Report - oshi.at/rzhj/socks5

Report Overview

Submitted URL
oshi.at/rzhj/socks5_backconnect.rar
IP
188.241.120.6
ASN
#25369 Hydra Communications Ltd
Submitted
2024-04-17 17:18:40
Access
public
Website Title
O shi-, 404
Final URL
oshi.at/rzhj/socks5_backconnect.rar
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
32

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
oshi.at	unknown	unknown	2019-05-14	2024-04-16	3.6 kB	246 kB	188.241.120.6
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-17	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed
2024-04-17	medium	oshi.at	Sinkholed

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	oshi.at/minified.js	24 kB	2023-03-07	2024-04-17
Pretty URL oshi.at/minified.js IP 194.15.112.248 ASN #213354 International Hosting Solutions Llp Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 21:54:47 Last Seen2024-04-17 19:18:40 Times Seen39 Hash 049ca1d3c742acc15ac3dd8124fcf19c 72afda4939c71ab849519adf1f9f4d94d579f03a 3fd3184bcfcd2a1b0376039adffc57fe07560e91f1ebb3351fd62a98711d9060 Loading...

HTTP Transactions (9)

URL IP Response Size

oshi.at/rzhj/socks5_backconnect.rar

188.241.120.6

301 Moved Permanently

786 B

URL User Request GET HTTP/1.1
oshi.at/rzhj/socks5_backconnect.rar
IP
188.241.120.6:80
ASN
#25369 Hydra Communications Ltd

File type
HTML document, ASCII text
Size
786 B (786 bytes)
Hash
b17ae67792d7788f66a79d3ba981fd0e
7c9652788ada68a5a39f22de954074d79c2439bb
a4476908423f7b2e61b27eed308d5b75ffbc6f873b08ea99868adae6dfaeb260

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rzhj/socks5_backconnect.rar HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 17 Apr 2024 17:18:15 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

oshi.at/rzhj/socks5_backconnect.rar

188.241.120.6

301 Moved Permanently

162 B

URL User Request GET HTTP/1.1
oshi.at/rzhj/socks5_backconnect.rar
IP
188.241.120.6:80
ASN
#25369 Hydra Communications Ltd

File type
HTML document, ASCII text, with CRLF line terminators
Size
162 B (162 bytes)
Hash
4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rzhj/socks5_backconnect.rar HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 17 Apr 2024 17:18:15 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://oshi.at/rzhj/socks5_backconnect.rar

oshi.at/rzhj/socks5_backconnect.rar

188.241.120.6

301 Moved Permanently

786 B

URL User Request GET HTTP/1.1
oshi.at/rzhj/socks5_backconnect.rar
IP
188.241.120.6:80
ASN
#25369 Hydra Communications Ltd

File type
HTML document, ASCII text
Size
786 B (786 bytes)
Hash
b17ae67792d7788f66a79d3ba981fd0e
7c9652788ada68a5a39f22de954074d79c2439bb
a4476908423f7b2e61b27eed308d5b75ffbc6f873b08ea99868adae6dfaeb260

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rzhj/socks5_backconnect.rar HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 17 Apr 2024 17:18:16 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

oshi.at/static/css/main.css

194.15.112.248

200 OK

4.8 kB

URL GET HTTP/1.1
oshi.at/static/css/main.css
IP
194.15.112.248:443
ASN
#213354 International Hosting Solutions Llp

Requested by
https://oshi.at/rzhj/socks5_backconnect.rar
Certificate
IssuerLet's Encrypt
Subjectoshi.at
Fingerprint7D:39:6A:D8:B3:26:3D:17:AA:A0:80:1A:90:E9:57:11:18:99:44:6E
ValiditySun, 14 Apr 2024 08:54:23 GMT - Sat, 13 Jul 2024 08:54:22 GMT

File type
assembler source, ASCII text
Size
4.8 kB (4802 bytes)
Hash
4733a9ac4f0a6dcc854409f080354021
f3792118130b0661abd7bcb964aef5bf244c3cb4
d11477642466ebf998a6c90f9e844143282a3d852d6a5b1e69879021b9e02155

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/css/main.css HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oshi.at/rzhj/socks5_backconnect.rar
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 15 Apr 2024 09:58:43 GMT
Content-Type: text/css
Content-Length: 4802
Connection: keep-alive
ETag: "68dca9173a04728abf2392b05b277fd6"
Last-Modified: Wed, 15 Dec 2021 12:58:29 GMT
Accept-Ranges: bytes

oshi.at/minified.js

194.15.112.248

200 OK

24 kB

URL GET HTTP/1.1
oshi.at/minified.js
IP
194.15.112.248:443
ASN
#213354 International Hosting Solutions Llp

Requested by
https://oshi.at/rzhj/socks5_backconnect.rar
Certificate
IssuerLet's Encrypt
Subjectoshi.at
Fingerprint7D:39:6A:D8:B3:26:3D:17:AA:A0:80:1A:90:E9:57:11:18:99:44:6E
ValiditySun, 14 Apr 2024 08:54:23 GMT - Sat, 13 Jul 2024 08:54:22 GMT

