Report - tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php

Report Overview

Submitted URL
tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
IP
185.11.145.254
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA
Submitted
2024-04-25 15:51:08
Access
public
Website Title
Account Suspended
Final URL
tech-1.org/cgi-sys/suspendedpage.cgi
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
28

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
zerossl.ocsp.sectigo.com	4049	2018-08-16	2020-05-09	2024-04-23	336 B	807 B	104.18.38.233
tech-1.org	unknown	unknown	No data	No data	4.0 kB	52 kB	185.11.145.145
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-25	1.0 kB	33 kB	216.58.207.227
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	429 B	9.1 kB	142.250.74.74
use.fontawesome.com	942	2012-10-18	2017-01-30	2024-04-24	948 B	48 kB	104.21.27.152
maxcdn.bootstrapcdn.com	724	2012-05-25	2014-06-18	2024-04-24	446 B	118 kB	104.18.11.207

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-25 15:50:43	high	Client IP	185.11.145.145	ThreatFox IRATA botnet C2 traffic (ip:port - confidence level: 50%)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed
2024-04-25	medium	tech-1.org	Sinkholed

ThreatFox

Scan Date	Severity	Indicator	Alert
2024-04-22	medium	tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php	IRATA
2024-04-22	medium	tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php	IRATA

JavaScript (0)

HTTP Transactions (13)

URL IP Response Size

zerossl.ocsp.sectigo.com/

104.18.38.233

315 B

URL
zerossl.ocsp.sectigo.com/
IP
104.18.38.233:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
315 B (315 bytes)
Hash
d7880c77a1617bc2fc51cff62eb55802
3984716e3ec94225bb322b3987a69e7cad022d5e
2c68b0c5ab53aa428567860a7ac20e29ac60cb6d1e85bf3cbe87ef4d3edcba5e

HTTP Headers

POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 15:50:43 GMT
Content-Type: application/ocsp-response
Content-Length: 315
Connection: keep-alive
Last-Modified: Tue, 23 Apr 2024 13:27:05 GMT
Expires: Tue, 30 Apr 2024 13:27:04 GMT
Etag: "3984716e3ec94225bb322b3987a69e7cad022d5e"
Cache-Control: max-age=422780,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 879f7d89f94b56c6-OSL

tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php

185.11.145.145

302 Found

6.4 kB

URL User Request GET HTTP/1.1
tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjecttech-1.org
FingerprintD3:D9:D0:49:EC:85:9A:AB:7D:A4:53:16:7A:2F:13:04:45:BE:8D:60
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (6024)
Size
6.4 kB (6376 bytes)
Hash
540d329614a77f1671d790316024d915
5ba879eaaa51875176f189359c03fc3bfed641b7
0a095945a1f0777acb37e3155140b02b1a3376653ef3980d33b27c7b77d02af1

Detections

Analyzer	Verdict	Alert
ThreatFox	malicious	IRATA
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php HTTP/1.1
Host: tech-1.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 15:50:57 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: BlazingWebCookie=7iGwxsqRJGczZQ40XjDoFrnRsZWc8367ZYcSwomPtYe0IV9rDuLkBzw6bDHHk6b0; Expires=Thu, 02-May-24 15:50:57 GMT; Domain=.tech-1.org; Path=/
Content-Encoding: gzip

tech-1.org/bf.jquery.max.js

185.11.145.145

200 OK

39 kB

URL GET HTTP/1.1
tech-1.org/bf.jquery.max.js
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Requested by
https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Certificate
IssuerZeroSSL
Subjecttech-1.org
FingerprintD3:D9:D0:49:EC:85:9A:AB:7D:A4:53:16:7A:2F:13:04:45:BE:8D:60
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32047)
Size
39 kB (38898 bytes)
Hash
5790ead7ad3ba27397aedfa3d263b867
8130544c215fe5d1ec081d83461bf4a711e74882
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bf.jquery.max.js HTTP/1.1
Host: tech-1.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Cookie: BlazingWebCookie=7iGwxsqRJGczZQ40XjDoFrnRsZWc8367ZYcSwomPtYe0IV9rDuLkBzw6bDHHk6b0
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 15:50:58 GMT
Content-Type: application/javascript
Last-Modified: Fri, 10 Jun 2022 20:17:16 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"62a3a6cc-176bb"
Cache-Control: no-store
Content-Encoding: gzip

tech-1.org/favicon.ico

185.11.145.145

404 Not Found

125 B

URL GET HTTP/1.1
tech-1.org/favicon.ico
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Requested by
https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Certificate
IssuerZeroSSL
Subjecttech-1.org
FingerprintD3:D9:D0:49:EC:85:9A:AB:7D:A4:53:16:7A:2F:13:04:45:BE:8D:60
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
125 B (125 bytes)
Hash
70461da8b94c6ca5d2fda3260c5a8c3b
994bc667720c21257500e29038c1a5f61e25da1e
f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: tech-1.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Cookie: BlazingWebCookie=7iGwxsqRJGczZQ40XjDoFrnRsZWc8367ZYcSwomPtYe0IV9rDuLkBzw6bDHHk6b0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 15:50:58 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

216.58.207.227

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15740, version 1.0
Size
16 kB (15740 bytes)
Hash
b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

HTTP Headers

GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://tech-1.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:32:46 GMT
expires: Fri, 25 Apr 2025 02:32:46 GMT
cache-control: public, max-age=31536000
age: 47878
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2

216.58.207.227

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15764, version 1.0
Size
16 kB (15764 bytes)
Hash
603b8950590bf833546eee7cbc79944a
ebbde06eb829868c5f689afe2d48377608be1e7b
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18

HTTP Headers

GET /s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://tech-1.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15764
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 08:37:16 GMT
expires: Wed, 23 Apr 2025 08:37:16 GMT
cache-control: public, max-age=31536000
age: 198808
last-modified: Wed, 11 May 2022 19:24:35 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Roboto:100,300

142.250.74.74

200 OK

8.5 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Roboto:100,300
IP
142.250.74.74:443
ASN
#15169 GOOGLE

Requested by
https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
8.5 kB (8502 bytes)
Hash
53d0f225d29513f7665247c45ddb0086
3e64ac63ce96b89df45689a3aa640ea0e93a629e
271450fb1edc7ef9eb1800308c6e193ab9a96efec3823c244137751a9870da81

HTTP Headers

GET /css?family=Roboto:100,300 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tech-1.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 15:50:43 GMT
date: Thu, 25 Apr 2024 15:50:43 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

tech-1.org/blzgfst-shark/?bfu=%2Fdata%2F6977722252%2Fpayment%2F54Wa3c29%2Feblaghhh%2Fconfirm.php&blazing_answer=81339828

185.11.145.145

302 Moved Temporarily

147 B

URL User Request GET HTTP/1.1
tech-1.org/blzgfst-shark/?bfu=%2Fdata%2F6977722252%2Fpayment%2F54Wa3c29%2Feblaghhh%2Fconfirm.php&blazing_answer=81339828
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjecttech-1.org
FingerprintD3:D9:D0:49:EC:85:9A:AB:7D:A4:53:16:7A:2F:13:04:45:BE:8D:60
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
147 B (147 bytes)
Hash
dfc9726ebc3f35d51f26beb34d4805c8
7ec3f23167f0867082c2ef640a654455f280374d
d42674d81adbb679d02b40041b327a237529a92a388867b3701a580cd32cd1e5

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /blzgfst-shark/?bfu=%2Fdata%2F6977722252%2Fpayment%2F54Wa3c29%2Feblaghhh%2Fconfirm.php&blazing_answer=81339828 HTTP/1.1
Host: tech-1.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Cookie: BlazingWebCookie=7iGwxsqRJGczZQ40XjDoFrnRsZWc8367ZYcSwomPtYe0IV9rDuLkBzw6bDHHk6b0
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 15:51:03 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: BlazingPuzzleCookie=Ie5f6IT5SNESyiRru7CYrJyaeJTpcxVo1vYJHnTf3JqVi2hmrMonetaJ5IYggrlV; Expires=Thu, 02-May-24 15:51:03 GMT; Domain=.tech-1.org; Path=/
Location: /data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php

tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php

185.11.145.145

302 Found

228 B

URL User Request GET HTTP/1.1
tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjecttech-1.org
FingerprintD3:D9:D0:49:EC:85:9A:AB:7D:A4:53:16:7A:2F:13:04:45:BE:8D:60
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text
Size
228 B (228 bytes)
Hash
c284f8ff109b982a8c20290909d87c11
7892b6270ea746e11c67e85f8449f42396e7034c
6910315b70f30a9d42999178a399508b098eee2c7b4ed69e7e3e2815c9afda96

Detections

Analyzer	Verdict	Alert
ThreatFox	malicious	IRATA
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php HTTP/1.1
Host: tech-1.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
DNT: 1
Connection: keep-alive
Cookie: BlazingWebCookie=7iGwxsqRJGczZQ40XjDoFrnRsZWc8367ZYcSwomPtYe0IV9rDuLkBzw6bDHHk6b0; BlazingPuzzleCookie=Ie5f6IT5SNESyiRru7CYrJyaeJTpcxVo1vYJHnTf3JqVi2hmrMonetaJ5IYggrlV
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 15:51:03 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: session=G3o9AFhnkTK5DmpvsPBKPw..|1714063863|RNhAEwTSpgqI7sUrylxYqfgpLSs.; Domain=.tech-1.org; Path=/; SameSite=Lax; Secure; HttpOnly
Location: https://tech-1.org/cgi-sys/suspendedpage.cgi
Access-Control-Allow-Origin: *

tech-1.org/cgi-sys/suspendedpage.cgi

185.11.145.145

200 OK

4.2 kB

URL User Request GET HTTP/1.1
tech-1.org/cgi-sys/suspendedpage.cgi
IP
185.11.145.145:443
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

Certificate
IssuerZeroSSL
Subjecttech-1.org
FingerprintD3:D9:D0:49:EC:85:9A:AB:7D:A4:53:16:7A:2F:13:04:45:BE:8D:60
ValidityMon, 22 Apr 2024 00:00:00 GMT - Sun, 21 Jul 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (4070)
Size
4.2 kB (4227 bytes)
Hash
3db19bd4a4894fe4b2f0206f22b02afe
deb3c05af256f8bb710b51cef37e81ac1f74f87d
a62058e73a383ebdd39be18a9a1796eb45860a80b6de098568b4ef7cb93e331f

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cgi-sys/suspendedpage.cgi HTTP/1.1
Host: tech-1.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
DNT: 1
Connection: keep-alive
Cookie: BlazingWebCookie=7iGwxsqRJGczZQ40XjDoFrnRsZWc8367ZYcSwomPtYe0IV9rDuLkBzw6bDHHk6b0; BlazingPuzzleCookie=Ie5f6IT5SNESyiRru7CYrJyaeJTpcxVo1vYJHnTf3JqVi2hmrMonetaJ5IYggrlV; session=G3o9AFhnkTK5DmpvsPBKPw..|1714063863|RNhAEwTSpgqI7sUrylxYqfgpLSs.
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: BlazingFastWeb
Date: Thu, 25 Apr 2024 15:51:03 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: session=G3o9AFhnkTK5DmpvsPBKPw..|1714063863|RNhAEwTSpgqI7sUrylxYqfgpLSs.; Domain=.tech-1.org; Path=/; SameSite=Lax; Secure; HttpOnly
Access-Control-Allow-Origin: *
Content-Encoding: gzip

use.fontawesome.com/releases/v5.0.6/css/all.css

104.21.27.152

200 OK

7.8 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.0.6/css/all.css
IP
104.21.27.152:443
ASN
#13335 CLOUDFLARENET

Requested by
https://tech-1.org/cgi-sys/suspendedpage.cgi
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
ASCII text, with very long lines (34556)
Size
7.8 kB (7751 bytes)
Hash
42eaa52604673b64d6b356c2fd7f87e3
6b59cb703b2d4a7a2691f13008062b46a6bc7fdb
ed0f122470c4d13d86bbabdc38046d743d0228204a56d786d2e17bd83fd358ce

HTTP Headers

GET /releases/v5.0.6/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tech-1.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 15:50:49 GMT
content-type: text/css
cache-control: max-age=31556926
etag: W/"42eaa52604673b64d6b356c2fd7f87e3"
last-modified: Fri, 22 Sep 2023 01:44:11 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 2540952
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nmE%2FuOzxfv2jpzyoPy9gRrdmuCJm9YFnDUa8u8u4K9npTyoDbf4F%2Fr9OealouR9UqtT9rwNuKGw%2F%2B6e73Sy27yxMPZqK3mtEBnlftL3J3ivv6v1Y3jIxQ0NZMPZ5EpXZb4Z5GR1A"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879f7dae7a7856c9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

use.fontawesome.com/releases/v5.0.6/webfonts/fa-solid-900.woff2

104.21.27.152

200 OK

39 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.0.6/webfonts/fa-solid-900.woff2
IP
104.21.27.152:443
ASN
#13335 CLOUDFLARENET

Requested by
https://tech-1.org/cgi-sys/suspendedpage.cgi
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 38784, version 1.0
Size
39 kB (38784 bytes)
Hash
f9b85c9463af7103b9b24bbbf09a06ed
d28d7222bcbeb8ea701a771e85f7efe006e62fb1
62554277d07b20c6bfae7c6267b3198b4846f604a37d4085bf9f54c392210b56

HTTP Headers

GET /releases/v5.0.6/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://tech-1.org
DNT: 1
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 15:50:49 GMT
content-type: application/font-woff2
content-length: 38784
access-control-allow-origin: *
cache-control: max-age=31556926
etag: "f9b85c9463af7103b9b24bbbf09a06ed"
last-modified: Fri, 22 Sep 2023 01:44:10 GMT
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 8425
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ILrn7lmZwzy6z5gvnMfbwE%2BvZonZdGztpR0kALm5%2Bc2mIBI8vanoSSaIPjG4OaRXHT8Raf86BWVfaRa0793DGCg%2F5mzon39bRJnzkAjETVpvQHI9e2p42Ppb4mOGVaaBCAhAwE7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879f7daf0bfd5693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css

104.18.11.207

200 OK

117 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://tech-1.org/data/6977722252/payment/54Wa3c29/eblaghhh/confirm.php
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
ASCII text, with very long lines (65371)
Size
117 kB (117305 bytes)
Hash
eedf9ee80c2faa4e1b9ab9017cdfcb88
ed29315e0ffb3f14382431f2724235bf67f44eb3
f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5

HTTP Headers

GET /bootstrap/3.3.4/css/bootstrap.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tech-1.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 15:50:43 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"eedf9ee80c2faa4e1b9ab9017cdfcb88"
last-modified: Mon, 25 Jan 2021 22:03:58 GMT
cdn-cachedat: 08/04/2023 12:50:24
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 7e74c5fea2151758aaf7c8cf1f839c4a
cdn-cache: HIT
cf-cache-status: HIT
age: 13162263
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 879f7d8c0af80b51-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (13)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash