Report - my-admin-sql.org/data/6977722252/rat/140wa69z/id.txt

Report Overview

Submitted URL
my-admin-sql.org/data/6977722252/rat/140wa69z/id.txt
IP
185.11.145.145
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA
Submitted
2024-04-25 09:02:04
Access
public
Website Title
Account Suspended
Final URL
my-admin-sql.org/cgi-sys/suspendedpage.cgi
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
24

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
maxcdn.bootstrapcdn.com	724	2012-05-25	2014-06-18	2024-04-24	450 B	29 kB	104.18.11.207
use.fontawesome.com	942	2012-10-18	2017-01-30	2024-04-23	960 B	48 kB	172.67.142.245
zerossl.ocsp.sectigo.com	4049	2018-08-16	2020-05-09	2024-04-23	336 B	807 B	104.18.38.233
my-admin-sql.org	unknown	unknown	No data	No data	3.5 kB	52 kB	185.11.145.145
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-25	1.0 kB	33 kB	216.58.207.227
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	435 B	7.8 kB	142.250.74.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed
2024-04-25	medium	my-admin-sql.org	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (13)

URL IP Response Size

zerossl.ocsp.sectigo.com/

104.18.38.233

315 B

URL
zerossl.ocsp.sectigo.com/
IP
104.18.38.233:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
315 B (315 bytes)
Hash
7099b38c8b24783e22d2ae101e798091
00f6d79ff9ef68c3fa149c112ac5829efb7cd4a6
e072974b1c7ca9a738516a89ea89d0a811bf41e9525a8c8141fd8c55b4610070

HTTP Headers

POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:01:39 GMT
Content-Type: application/ocsp-response
Content-Length: 315
Connection: keep-alive
Last-Modified: Mon, 22 Apr 2024 12:25:36 GMT
Expires: Mon, 29 Apr 2024 12:25:35 GMT
Etag: "00f6d79ff9ef68c3fa149c112ac5829efb7cd4a6"
Cache-Control: max-age=357235,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 879d2652c91b5699-OSL

my-admin-sql.org/data/6977722252/rat/140wa69z/id.txt

185.11.145.145

234 B

URL
my-admin-sql.org/data/6977722252/rat/140wa69z/id.txt
IP
185.11.145.145:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
HTML document, ASCII text
Size
234 B (234 bytes)
Hash
2d162862cff43418946250424ba93f45
0ad54d35d0f154e43db64da7e0588d69e4a349f3
9396475d46c373846180d7da28f6a19ece5a29003c108deffe3d16852ad7945f

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /data/6977722252/rat/140wa69z/id.txt HTTP/1.1
Host: my-admin-sql.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 09:01:53 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Access-Control-Allow-Origin: *
Expires: Thu, 02 May 2024 09:01:53 GMT
Cache-Control: max-age=604800, public, must-revalidate

my-admin-sql.org/cgi-sys/suspendedpage.cgi

185.11.145.145

200 OK

6.4 kB

URL User Request GET HTTP/1.1
my-admin-sql.org/cgi-sys/suspendedpage.cgi
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjectmy-admin-sql.org
Fingerprint66:63:53:9F:4F:9C:11:43:51:DB:05:A6:0F:25:22:17:65:DF:98:BA
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (6024)
Size
6.4 kB (6358 bytes)
Hash
e34956c7ebace6b13ce0e10d18e34ddc
3b8a4e263fd01447ef4f0f7b9d64b84c48b6dd3f
ba13042cdf2976d7e51ac297dc451d24c166a698ee86968928e47738a4383c94

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cgi-sys/suspendedpage.cgi HTTP/1.1
Host: my-admin-sql.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 09:01:53 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: BlazingWebCookie=y9wIYhjxgAPrB9aWUgJ1jhnorYfGfP2HutSr3bRynLUBJ3jpczB6AG4xIK2VuBoj; Expires=Thu, 02-May-24 09:01:53 GMT; Domain=.my-admin-sql.org; Path=/
Content-Encoding: gzip

my-admin-sql.org/bf.jquery.max.js

185.11.145.145

39 kB

URL
my-admin-sql.org/bf.jquery.max.js
IP
185.11.145.145:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
JavaScript source, ASCII text, with very long lines (32047)
Size
39 kB (38898 bytes)
Hash
5790ead7ad3ba27397aedfa3d263b867
8130544c215fe5d1ec081d83461bf4a711e74882
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bf.jquery.max.js HTTP/1.1
Host: my-admin-sql.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Cookie: BlazingWebCookie=y9wIYhjxgAPrB9aWUgJ1jhnorYfGfP2HutSr3bRynLUBJ3jpczB6AG4xIK2VuBoj
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 09:01:54 GMT
Content-Type: application/javascript
Last-Modified: Fri, 10 Jun 2022 20:17:16 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62a3a6cc-176bb"
Cache-Control: no-store
Content-Encoding: gzip

