Host: c.parkingcrew.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 10:37:40 GMT
Content-Type: application/javascript
Content-Length: 761
Connection: keep-alive
Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT
ETag: "65fc1e7b-2f9"
Accept-Ranges: bytes

rape.su/track.php?domain=rape.su&toggle=browserjs&uid=MTcxMzQzNjY1OS45MTg0Ojk5NDEzMWM2ZGY1NTMxZTEwMTVjZjY1NzFmZTczMGI0Nzc2YmI0NDMwY2FmNDI4ZGZhZThkZDVkYzlmNzIwMTU6NjYyMGY3ZjNlMDM4NA%3D%3D

185.53.178.7

200 OK

20 B

URL GET HTTP/1.1
rape.su/track.php?domain=rape.su&toggle=browserjs&uid=MTcxMzQzNjY1OS45MTg0Ojk5NDEzMWM2ZGY1NTMxZTEwMTVjZjY1NzFmZTczMGI0Nzc2YmI0NDMwY2FmNDI4ZGZhZThkZDVkYzlmNzIwMTU6NjYyMGY3ZjNlMDM4NA%3D%3D
IP
185.53.178.7:80
ASN
#61969 Team Internet AG

Requested by
http://rape.su/

File type
gzip compressed data, max speed, from Unix
Size
20 B (20 bytes)
Hash
a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /track.php?domain=rape.su&toggle=browserjs&uid=MTcxMzQzNjY1OS45MTg0Ojk5NDEzMWM2ZGY1NTMxZTEwMTVjZjY1NzFmZTczMGI0Nzc2YmI0NDMwY2FmNDI4ZGZhZThkZDVkYzlmNzIwMTU6NjYyMGY3ZjNlMDM4NA%3D%3D HTTP/1.1
Host: rape.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 10:37:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

rape.su/ls.php?t=6620f7f3&token=2aa026b648c57d1fc1bfe5f479c5197185023dbb

185.53.178.7

201 Created

16 B

URL GET HTTP/1.1
rape.su/ls.php?t=6620f7f3&token=2aa026b648c57d1fc1bfe5f479c5197185023dbb
IP
185.53.178.7:80
ASN
#61969 Team Internet AG

Requested by
http://rape.su/

File type
JSON text data
Size
16 B (16 bytes)
Hash
7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /ls.php?t=6620f7f3&token=2aa026b648c57d1fc1bfe5f479c5197185023dbb HTTP/1.1
Host: rape.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 201 Created
Server: nginx
Date: Thu, 18 Apr 2024 10:37:40 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 6620f7f46c802ce0560ffa6b
Charset: utf-8
Access-Control-Allow-Origin: 
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_iWTNY9cEIydMOcSxHkdqkO9eha3utTwk6JZHvts5iTjQTd40Wx9gdIlZjjvpIst7STZ1EgG15pH74s/uLKiLaA==

d38psrni17bvxu.cloudfront.net/fonts/Port_Lligat_Slab/latin.woff2

54.230.241.34

200 OK

12 kB

URL GET HTTP/1.1
d38psrni17bvxu.cloudfront.net/fonts/Port_Lligat_Slab/latin.woff2
IP
54.230.241.34:80
ASN
#16509 AMAZON-02

Requested by
http://rape.su/

File type
Web Open Font Format (Version 2), TrueType, length 11460, version 1.0
Size
12 kB (11460 bytes)
Hash
530281ca203b403ba954d0652eb4072f
51a62f96562ff94b45a02aee4476abb3518da3bd
b938a950c28b1cec409f935d79a2faadd658bb6a461ca3ee8e2f6e2d716511f5

HTTP Headers

GET /fonts/Port_Lligat_Slab/latin.woff2 HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://rape.su
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
Content-Length: 11460
Connection: keep-alive
Server: nginx
Date: Thu, 18 Apr 2024 01:56:39 GMT
Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT
ETag: "65fc1e7b-2cc4"
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Via: 1.1 92c4bb210eab82a152000047d3609a02.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: noHKeHlJSxs0-CVX5eWzxRw9sEmwvh052Gzumzoio7W-vnUnuADf1g==
Age: 31261
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *

d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png

54.230.241.34

200 OK

11 kB

URL GET HTTP/1.1
d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
IP
54.230.241.34:80
ASN
#16509 AMAZON-02

