297 B IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 605758fc07fab09e8972bc577186edab
ac300aaedd4022723873447aadb3366ae04c3409
604cf633a6315780304dd556a498442c4ad25c8e73944fc59c51d0abad8a6b31
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.zzux .com Domain
GET / HTTP/1.1
Host: eventkios45.zzux.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 01 Jun 2023 16:04:52 GMT
Content-Type: text/html
Content-Length: 297
Connection: keep-alive
Last-Modified: Thu, 27 Apr 2023 10:21:14 GMT
ETag: "1b0-5fa4eb758da80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
assets.plesk.com/static/default-website-content/public/default-server-index.js
200 OK 25 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/default-server-index.js
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type gzip compressed data, from Unix\012- data
Hash d25d3ba385e9503f17c3caa5f5cee734
00f3a2c742e3993b2aeb5f7aaaae28d73e2fb116
8bfc1d3c7be3ff038a60097596178d88649c08ee5832998c0bca1c0640cb0664
GET /static/default-website-content/public/default-server-index.js HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: application/javascript; charset=utf-8
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: W/"6413e061-68c5"
expires: Fri, 17 Mar 2023 03:51:08 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 80C0:0E7F:3F7DB8:41F1FE:6413E154
via: 1.1 varnish
age: 0
x-served-by: cache-bma1677-BMA
x-cache-hits: 0
x-timer: S1679024468.363949,VS0,VE119
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: f849ba9c008551d133b07a2c6bf8fcca20177d59
server: CDN77-Turbo
x-77-nzt: AblMCRSgrSbelAIAAA
x-77-nzt-ray: af585630108db0e3a4c1786481a24a16
x-accel-expires: @1685636092
x-accel-date: 1685634832
x-cache: REVALIDATED
x-age: 660
x-77-pop: stockholmSE
x-77-cache: HIT
content-encoding: gzip
X-Firefox-Spdy: h2
assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-700-54321e.woff2
200 OK 18 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-700-54321e.woff2
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type Web Open Font Format (Version 2), TrueType, length 17784, version 1.0\012- data
Hash 8d7a3f034881d1712b3325cc71425c10
9594f24367800a20297a96c2d4f957e62c63e207
ced2d8e02e2fbf08d2edec9b5f13648ed8348588a05f7181632f3c1dd6e1f5c3
GET /static/default-website-content/public/fonts/inter-v12-latin-700-54321e.woff2 HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://eventkios45.zzux.com
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: font/woff2
content-length: 17784
permissions-policy: interest-cohort=()
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: "6413e061-4578"
expires: Fri, 17 Mar 2023 03:56:22 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 4966:2564:13BAAEF:146B79F:6413E28E
via: 1.1 varnish
age: 0
x-served-by: cache-bma1658-BMA
x-cache-hits: 0
x-timer: S1679024782.498966,VS0,VE119
vary: Accept-Encoding
x-fastly-request-id: e2a6e11cf3940b3fb5710d9bfa8f124909106c1e
server: CDN77-Turbo
x-77-nzt: AblMCRRDZgT/RwIAAA
x-77-nzt-ray: af5856303b8b12e6a4c178643b9ebd26
x-accel-expires: @1685635509
x-accel-date: 1685634909
x-cache: HIT
x-age: 583
x-77-pop: stockholmSE
x-77-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
assets.plesk.com/static/default-website-content/public/favicon-2d0e10.ico
200 OK 114 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/favicon-2d0e10.ico
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel\012- data
Size 114 kB (113459 bytes)
Hash 1db747255c64a30f9236e9d929e986ca
384023452346aa087d40c93c23ca2f5e32ff1b1f
88baf40feb43463a8f6aa6543e88bdbe33f0db9a317486e786eee1e5c76a9544
GET /static/default-website-content/public/favicon-2d0e10.ico HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: image/vnd.microsoft.icon
content-length: 113459
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: "6413e061-1bb33"