File type
JavaScript source, ASCII text, with very long lines (24285), with no line terminators
Size
24 kB (24285 bytes)
Hash
049ca1d3c742acc15ac3dd8124fcf19c
72afda4939c71ab849519adf1f9f4d94d579f03a
3fd3184bcfcd2a1b0376039adffc57fe07560e91f1ebb3351fd62a98711d9060

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /minified.js HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oshi.at/rzhj/socks5_backconnect.rar
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 15 Apr 2024 09:58:43 GMT
Content-Type: application/octet-stream
Content-Length: 24285
Connection: keep-alive

oshi.at/static/vendor/bootstrap/css/bootstrap.min.css

188.241.120.6

200 OK

156 kB

URL GET HTTP/1.1
oshi.at/static/vendor/bootstrap/css/bootstrap.min.css
IP
188.241.120.6:443
ASN
#25369 Hydra Communications Ltd

Requested by
https://oshi.at/rzhj/socks5_backconnect.rar
Certificate
IssuerLet's Encrypt
Subjectoshi.at
Fingerprint7D:39:6A:D8:B3:26:3D:17:AA:A0:80:1A:90:E9:57:11:18:99:44:6E
ValiditySun, 14 Apr 2024 08:54:23 GMT - Sat, 13 Jul 2024 08:54:22 GMT

File type
ASCII text, with very long lines (65324)
Size
156 kB (155758 bytes)
Hash
a15c2ac3234aa8f6064ef9c1f7383c37
6e10354828454898fda80f55f3decb347fd9ed21
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oshi.at/rzhj/socks5_backconnect.rar
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 17 Apr 2024 17:18:16 GMT
Content-Type: text/css
Content-Length: 155758
Connection: keep-alive
accept-ranges: bytes
last-modified: Wed, 15 Dec 2021 12:58:29 GMT
etag: "68dca9173a04728abf2392b05b277fd6"

oshi.at/favicon.ico

194.15.112.248

200 OK

15 kB

URL GET HTTP/1.1
oshi.at/favicon.ico
IP
194.15.112.248:443
ASN
#213354 International Hosting Solutions Llp

Requested by
https://oshi.at/rzhj/socks5_backconnect.rar
Certificate
IssuerLet's Encrypt
Subjectoshi.at
Fingerprint7D:39:6A:D8:B3:26:3D:17:AA:A0:80:1A:90:E9:57:11:18:99:44:6E
ValiditySun, 14 Apr 2024 08:54:23 GMT - Sat, 13 Jul 2024 08:54:22 GMT

File type
MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Size
15 kB (15086 bytes)
Hash
8a2593bf645ea0551923acb5d6a09cd8
8d752a32b063fb56efef22c2801537b7c1171f74
6c95881c8d2fed8f26fafbb863ca111cb2e75202916b9140141c436e61d54c42

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oshi.at/rzhj/socks5_backconnect.rar
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 15 Apr 2024 09:58:44 GMT
Content-Type: image/x-icon
Content-Length: 15086
Connection: keep-alive
Last-Modified: Sun, 14 Jun 2020 16:05:44 GMT
Accept-Ranges: bytes
ETag: "0acda02ca9ab6842915f57c28adbea94"

oshi.at/static/404.jpg

188.241.120.6

200 OK

42 kB

URL GET HTTP/1.1
oshi.at/static/404.jpg
IP
188.241.120.6:443
ASN
#25369 Hydra Communications Ltd

Requested by
https://oshi.at/rzhj/socks5_backconnect.rar
Certificate
IssuerLet's Encrypt
Subjectoshi.at
Fingerprint7D:39:6A:D8:B3:26:3D:17:AA:A0:80:1A:90:E9:57:11:18:99:44:6E
ValiditySun, 14 Apr 2024 08:54:23 GMT - Sat, 13 Jul 2024 08:54:22 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, baseline, precision 8, 960x472, components 3
Size
42 kB (42347 bytes)
Hash
25a81b75239974c397ecb328eacf3f2f
67d65112e25b0d50d13cbcb9884db81f61ae935a
650be7ae9bba7f4dafe80cb4efe971be4690f981403323e009b2a36891a214dd

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/404.jpg HTTP/1.1
Host: oshi.at
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oshi.at/static/css/main.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 17 Apr 2024 17:18:17 GMT
Content-Type: image/jpeg
Content-Length: 42347
Connection: keep-alive
last-modified: Wed, 15 Dec 2021 12:58:29 GMT
accept-ranges: bytes
etag: "68dca9173a04728abf2392b05b277fd6"

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-101-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-101-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
XML 1.0 document, ASCII text, with very long lines (332)
Size
444 B (444 bytes)
Hash
3b324dec137a87ef7e24a30a65b13dd0
c0faa95b2f1018e264b3a14aaf50d1003e6c27b3
6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-101-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-05-20-00-15-28.chain; p384ecdsa=IUR0ZDABWVw0BbkacnNzDsjJOU_8PHNw32GjyvtMvPxjE3mHrX8C_i7tOKQxVK1beRTbaG3aOYhav-JLiQcFNvuc3t_8fkjpBvioiXnUFtI4awicZ-oojEqrohJhfZ7K
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
date: Wed, 17 Apr 2024 17:18:24 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 10
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP