| mail.nexi.193-222-96-145.cprapid.com/ |  193.222.96.145 | | 549 B |
URL mail.nexi.193-222-96-145.cprapid.com/ IP193.222.96.145:0 ASN#203168 Constant MOULIN
File typeHTML document, ASCII text Hashfc21d6fb08702e202ee81b6026340b01 c4b872e1a4458bc40a6687beec55cadbd243bbc2 b95360d1ae86f9e925bf3a2bc3c57c1f24982d408bbeef627b83cc0e922c9ae8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: mail.nexi.193-222-96-145.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 09:21:11 GMT
Server: Apache/2.4.41 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 549
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
| ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js |  142.250.74.106 | | 31 kB |
URL ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js IP142.250.74.106:0
File typeJavaScript source, ASCII text, with very long lines (65451) Hashdc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://mail.nexi.193-222-96-145.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 16 Apr 2024 09:56:44 GMT
expires: Wed, 16 Apr 2025 09:56:44 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 170667
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
| mail.nexi.193-222-96-145.cprapid.com/img/icon_p.png | 193.222.96.145 | | 298 B |
URL mail.nexi.193-222-96-145.cprapid.com/img/icon_p.png IP193.222.96.145:0 ASN#203168 Constant MOULIN
File typeHTML document, ASCII text Hash04c69eb05a6a3094b521a28d50bbf25e dfacb9d48cac849f77e44f24bb2f76c017a94079 15f905f6d4bc0d5aec049d342fe537e11eb7f7e48aaa98f59eb029f2da173833
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/icon_p.png HTTP/1.1
Host: mail.nexi.193-222-96-145.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://mail.nexi.193-222-96-145.cprapid.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 18 Apr 2024 09:21:11 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
| mail.nexi.193-222-96-145.cprapid.com/beginnen.php | 193.222.96.145 | | 0 B |
URL User Request GET mail.nexi.193-222-96-145.cprapid.com/beginnen.php IP193.222.96.145:0 ASN#203168 Constant MOULIN
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /beginnen.php HTTP/1.1
Host: mail.nexi.193-222-96-145.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Thu, 18 Apr 2024 09:21:16 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
| mail.nexi.193-222-96-145.cprapid.com/favicon.ico | 193.222.96.145 | 404 Not Found | 298 B |
URL GET HTTP/1.1mail.nexi.193-222-96-145.cprapid.com/favicon.ico IP193.222.96.145:80 ASN#203168 Constant MOULIN
Requested byhttp://mail.nexi.193-222-96-145.cprapid.com/beginnen.php
File typeHTML document, ASCII text Hash04c69eb05a6a3094b521a28d50bbf25e dfacb9d48cac849f77e44f24bb2f76c017a94079 15f905f6d4bc0d5aec049d342fe537e11eb7f7e48aaa98f59eb029f2da173833
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: mail.nexi.193-222-96-145.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://mail.nexi.193-222-96-145.cprapid.com/beginnen.php
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 18 Apr 2024 09:21:17 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 298
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|