URL User Request GET HTTP/1.1 IP
File type gzip compressed data, from Unix\012- data
Hash 8eeb3c9bd4711cab30d9af612387209f
a97c83ab7beb88d51b82a10789d2b403aa5facfa
901b6f5cdbc78773816c7e8164a034aabe1bad9d9641ea9cd1fc16b75c5d12ed
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
suricata low ET INFO HTTP Request to a *.pw domain
GET /apiir HTTP/1.1
Host: killredls.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sat, 25 Nov 2023 21:37:36 GMT
location: http://killredls.pw/apiir
cache-control: max-age=3600
expires: Sat, 25 Nov 2023 22:37:36 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oEMEQZpYb6fKyvekuEunbXXObJ6%2F3EqKSiOcgJg%2Bo4wTfxBomeAK%2BBhUXfX098VPL0RZhwIb%2BBhWifzIjklZMBVWqwCN6UNlT6kPBTYnYRZeXxfHr2itP84wL%2BkvoHE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82bd08a97c730b3d-OSL
X-Firefox-Spdy: h2
killredls.pw/cdn-cgi/styles/challenges.css
200 OK 2.6 kB URL GET HTTP/1.1 killredls.pw/cdn-cgi/styles/challenges.css
IP
Requested by http://killredls.pw/apiir
File type ASCII text, with very long lines (6600), with no line terminators
Hash 2c78b7f8fa496092bf41d5edd51611e7
8b0b1b276e8194b0a5497db478ec2ea9b4f83c42
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata low ET INFO HTTP Request to a *.pw domain
GET /cdn-cgi/styles/challenges.css HTTP/1.1
Host: killredls.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://killredls.pw/apiir
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 Nov 2023 21:37:36 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 16 Nov 2023 21:55:48 GMT
ETag: W/"65568fe4-19c8"
Server: cloudflare
CF-RAY: 82bd08ac5f785689-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Sat, 25 Nov 2023 23:37:36 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip
killredls.pw/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82bd08aa2a091c16
200 OK 1.9 kB URL GET HTTP/1.1 killredls.pw/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82bd08aa2a091c16
IP
Requested by http://killredls.pw/apiir
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (394)
Hash c4999e89d258e7fcfcee15f9cdf01260
3d3ede20438af7e6aedb5a1e929056933fb82a67
9489667180f2a87f7dea20885b30f82f6311c1b513901c8020758ef31c563da9
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata low ET INFO HTTP Request to a *.pw domain
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82bd08aa2a091c16 HTTP/1.1
Host: killredls.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://killredls.pw/apiir?__cf_chl_rt_tk=ArrLsji2Cbj8wpz__ROnEkNpZtgz.DYCm7tOZJviGNo-1700948256-0-gaNycGzNBeU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 25 Nov 2023 21:37:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rfRx6J6ITm3%2F4TKuEbn7Qi9kv%2BZQznEfL1BrLEBz3HT4vI%2B04itYwOHL6hjDizwrThX%2FdqWmXJJPvutYKnlP6RlWFypBxS3IU7C9P%2BSBx9MHgN5BMZXfeV1Gvb99zzE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82bd08ac9fdd5689-OSL
Content-Encoding: gzip
IP
Requested by http://killredls.pw/apiir
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4724), with no line terminators
Hash 3f88be5c1a81c38720316c41a2c08588
2acea95f0225116c11f680fda3cd98157b9d1fd4
b749e36464f69b4bddeb3074c34d6856d6f101e25892650ff5a1f340a55d3b15
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata low ET INFO HTTP Request to a *.pw domain
GET /favicon.ico HTTP/1.1
Host: killredls.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://killredls.pw/apiir
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sat, 25 Nov 2023 21:37:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2NatnpxmuEpYIL9m%2Bw0C%2F9Tv5OQOHRhnRm2EHD5hQdufd1kqJOP1JCu56EEqSrO0uptxXJYgQ8nlhYkyveVJfp1wdQITr5zJGPvvEIVyzZnC5ZCV2TSA0AlyCmQYWEM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82bd08acc80f5689-OSL
Content-Encoding: gzip
172.67.209.38
104.21.53.57