expires: Fri, 17 Mar 2023 03:50:57 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 54BC:781F:3C0AC2D:3E30D37:6413E149
via: 1.1 varnish
age: 17
x-served-by: cache-bma1622-BMA
x-cache-hits: 1
x-timer: S1679024474.184535,VS0,VE1
vary: Accept-Encoding
x-fastly-request-id: 385435d77f2b2ffc59ee4783a7282434337a3fd5
server: CDN77-Turbo
x-77-nzt: AblMCRQLujDeqQIAAA
x-77-nzt-ray: af585630108db0e3a4c17864bd97ce27
x-accel-expires: @1685636092
x-accel-date: 1685634811
x-cache: REVALIDATED
x-age: 681
x-77-pop: stockholmSE
x-77-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.r2m01.amazontrust.com/
471 B URL ocsp.r2m01.amazontrust.com/
IP
Hash d3764bf394f4617916dab6c9d169ecde
01cbf397d437fb34ae15a3a0d4593ad9826f68a0
90c57da39883cf7ab9dfdfb3179575840d4e1ffb60374c8b640f933003fc76ba
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Thu, 01 Jun 2023 16:04:53 GMT
Last-Modified: Thu, 01 Jun 2023 14:41:36 GMT
Server: ECAcc (nya/7968)
X-Cache: Miss from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: qRWsYDbGv8LfWk55rgUaqjHGGNTLgKUNWawQ6-3aOZGFUDeJwmlsPA==
Age: 4997
ocsp.r2m01.amazontrust.com/
471 B URL ocsp.r2m01.amazontrust.com/
IP
Hash d3764bf394f4617916dab6c9d169ecde
01cbf397d437fb34ae15a3a0d4593ad9826f68a0
90c57da39883cf7ab9dfdfb3179575840d4e1ffb60374c8b640f933003fc76ba
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Thu, 01 Jun 2023 16:04:53 GMT
Last-Modified: Thu, 01 Jun 2023 14:41:44 GMT
Server: ECAcc (bsa/EB26)
X-Cache: Miss from cloudfront
Via: 1.1 0e39dca74306d7aab723ed3d73dbfbb4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: 29zA830ylnQK6OQ7pLL-HfQZEthjPuVztmngPWWvd8VCUB1F50Nl7A==
Age: 4990
firehose.us-west-2.amazonaws.com/
200 OK 20 B URL OPTIONS HTTP/1.1 firehose.us-west-2.amazonaws.com/
IP
Requested by http://eventkios45.zzux.com/
Certificate IssuerAmazon
Subjectfirehose.us-west-2.amazonaws.com
Fingerprint33:FD:78:B1:20:8F:6F:DC:AD:63:CA:90:DB:65:81:6C:6B:52:01:BB
ValidityWed, 01 Mar 2023 00:00:00 GMT - Thu, 29 Feb 2024 23:59:59 GMT
File type gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)\012- data
Hash 3970e82605c7d109bb348fc94e9eecc0
e03849ea786b9f7b28a35c17949e85a93eb1cff1
f5d031af01f137ae07fa71720fab94d16cc8a2a59868766002918b7c240f3967
OPTIONS / HTTP/1.1
Host: firehose.us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent
Referer: http://eventkios45.zzux.com/
Origin: http://eventkios45.zzux.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amzn-RequestId: f14ddab1-95a2-b80f-adbf-1954fd53b350
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Access-Control-Allow-Headers: authorization,content-type,x-amz-content-sha256,x-amz-date,x-amz-target,x-amz-user-agent
Access-Control-Allow-Methods: POST
Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-request-id,x-amz-id-2,x-amzn-ErrorMessage,Date
Access-Control-Max-Age: 172800
Content-Length: 20
Date: Thu, 01 Jun 2023 16:04:52 GMT
firehose.us-west-2.amazonaws.com/
200 OK 245 B URL OPTIONS HTTP/1.1 firehose.us-west-2.amazonaws.com/
IP
Requested by http://eventkios45.zzux.com/
Certificate IssuerAmazon
Subjectfirehose.us-west-2.amazonaws.com
Fingerprint33:FD:78:B1:20:8F:6F:DC:AD:63:CA:90:DB:65:81:6C:6B:52:01:BB
ValidityWed, 01 Mar 2023 00:00:00 GMT - Thu, 29 Feb 2024 23:59:59 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 85a7a5d38b86496696e4bf9e6f103655
16afa2943e59fd80a2e9ed351fd596c2f8abfaa5
646b114441e197fd55331abb5c2a9f45594a7da2ff094152da90ad98aa0fa135
POST / HTTP/1.1
Host: firehose.us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Amz-User-Agent: aws-sdk-js/2.1335.0 callback
Content-Type: application/x-amz-json-1.1
X-Amz-Target: Firehose_20150804.PutRecord
X-Amz-Content-Sha256: 596bf03671d28647bdf8219d7505db5ea10d6c24dee3a4f0241f08d05521d898
X-Amz-Date: 20230601T160452Z
Authorization: AWS4-HMAC-SHA256 Credential=AKIAR4YEYRJL6JKBNRGP/20230601/us-west-2/firehose/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-target;x-amz-user-agent, Signature=31e0b12a0f3452706e4abac31d9a091cec02b1728ab97f4f1d013231202af5f5
Content-Length: 108
Origin: http://eventkios45.zzux.com
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amzn-RequestId: cce49ebc-7b95-d829-9016-5d591364d376
Access-Control-Allow-Origin: *
Content-Encoding: gzip
x-amz-id-2: t3n0mZ6RUon3EOIPBm+JkorkrNPYaH/lo8HCIvTos0NrfDk2ZglBNJxa4fMeoqV63Gjn4C5AaSu5QaE9FAtlQUwY70Nr+ILe
Access-Control-Expose-Headers: x-amzn-RequestId,x-amzn-ErrorType,x-amz-request-id,x-amz-id-2,x-amzn-ErrorMessage,Date
Content-Type: application/x-amz-json-1.1
Content-Length: 245
Date: Thu, 01 Jun 2023 16:04:52 GMT
assets.plesk.com/static/default-website-content/public/img/robot-4b152c.svg
200 OK 89 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/img/robot-4b152c.svg
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (65536), with no line terminators
Hash a11790af7b8e734f7391d2695e96bfc8
af73e0993f9a486721d75bc21d6eb6e17104ece9
01084e18312cb2af2d6b89b7348a7f1e5ae8faf10c0bd9ce478dd38adb2955a3
GET /static/default-website-content/public/img/robot-4b152c.svg HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: image/svg+xml
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: W/"6413e061-15bb6"
expires: Fri, 17 Mar 2023 03:47:41 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: F078:0C56:31B615:33C34C:6413E085
via: 1.1 varnish
age: 0
x-served-by: cache-bma1651-BMA
x-cache-hits: 0
x-timer: S1679024262.544210,VS0,VE157
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 31ce43d106a74af407eb05ec2962432f0ed17dd3
server: CDN77-Turbo
x-77-nzt: AblMCRTDSYb/AwAAAA
x-77-nzt-ray: af585630108db0e3a4c17864a11a0e23
x-accel-expires: @1685636089
x-accel-date: 1685635489
x-cache: HIT
x-age: 3
x-77-pop: stockholmSE
x-77-cache: HIT
content-encoding: gzip
X-Firefox-Spdy: h2
assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-regular-be7cb1.woff2
200 OK 17 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/fonts/inter-v12-latin-regular-be7cb1.woff2
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type Web Open Font Format (Version 2), TrueType, length 16708, version 1.0\012- data
Hash 68c477c4c76baab3a8d1ef6a55aa986f
4af50379e13514558dd53d123db8ea101ec5e24c
0364d368abf457d4e70dbc7a7a360f3486eaea2837b194915b23d4398bee91ac
GET /static/default-website-content/public/fonts/inter-v12-latin-regular-be7cb1.woff2 HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://eventkios45.zzux.com/
Origin: http://eventkios45.zzux.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: font/woff2
content-length: 16708
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: "6413e061-4144"
expires: Fri, 17 Mar 2023 03:56:22 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: D8F0:FA6B:14366CF:14EE920:6413E28E
via: 1.1 varnish
age: 0
x-served-by: cache-bma1639-BMA
x-cache-hits: 0
x-timer: S1679024782.459548,VS0,VE133
vary: Accept-Encoding
x-fastly-request-id: 3b308dfc6febdb130bf120afd02906f5efd74eb0
server: CDN77-Turbo
x-77-nzt: AblMCRQLkpf/RwIAAA
x-77-nzt-ray: af5856303b8b12e6a4c178644ffcaf23
x-accel-expires: @1685635509
x-accel-date: 1685634909
x-cache: HIT
x-age: 583
x-77-pop: stockholmSE
x-77-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
eventkios45.zzux.com/favicon.ico
0 B URL GET eventkios45.zzux.com/favicon.ico
IP
Requested by http://eventkios45.zzux.com/
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
NIDS Severity Alert suricata medium ET INFO DYNAMIC_DNS HTTP Request to a *.zzux .com Domain
GET /favicon.ico HTTP/1.1
Host: eventkios45.zzux.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Pragma: no-cache
Cache-Control: no-cache
assets.plesk.com/static/default-website-content/public/img/logo-81ca7a.svg
200 OK 2.1 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/img/logo-81ca7a.svg
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2118), with no line terminators
Hash f9feb5d64f4aa6ef9441952f93004e90
94b804495ac52b65261f53f1dd97c0d0691a7ac5
024d3703031d890a8de7c855c2fdbe295daf1b803f828f4e7f225f75d0897941
GET /static/default-website-content/public/img/logo-81ca7a.svg HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: image/svg+xml
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: W/"6413e061-833"
expires: Fri, 17 Mar 2023 03:47:41 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 62B8:2564:13B3BE9:14640BF:6413E085
via: 1.1 varnish
age: 0
x-served-by: cache-bma1657-BMA
x-cache-hits: 0
x-timer: S1679024262.544866,VS0,VE117
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 0f310044a3e4ab686b2c1f0ff8ca908afd5a3cba
server: CDN77-Turbo
x-77-nzt: AblMCRQKStr/2QEAAA
x-77-nzt-ray: af585630108db0e3a4c17864082a4122
x-accel-expires: @1685635619
x-accel-date: 1685635019
x-cache: HIT
x-age: 473
x-77-pop: stockholmSE
x-77-cache: HIT
content-encoding: gzip
X-Firefox-Spdy: h2
assets.plesk.com/static/default-website-content/public/bundle.js
200 OK 295 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/bundle.js
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 295 kB (295320 bytes)
Hash 26c98df9bcdad657b5165c13f7bf206e
4447bc2d08af637b3b74bea3cc74ce036616f81e
f98c1f60e8868b1864ea53f7065ce6c0844bb1d0f069e0fb3cb5c86796264463
GET /static/default-website-content/public/bundle.js HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: application/javascript; charset=utf-8
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: W/"6413e061-48198"
expires: Fri, 17 Mar 2023 03:47:41 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: F28E:12950:36319A5:3840283:6413E085
via: 1.1 varnish
age: 0
x-served-by: cache-bma1658-BMA
x-cache-hits: 0
x-timer: S1679024261.319754,VS0,VE207
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: ac411854cc754f8433aa41c6f453b86c9c2492d6
server: CDN77-Turbo
x-77-nzt: AblMCRR6dsX/2QEAAA
x-77-nzt-ray: af585630108db0e3a4c17864f372a322
x-accel-expires: @1685635619
x-accel-date: 1685635019
x-cache: HIT
x-age: 473
x-77-pop: stockholmSE
x-77-cache: HIT
content-encoding: gzip
X-Firefox-Spdy: h2
assets.plesk.com/static/default-website-content/public/img/stars-fb15b6.svg
200 OK 24 kB URL GET HTTP/2 assets.plesk.com/static/default-website-content/public/img/stars-fb15b6.svg
IP
ASN #60068 Datacamp Limited
Requested by http://eventkios45.zzux.com/
Certificate IssuerLet's Encrypt
Subject1226552209.rsc.cdn77.org
Fingerprint55:53:79:0A:7B:19:31:CB:0C:72:0C:2B:A7:FF:16:F6:E2:7B:B8:76
ValidityFri, 12 May 2023 06:48:43 GMT - Thu, 10 Aug 2023 06:48:42 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (23586)
Hash 18aa9407cb97208391f24bcef249457f
c76eef71591d7d92fb30f51b49dadf16ae600a05
30628c4c5254e81ed7f953bd449c6976ce87210089c4b221f00c3a7a5d597736
GET /static/default-website-content/public/img/stars-fb15b6.svg HTTP/1.1
Host: assets.plesk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://eventkios45.zzux.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 01 Jun 2023 16:04:52 GMT
content-type: image/svg+xml
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 17 Mar 2023 03:37:05 GMT
access-control-allow-origin: *
etag: W/"6413e061-5c23"
expires: Fri, 17 Mar 2023 03:47:41 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 9B76:0C56:31B615:33C34B:6413E085
via: 1.1 varnish
age: 0
x-served-by: cache-bma1672-BMA
x-cache-hits: 0
x-timer: S1679024262.543660,VS0,VE120
vary: Accept-Encoding, Accept-Encoding
x-fastly-request-id: 98e82d2e6c971609fcdc0c56c00c84a4fd301a2b
server: CDN77-Turbo
x-77-nzt: AblMCRS9Cbj/sQAAAA
x-77-nzt-ray: af585630108db0e3a4c1786434500b23
x-accel-expires: @1685635915
x-accel-date: 1685635315
x-cache: HIT
x-age: 177
x-77-pop: stockholmSE
x-77-cache: HIT
content-encoding: gzip
X-Firefox-Spdy: h2
62.4.16.126
185.76.9.24
54.230.80.227
0.0.0.0