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

216.58.207.227

16 kB

URL
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
216.58.207.227:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 15740, version 1.0
Size
16 kB (15740 bytes)
Hash
b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

HTTP Headers

GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://my-admin-sql.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:32:46 GMT
expires: Fri, 25 Apr 2025 02:32:46 GMT
cache-control: public, max-age=31536000
age: 23334
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2

216.58.207.227

16 kB

URL
fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2
IP
216.58.207.227:0
ASN
#15169 GOOGLE

File type
Web Open Font Format (Version 2), TrueType, length 15764, version 1.0
Size
16 kB (15764 bytes)
Hash
603b8950590bf833546eee7cbc79944a
ebbde06eb829868c5f689afe2d48377608be1e7b
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18

HTTP Headers

GET /s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://my-admin-sql.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15764
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 08:37:16 GMT
expires: Wed, 23 Apr 2025 08:37:16 GMT
cache-control: public, max-age=31536000
age: 174264
last-modified: Wed, 11 May 2022 19:24:35 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

my-admin-sql.org/favicon.ico

185.11.145.145

404 Not Found

125 B

URL GET HTTP/1.1
my-admin-sql.org/favicon.ico
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Requested by
https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Certificate
IssuerZeroSSL
Subjectmy-admin-sql.org
Fingerprint66:63:53:9F:4F:9C:11:43:51:DB:05:A6:0F:25:22:17:65:DF:98:BA
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
125 B (125 bytes)
Hash
70461da8b94c6ca5d2fda3260c5a8c3b
994bc667720c21257500e29038c1a5f61e25da1e
f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: my-admin-sql.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Cookie: BlazingWebCookie=y9wIYhjxgAPrB9aWUgJ1jhnorYfGfP2HutSr3bRynLUBJ3jpczB6AG4xIK2VuBoj
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 09:01:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

fonts.googleapis.com/css?family=Roboto:100,300

142.250.74.106

7.1 kB

URL
fonts.googleapis.com/css?family=Roboto:100,300
IP
142.250.74.106:0
ASN
#15169 GOOGLE

File type
gzip compressed data, max compression
Size
7.1 kB (7133 bytes)
Hash
99a0e0032c27eb3f60f5da8e307a8935
09d4b5555947711dbf9e9115de4797dfa221a890
a3dc6c790f9eec5fde2b798cf0232254d6e89083fb2e6a27c3d8ebb5cecd8677

HTTP Headers

GET /css?family=Roboto:100,300 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://my-admin-sql.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 09:01:40 GMT
date: Thu, 25 Apr 2024 09:01:40 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css

104.18.11.207

28 kB

URL
maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css
IP
104.18.11.207:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65371)
Size
28 kB (27730 bytes)
Hash
eedf9ee80c2faa4e1b9ab9017cdfcb88
ed29315e0ffb3f14382431f2724235bf67f44eb3
f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5

HTTP Headers

GET /bootstrap/3.3.4/css/bootstrap.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://my-admin-sql.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 09:01:40 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"eedf9ee80c2faa4e1b9ab9017cdfcb88"
last-modified: Mon, 25 Jan 2021 22:03:58 GMT
cdn-cachedat: 08/04/2023 12:50:24
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 7e74c5fea2151758aaf7c8cf1f839c4a
cdn-cache: HIT
cf-cache-status: HIT
age: 13137720
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 879d2655686ab4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

my-admin-sql.org/blzgfst-shark/?bfu=%2Fcgi-sys%2Fsuspendedpage.cgi&blazing_answer=35623541

185.11.145.145

302 Moved Temporarily

147 B

URL User Request GET HTTP/1.1
my-admin-sql.org/blzgfst-shark/?bfu=%2Fcgi-sys%2Fsuspendedpage.cgi&blazing_answer=35623541
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjectmy-admin-sql.org
Fingerprint66:63:53:9F:4F:9C:11:43:51:DB:05:A6:0F:25:22:17:65:DF:98:BA
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
147 B (147 bytes)
Hash
dfc9726ebc3f35d51f26beb34d4805c8
7ec3f23167f0867082c2ef640a654455f280374d
d42674d81adbb679d02b40041b327a237529a92a388867b3701a580cd32cd1e5

