IP141.8.192.6:0 ASN#35278 Sprinthost.ru LLC
File typeHTML document, Unicode text, UTF-8 text, with very long lines (19980) Hash198e78f0dbd919927f8b1a45323de7b8 274a44afd990d5e8c0fd47843b32585cfa7a7b74 97d394e9b9ef2da948adfc70109d4b6b30c75e924966c793446fb5113aab9411
NIDS | Severity | Alert | suricata | high | ET MALWARE Single char EXE direct download likely trojan (multiple families) | suricata | high | ET MALWARE Single char EXE direct download likely trojan (multiple families) |
GET /1.exe HTTP/1.1
Host: a0981250.xsph.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: openresty
Date: Fri, 10 May 2024 05:44:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
|
| a0981250.xsph.ru/favicon.ico | 141.8.192.6 | 403 Forbidden | 15 kB |
URL GET HTTP/1.1a0981250.xsph.ru/favicon.ico IP141.8.192.6:80 ASN#35278 Sprinthost.ru LLC
Requested byhttp://a0981250.xsph.ru/1.exe
File typeHTML document, Unicode text, UTF-8 text, with very long lines (19980) Hash198e78f0dbd919927f8b1a45323de7b8 274a44afd990d5e8c0fd47843b32585cfa7a7b74 97d394e9b9ef2da948adfc70109d4b6b30c75e924966c793446fb5113aab9411
GET /favicon.ico HTTP/1.1
Host: a0981250.xsph.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://a0981250.xsph.ru/1.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: openresty
Date: Fri, 10 May 2024 05:44:49 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
|