URL User Request GET HTTP/1.1 IP 167.103.19.65:80
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET / HTTP/1.1
Host: 167.103.19.65
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Content-Length: 0
Access-Control-Allow-Origin: *
Location: https://gateway.zscalertwo.net:443/auD?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
Content-Type: text/html
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Set-Cookie: _sm_au_d=1;SameSite=LAX;path=/;domain=167.103.19.65
gateway.zscalertwo.net/auD?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
147.161.146.25307 Temporary Redirect 0 B URL User Request GET HTTP/1.1 gateway.zscalertwo.net/auD?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
IP 147.161.146.25:443
ASN #62044 Zscaler Switzerland GmbH
Certificate IssuerDigiCert Inc
Subject*.zscalertwo.net
FingerprintF4:9B:00:D0:E7:96:67:23:42:E9:50:B8:95:35:4F:CA:9D:2A:30:FC
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sun, 06 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /auD?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ HTTP/1.1
Host: gateway.zscalertwo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Content-Length: 0
Access-Control-Allow-Origin: *
Location: https://gateway.zscalertwo.net:443/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
Content-Type: text/html
Set-Cookie: _sm_au_d=1;path=/;domain=.zscalertwo.net;SameSite=None;Secure;HttpOnly;
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
gateway.zscalertwo.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
147.161.146.25200 OK 22 kB URL User Request GET HTTP/1.1 gateway.zscalertwo.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
IP 147.161.146.25:443
ASN #62044 Zscaler Switzerland GmbH
Certificate IssuerDigiCert Inc
Subject*.zscalertwo.net
FingerprintF4:9B:00:D0:E7:96:67:23:42:E9:50:B8:95:35:4F:CA:9D:2A:30:FC
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sun, 06 Oct 2024 23:59:59 GMT
File type HTML document text HTML document, ASCII text, with very long lines (22034), with no line terminators
Hash 5a93b32eacf7204bd1bf26eb7ee1e4b6
e23971fd8d52069ea14bb53828889a256155f18f
9728b648d5bd73a346c2b02f17d87953b2a65f02848c8290eac7c916a9badd77
GET /auT?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ HTTP/1.1
Host: gateway.zscalertwo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: _sm_au_d=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html
Server: Zscaler/6.2
Cache-Control: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-length: 22034
Set-Cookie: _sm__fch=tQTH0k1kRNDDQ
gateway.zscalertwo.net/favicon.ico
147.161.146.25403 Forbidden 14 kB URL GET HTTP/1.1 gateway.zscalertwo.net/favicon.ico
IP 147.161.146.25:443
ASN #62044 Zscaler Switzerland GmbH
Requested by https://gateway.zscalertwo.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
Certificate IssuerDigiCert Inc
Subject*.zscalertwo.net
FingerprintF4:9B:00:D0:E7:96:67:23:42:E9:50:B8:95:35:4F:CA:9D:2A:30:FC
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sun, 06 Oct 2024 23:59:59 GMT
File type HTML document text HTML document, ASCII text, with very long lines (2391)
Hash 44fa4f2d87c3ee026870c9436e7c36f4
cc5e159503f891b9f17151784726cb5bdcc50ab0
2a89c61fe3244c19636960d45071d7877c5b40a9d8c20451d323be0c814c2d8c
GET /favicon.ico HTTP/1.1
Host: gateway.zscalertwo.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gateway.zscalertwo.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e65%2f&_ordtok=KrZ3WVLJLVFkJ4sf40W3lT0VVZ
Cookie: _sm_au_d=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Content-Type: text/html
Server: Zscaler/6.2
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Content-length: 13703