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /blzgfst-shark/?bfu=%2Fcgi-sys%2Fsuspendedpage.cgi&blazing_answer=35623541 HTTP/1.1
Host: my-admin-sql.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Cookie: BlazingWebCookie=y9wIYhjxgAPrB9aWUgJ1jhnorYfGfP2HutSr3bRynLUBJ3jpczB6AG4xIK2VuBoj
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 09:01:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: BlazingPuzzleCookie=j2vtsuiTE9gh0GuU9l0EuF5hU8wQ2Fqzy2r8BJJKXx75wVsW8P6rUndvHau4guzS; Expires=Thu, 02-May-24 09:01:59 GMT; Domain=.my-admin-sql.org; Path=/
Location: /cgi-sys/suspendedpage.cgi

my-admin-sql.org/cgi-sys/suspendedpage.cgi

185.11.145.145

200 OK

4.2 kB

URL User Request GET HTTP/1.1
my-admin-sql.org/cgi-sys/suspendedpage.cgi
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjectmy-admin-sql.org
Fingerprint66:63:53:9F:4F:9C:11:43:51:DB:05:A6:0F:25:22:17:65:DF:98:BA
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (4070)
Size
4.2 kB (4231 bytes)
Hash
7e81fc5d7ad3474b017ff55e54480301
980d3d668a902e43dd5eeadda18d0b33380e4ed5
1bc0998ee19e1e504ba5328496ac59cad3dea68b28827cfa20b487e124a9dcde

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cgi-sys/suspendedpage.cgi HTTP/1.1
Host: my-admin-sql.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
DNT: 1
Connection: keep-alive
Cookie: BlazingWebCookie=y9wIYhjxgAPrB9aWUgJ1jhnorYfGfP2HutSr3bRynLUBJ3jpczB6AG4xIK2VuBoj; BlazingPuzzleCookie=j2vtsuiTE9gh0GuU9l0EuF5hU8wQ2Fqzy2r8BJJKXx75wVsW8P6rUndvHau4guzS
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 09:01:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: session=Y_sVuGU85yHVZB1t1p_Sww..|1714039319|zLTlcOwGV0XPLVAiERE6k7k4Rbs.; Domain=.my-admin-sql.org; Path=/; SameSite=Lax; Secure; HttpOnly
Access-Control-Allow-Origin: *
Content-Encoding: gzip

use.fontawesome.com/releases/v5.0.6/css/all.css

172.67.142.245

200 OK

7.8 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.0.6/css/all.css
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
ASCII text, with very long lines (34556)
Size
7.8 kB (7751 bytes)
Hash
42eaa52604673b64d6b356c2fd7f87e3
6b59cb703b2d4a7a2691f13008062b46a6bc7fdb
ed0f122470c4d13d86bbabdc38046d743d0228204a56d786d2e17bd83fd358ce

HTTP Headers

GET /releases/v5.0.6/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://my-admin-sql.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 09:01:45 GMT
content-type: text/css
cache-control: max-age=31556926
etag: W/"42eaa52604673b64d6b356c2fd7f87e3"
last-modified: Fri, 22 Sep 2023 01:44:11 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 2516408
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iyr275zsLCFGX5DZn4vTkXcSdZoq5U6gp3SKXbCoSzOm2gYbQblL3Lc7mHWLKQjOMEGeczE%2BotfaVRgPQ6SCTgg6DCodEIlFPz0l3RB2WsPkqxhezcX8SJeAleL1xJN9HEUJVMXt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879d2677cd0fb517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

use.fontawesome.com/releases/v5.0.6/webfonts/fa-solid-900.woff2

172.67.142.245

200 OK

39 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.0.6/webfonts/fa-solid-900.woff2
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://my-admin-sql.org/cgi-sys/suspendedpage.cgi
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 38784, version 1.0
Size
39 kB (38784 bytes)
Hash
f9b85c9463af7103b9b24bbbf09a06ed
d28d7222bcbeb8ea701a771e85f7efe006e62fb1
62554277d07b20c6bfae7c6267b3198b4846f604a37d4085bf9f54c392210b56

HTTP Headers

GET /releases/v5.0.6/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://my-admin-sql.org
DNT: 1
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 09:01:45 GMT
content-type: application/font-woff2
content-length: 38784
access-control-allow-origin: *
cache-control: max-age=31556926
etag: "f9b85c9463af7103b9b24bbbf09a06ed"
last-modified: Fri, 22 Sep 2023 01:44:10 GMT
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 77924
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bgnbbYd5oVJ3G%2BOL7%2BoEvgJHQyklt1xx1%2FKZ7eVwTYydyFb%2BTSit5UKKbAk%2BeQZkI8TL7RsL9yjrSpFUxa2kGjjMfxJw8EBgWCN%2FCuKdBGf5%2BCCuNiBmM6nX%2B2N%2FJjWsfFacA0cb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879d267848d5568f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (13)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size