Requested by
http://rape.su/

File type
PNG image data, 1500 x 600, 8-bit colormap, non-interlaced
Size
11 kB (11375 bytes)
Hash
0cb2e5165dc9324eb462199f04e1ffa9
9e0f89847ec8a98d98a6020bc5c4ed32b7a48bf8
67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865

HTTP Headers

GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 11375
Connection: keep-alive
Server: nginx
Date: Wed, 17 Apr 2024 17:26:54 GMT
Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT
Accept-Ranges: bytes
ETag: "65fc1e7b-2c6f"
X-Cache: Hit from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ikP55esArmaOqh5dhzHnCrKBEQGaF4W97KrkmrDCPboGgV2eLcz1hg==
Age: 61846

rape.su/favicon.ico

185.53.178.7

200 OK

0 B

URL GET HTTP/1.1
rape.su/favicon.ico
IP
185.53.178.7:80
ASN
#61969 Team Internet AG

Requested by
http://rape.su/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: rape.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 10:37:40 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Last-Modified: Wed, 17 Apr 2024 09:08:47 GMT
ETag: "661f919f-0"
Accept-Ranges: bytes

www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true

142.250.74.164

200 OK

74 kB

URL GET HTTP/1.1
www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true
IP
142.250.74.164:80
ASN
#15169 GOOGLE

Requested by
http://rape.su/

File type
JavaScript source, ASCII text, with very long lines (2247)
Size
74 kB (74187 bytes)
Hash
fbd2cb89822f8b4f34948a03ca7c9700
b2d8856563b497d7bb98bc1ceb24ad2fe0981233
e6dbac2c743a7857f49f82c4d7093765f34a140848abfdd18f11ff26a8425a36

HTTP Headers

GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Thu, 18 Apr 2024 10:37:40 GMT
Expires: Thu, 18 Apr 2024 10:37:40 GMT
Cache-Control: private, max-age=3600
ETag: "4648279398453971068"
X-Content-Type-Options: nosniff
Link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0

www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F

216.58.211.14

200 OK

2.9 kB

URL GET HTTP/2
www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F
IP
216.58.211.14:443
ASN
#15169 GOOGLE

Requested by
http://rape.su/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
FingerprintF3:76:52:2E:82:03:17:59:3A:0C:25:75:49:66:99:4F:AB:15:33:CE
ValidityMon, 04 Mar 2024 06:40:54 GMT - Mon, 27 May 2024 06:40:53 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (13899)
Size
2.9 kB (2902 bytes)
Hash
1b280fe0fbac065a4a2c9e7f45b0809f
a56999df2df8d5abbf4636c425cd8e8906e6499d
0f5da13f73a08fe8e0b48c13198daa3acaee8a9e67357264253d73978d157ac1

HTTP Headers

GET /afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F HTTP/1.1
Host: www.adsensecustomsearchads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Thu, 18 Apr 2024 10:37:40 GMT
expires: Thu, 18 Apr 2024 10:37:40 GMT
cache-control: private, max-age=3600
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-i8huGQ50RXbEnSQDIAgUqA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-encoding: br
server: gws
content-length: 2902
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.adsensecustomsearchads.com/adsense/domains/caf.js

216.58.211.14

200 OK

74 kB

URL GET HTTP/3
www.adsensecustomsearchads.com/adsense/domains/caf.js
IP
216.58.211.14:443
ASN
#15169 GOOGLE

Requested by
https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
FingerprintF3:76:52:2E:82:03:17:59:3A:0C:25:75:49:66:99:4F:AB:15:33:CE
ValidityMon, 04 Mar 2024 06:40:54 GMT - Mon, 27 May 2024 06:40:53 GMT

