IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hashbf22aca13e676d8d005d875e1f627955 be19f135bc0099fe21d1fd9067df27d6452afbce 1a54e6b8a836c418abaf97d82775f1416bf9c842d32c2a366ae040b421e4796f
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1A54E6B8A836C418ABAF97D82775F1416BF9C842D32C2A366AE040B421E4796F"
Last-Modified: Fri, 20 Sep 2024 01:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16801
Expires: Fri, 20 Sep 2024 08:56:39 GMT
Date: Fri, 20 Sep 2024 04:16:38 GMT
Connection: keep-alive
|
URL User Request GET HTTP/1.1IP 40.129.7.198:80
File typeHTML document, ASCII text, with very long lines (451), with CRLF line terminators Hash7dff90da9f1853c180b28111873bb2d3 0a0b2884926a5e33e3dfabfc226a5d3078433e7a 734dfbcebbe533c347de28d5b0971b740c0da54bfee8ea0fd97d88d46c16139f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 40.129.7.198
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Fri, 20 Sep 2024 04:16:39 GMT
Content-Length: 540
|
IP40.129.7.198:80
File typeGIF image data, version 89a, 150 x 150 Hash5b7794c242a19aceb7cf97da3b5dbb18 692bb5d79972859f11e38ef2065dac7bc6a0cb26 2d23411674a0c10a230ca9a84e04aa22f2d2edc006b5f35e6aa18cfd070552e5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 40.129.7.198
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://40.129.7.198/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Wed, 17 Jan 2007 16:59:54 GMT
Accept-Ranges: bytes
ETag: "061c3e8583ac71:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Fri, 20 Sep 2024 04:16:39 GMT
Content-Length: 3222
|