URL User Request GET HTTP/1.1IP 104.143.9.111:80
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hash81a2568d4220d5bd0cc1380d3bfd819e 97f18e697fa1a0bf3d1b5ba3340b0b27addbbb47 f0100c57042ec3b9b1fc4c06ce1fec2eae50655d72c04b3500c02e85d30ed931
GET /update.txt HTTP/1.1
Host: 12881288.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 23 Sep 2023 22:59:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_FzrU0O/DzPHwhUHqvo1zsrZd6OYhY/CKmMbfkIpM4HkqpULVsnDaZNpBRyCVeu0ugpO2Xos2NXdjGtQoX27wGQ==
Content-Encoding: gzip
|
IP104.143.9.111:80
Requested byhttp://12881288.com/update.txt
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
GET /favicon.ico HTTP/1.1
Host: 12881288.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://12881288.com/update.txt
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 23 Sep 2023 22:59:18 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
|
| 63.141.249.30/12881288.com/update.txt | 63.141.249.30 | 404 Not Found | 221 B |
URL GET HTTP/1.163.141.249.30/12881288.com/update.txt IP63.141.249.30:80
Requested byhttp://12881288.com/update.txt
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hashe7346b46ac7877345ba7a408d75a6328 2a5a5f754b00d86b9a0f8b4ab4f0fe18d556bbfd 4f71fb0ec4c270bef95b86fcba03fb686148e3151ba8272ced2973b7debb5730
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /12881288.com/update.txt HTTP/1.1
Host: 63.141.249.30
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://12881288.com/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Sat, 23 Sep 2023 22:59:17 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 221
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|