File type
JavaScript source, ASCII text, with very long lines (2247)
Size
74 kB (74177 bytes)
Hash
b7914b65f9b80ff7f03ffe7521a3907c
5948baada53a8c51680a439eb7bf1fbf2f0820b5
cf8c1d53a288d973fc7e78acc71b0709acc4ed846b68cd1d9f347b44b999394a

HTTP Headers

GET /adsense/domains/caf.js HTTP/1.1
Host: www.adsensecustomsearchads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.adsensecustomsearchads.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Thu, 18 Apr 2024 10:37:40 GMT
expires: Thu, 18 Apr 2024 10:37:40 GMT
cache-control: private, max-age=3600
etag: "11957826621676886974"
x-content-type-options: nosniff
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff

142.250.74.97

200 OK

174 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE0:0C:38:A4:4D:4F:CB:42:05:30:9A:C4:60:B3:64:3F:EF:43:D1:2F
ValidityMon, 04 Mar 2024 07:14:32 GMT - Mon, 27 May 2024 07:14:31 GMT

File type
SVG Scalable Vector Graphics image
Size
174 B (174 bytes)
Hash
11b3089d616633ca6b73b57aa877eeb4
07632f63e06b30d9b63c97177d3a8122629bda9b
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.adsensecustomsearchads.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 07:37:12 GMT
expires: Fri, 19 Apr 2024 06:37:12 GMT
cache-control: public, max-age=82800
age: 10829
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff

142.250.74.97

200 OK

270 B

URL GET HTTP/2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
IP
142.250.74.97:443
ASN
#15169 GOOGLE

Requested by
https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=1167268112&pcsa=false&channel=000001%2Cbucket102&client=dp-teaminternet09_3ph&r=m&hl=no&ivt=0&rpbu=http%3A%2F%2Frape.su%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQxMDJ8fHx8fHw2NjIwZjdmM2UwMzQxfHx8MTcxMzQzNjY1OS45MzEzfDA1YjIwYzI0NTkwNWVkODM5NDFmMzljNGY4ZWI4MTJlNjRlODFjMGR8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXwyYWEwMjZiNjQ4YzU3ZDFmYzFiZmU1ZjQ3OWM1MTk3MTg1MDIzZGJifDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2783310615513458&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301431%2C17301433%2C17301436%2C17301467%2C17301480&client_gdprApplies=1&format=r3%7Cs&nocache=4581713436660474&num=0&output=afd_ads&domain_name=rape.su&v=3&bsl=8&pac=0&u_his=2&u_tz=0&dt=1713436660476&u_w=1280&u_h=1024&biw=1280&bih=1024&psw=1280&psh=760&frm=0&uio=--&cont=tc&drt=0&jsid=caf&jsv=623135625&rurl=http%3A%2F%2Frape.su%2F
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE0:0C:38:A4:4D:4F:CB:42:05:30:9A:C4:60:B3:64:3F:EF:43:D1:2F
ValidityMon, 04 Mar 2024 07:14:32 GMT - Mon, 27 May 2024 07:14:31 GMT

File type
SVG Scalable Vector Graphics image
Size
270 B (270 bytes)
Hash
8959ddcd9712196961d93f58064ed655
62ab1e38e7e9fbf58a04381b76c2d96a9c829f24
17c7a89bf169c2ee400e31b042cea68513f06b9cd7d1e8990dbec800f0d771c7

HTTP Headers

GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.adsensecustomsearchads.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 06:46:39 GMT
expires: Fri, 19 Apr 2024 05:46:39 GMT
cache-control: public, max-age=82800
age: 13862
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
content-type: image/svg+xml
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=glrltli0m840&aqid=9PcgZofnIeuLiM0Puo6VCA&psid=1167268112&pbt=bs&adbx=375&adby=94&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=623135625&csala=6%7C0%7C481%7C90%7C54&lle=0&ifv=1&hpt=1

