URL User Request GET HTTP/1.1IP 168.76.252.16:80
ASN#137951 ASLINE LIMITED
File typeHTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators Hashc25337a1dbaabbe780a5b10e3c70829d c8717c8e958369052cf9de80a2b8aad745b04e95 23e6b6c646bb689dac5ca1a70bcd2d87a5b2ac0a46603af6be90b8d8b3cc8d08
GET / HTTP/1.1
Host: docflash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 May 2024 18:20:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Trace-Id: 51c3899fde47cd170aba45424ffb53ae
X-Cache: MISS
Content-Encoding: gzip
|
| docflash.net/public/css/css8.css | 168.76.252.16 | 200 OK | 4.0 kB |
URL GET HTTP/1.1docflash.net/public/css/css8.css IP168.76.252.16:80 ASN#137951 ASLINE LIMITED
File typeUnicode text, UTF-8 text, with very long lines (2386) Hashfe2839c004269fa974f08839d48256d7 b8b3daba1508e8b7e8301761fcf3ba7dcae429b8 d90a540e51a6cef0a1aa99759f51d71c4db6cab00d703fb6f682a279e68bc55f
GET /public/css/css8.css HTTP/1.1
Host: docflash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://docflash.net/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 May 2024 18:20:57 GMT
Content-Type: text/css; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Wed, 03 Apr 2024 13:03:04 GMT
X-Cache: MISS
Content-Encoding: gzip
|
| 43.139.22.16:1668/pic/12093.jpg |  43.139.22.16 | 200 OK | 7.6 kB |
URL GET HTTP/1.143.139.22.16:1668/pic/12093.jpg IP43.139.22.16:1668 ASN#45090 Shenzhen Tencent Computer Systems Company Limited
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 40", baseline, precision 8, 363x225, components 3 Hashb76247a8120fd5edf3792cc933c594f9 82dfdd2ccb8279c7c64cf7cb99dadf817ae38026 ed3a5d0b98911f086f7f15396d18e2cda90b523de2e8f34113d27b3ac936b3e8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pic/12093.jpg HTTP/1.1
Host: 43.139.22.16:1668
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://docflash.net/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 May 2024 18:23:32 GMT
Content-Type: image/jpeg
Content-Length: 7637
Last-Modified: Mon, 23 Oct 2023 07:06:13 GMT
Connection: keep-alive
ETag: "65361b65-1dd5"
Expires: Thu, 06 Jun 2024 18:23:32 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
|
IP168.76.252.16:80 ASN#137951 ASLINE LIMITED
File typeMS Windows icon resource - 1 icon, 32x32, 32 bits/pixel Hashda865a0b09efc4afb8b82adb67bd1923 dd9bf440da4950cf6a004d4d3803dd4db9718e93 5bb8acdc25ba3e8be7607d4ea4095347f74e081d817eee079345056b741473f8
GET /favicon.ico HTTP/1.1
Host: docflash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://docflash.net/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 07 May 2024 18:21:01 GMT
Content-Type: image/vnd.microsoft.icon
Content-Length: 4286
Connection: keep-alive
Last-Modified: Tue, 12 Sep 2023 10:12:35 GMT
X-Cache: MISS
Accept-Ranges: bytes
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml |  35.244.181.201 | | 5.8 kB |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP35.244.181.201:0 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typegzip compressed data, max speed, from Unix Hashaa33725c2d0a3d1c2f9c878d64914807 6e83d13ec860384a977738b04ff0891a01ab519a fe412eadb3dc9820ec6cab7cb62349be057c509e34f7e2de6d23b28eacc98bfd
GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Tue, 07 May 2024 18:23:41 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=p7iV4KWdUglrxs2hdWv228eWfaqrZF-PDjQWTbiiiw4m_z7FYvZbD90yeHLLqTKfFUmycZleSeU3VazGj6YjpgxGisiNz7n2SiUp83LHNoc8bIyuefT04GZbrVGuR-0M
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|