| 46.101.76.227/bins/furasshu.arm5 |  46.101.76.227 | 200 OK | 2.1 kB |
URL User Request GET HTTP/1.146.101.76.227/bins/furasshu.arm5 IP46.101.76.227:80 ASN#14061 DIGITALOCEAN-ASN
File typeHTML document, ASCII text, with very long lines (421) Hash92be9e30fde827d174f82ba0f3a55603 f7b8b8c0088922b018b408c38bbdfcea06a99f27 2f2d838ca2b3da39ed7aa4398d1b3dcdf5b7cef5cd974c9445c6c18915b9ad0b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET HUNTING Suspicious GET Request for .arm file File |
GET /bins/furasshu.arm5 HTTP/1.1
Host: 46.101.76.227
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 18 Apr 2024 11:11:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
|
| 46.101.76.227/favicon.ico | 46.101.76.227 | 200 OK | 2.1 kB |
URL GET HTTP/1.146.101.76.227/favicon.ico IP46.101.76.227:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://46.101.76.227/bins/furasshu.arm5
File typeHTML document, ASCII text, with very long lines (421) Hash92be9e30fde827d174f82ba0f3a55603 f7b8b8c0088922b018b408c38bbdfcea06a99f27 2f2d838ca2b3da39ed7aa4398d1b3dcdf5b7cef5cd974c9445c6c18915b9ad0b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 46.101.76.227
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://46.101.76.227/bins/furasshu.arm5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 18 Apr 2024 11:11:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
|
| 46.101.76.227/assets/sammytheshark.gif | 46.101.76.227 | 200 OK | 1.1 MB |
URL GET HTTP/1.146.101.76.227/assets/sammytheshark.gif IP46.101.76.227:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://46.101.76.227/bins/furasshu.arm5
File typeGIF image data, version 89a, 750 x 422 Size1.1 MB (1066340 bytes) Hash8b7b099a7de0aabe625df02e8506ff08 88613a4b9dbf50170cfb5b55b79e019d8c1d46a9 b277c6e6fea762cbba89ec36242a1630b7dc68fbd77bb9044623b772284f8d7d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/sammytheshark.gif HTTP/1.1
Host: 46.101.76.227
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://46.101.76.227/bins/furasshu.arm5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 18 Apr 2024 11:11:42 GMT
Content-Type: image/gif
Content-Length: 1066340
Last-Modified: Tue, 23 Jun 2020 20:36:08 GMT
Connection: keep-alive
ETag: "5ef267b8-104564"
Expires: Thu, 18 Apr 2024 23:11:42 GMT
Cache-Control: max-age=43200, public
Accept-Ranges: bytes
|