216.58.211.14

204 No Content

0 B

URL GET HTTP/3
www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=glrltli0m840&aqid=9PcgZofnIeuLiM0Puo6VCA&psid=1167268112&pbt=bs&adbx=375&adby=94&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=623135625&csala=6%7C0%7C481%7C90%7C54&lle=0&ifv=1&hpt=1
IP
216.58.211.14:443
ASN
#15169 GOOGLE

Requested by
http://rape.su/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
FingerprintF3:76:52:2E:82:03:17:59:3A:0C:25:75:49:66:99:4F:AB:15:33:CE
ValidityMon, 04 Mar 2024 06:40:54 GMT - Mon, 27 May 2024 06:40:53 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=glrltli0m840&aqid=9PcgZofnIeuLiM0Puo6VCA&psid=1167268112&pbt=bs&adbx=375&adby=94&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=623135625&csala=6%7C0%7C481%7C90%7C54&lle=0&ifv=1&hpt=1 HTTP/1.1
Host: www.adsensecustomsearchads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-V7d2f59LnjJLhqyaskFMQQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Thu, 18 Apr 2024 10:37:42 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=72aif0ef73o6&aqid=9PcgZofnIeuLiM0Puo6VCA&psid=1167268112&pbt=bv&adbx=375&adby=94&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=623135625&csala=6%7C0%7C481%7C90%7C54&lle=0&ifv=1&hpt=1

216.58.211.14

204 No Content

0 B

URL GET HTTP/3
www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=72aif0ef73o6&aqid=9PcgZofnIeuLiM0Puo6VCA&psid=1167268112&pbt=bv&adbx=375&adby=94&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=623135625&csala=6%7C0%7C481%7C90%7C54&lle=0&ifv=1&hpt=1
IP
216.58.211.14:443
ASN
#15169 GOOGLE

Requested by
http://rape.su/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
FingerprintF3:76:52:2E:82:03:17:59:3A:0C:25:75:49:66:99:4F:AB:15:33:CE
ValidityMon, 04 Mar 2024 06:40:54 GMT - Mon, 27 May 2024 06:40:53 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=72aif0ef73o6&aqid=9PcgZofnIeuLiM0Puo6VCA&psid=1167268112&pbt=bv&adbx=375&adby=94&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=623135625&csala=6%7C0%7C481%7C90%7C54&lle=0&ifv=1&hpt=1 HTTP/1.1
Host: www.adsensecustomsearchads.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 204 No Content
content-type: text/html; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-2H4nR5YKs__5aiI8ttJTOA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
date: Thu, 18 Apr 2024 10:37:43 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

rape.su/track.php?domain=rape.su&caf=1&toggle=answercheck&answer=yes&uid=MTcxMzQzNjY1OS45MTg0Ojk5NDEzMWM2ZGY1NTMxZTEwMTVjZjY1NzFmZTczMGI0Nzc2YmI0NDMwY2FmNDI4ZGZhZThkZDVkYzlmNzIwMTU6NjYyMGY3ZjNlMDM4NA%3D%3D

185.53.178.7

200 OK

0 B

URL GET HTTP/1.1
rape.su/track.php?domain=rape.su&caf=1&toggle=answercheck&answer=yes&uid=MTcxMzQzNjY1OS45MTg0Ojk5NDEzMWM2ZGY1NTMxZTEwMTVjZjY1NzFmZTczMGI0Nzc2YmI0NDMwY2FmNDI4ZGZhZThkZDVkYzlmNzIwMTU6NjYyMGY3ZjNlMDM4NA%3D%3D
IP
185.53.178.7:80
ASN
#61969 Team Internet AG

Requested by
http://rape.su/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /track.php?domain=rape.su&caf=1&toggle=answercheck&answer=yes&uid=MTcxMzQzNjY1OS45MTg0Ojk5NDEzMWM2ZGY1NTMxZTEwMTVjZjY1NzFmZTczMGI0Nzc2YmI0NDMwY2FmNDI4ZGZhZThkZDVkYzlmNzIwMTU6NjYyMGY3ZjNlMDM4NA%3D%3D HTTP/1.1
Host: rape.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://rape.su/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Apr 2024 10:37:41 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Custom-Track: answercheck
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML