Report - 149.28.109.35/8UsA.sh

Report Overview

Submitted URL
149.28.109.35/8UsA.sh
IP
149.28.109.35
ASN
#20473 AS-CHOOPA
Submitted
2023-03-31 08:44:58
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
44

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
fonts.googleapis.com	8877	2013-06-10T22:14:26Z	2023-03-31T20:23:24Z	415 B	630 B	142.250.74.74
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-31T18:14:44Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-31T18:18:04Z	413 B	5.9 kB	34.160.144.191
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-31T18:12:03Z	686 B	1.4 kB	142.250.74.131
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-31T07:51:33Z	3.2 kB	66 kB	34.120.237.76
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-31T18:13:52Z	606 B	238 B	34.117.65.55
149.28.109.35	unknown	2020-12-02T22:54:08Z	2023-02-28T13:34:57Z	4.9 kB	5.6 MB	149.28.109.35
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-31T18:12:04Z	2.4 kB	6.2 kB	95.101.11.115
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-31T18:12:09Z	333 B	391 B	34.117.237.239
cdnjs.cloudflare.com	235	2015-04-17T22:46:33Z	2023-03-31T18:42:09Z	412 B	16 kB	104.17.24.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-03-31	medium	149.28.109.35/8UsA.sh	Malware
2023-03-31	medium	149.28.109.35/static/js/main.fda4b6be.js	Malware
2023-03-31	medium	149.28.109.35/static/media/sansation.9be04a011dc2beea9985.ttf	Malware
2023-03-31	medium	149.28.109.35/static/js/120.4d24b999.chunk.js	Malware
2023-03-31	medium	149.28.109.35/static/js/58.836527c2.chunk.js	Malware
2023-03-31	medium	149.28.109.35/static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg	Malware
2023-03-31	medium	149.28.109.35/static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed
2023-03-31	medium	149.28.109.35	Sinkholed

ThreatFox

No alerts detected

JavaScript (17)

	URL	Size	First Seen	Last Seen
	149.28.109.35/static/js/main.fda4b6be.js	2.4 MB	2023-04-01	2023-04-01
Pretty URL 149.28.109.35/static/js/main.fda4b6be.js IP 149.28.109.35 ASN #20473 AS-CHOOPA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-01 10:53:00 Last Seen2023-04-01 10:53:00 Times Seen1 Hash fb256fbbbe823ff919bada1832053005 3b42d2be9daef27687b47b28c31439a0781dbbe6 9f012dd8fbcd0dad5b8366926d2aac376a1c696fd37721a881846c88b69bd43f Loading...

	149.28.109.35/static/js/120.4d24b999.chunk.js	7.1 kB	2023-03-26	2023-04-05
Pretty URL 149.28.109.35/static/js/120.4d24b999.chunk.js IP 149.28.109.35 ASN #20473 AS-CHOOPA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 06:40:15 Last Seen2023-04-05 01:50:18 Times Seen18 Hash 493221350a56887ebabb6e16303aa045 afda99dc33a493c1785727fbfa7e1674ab0394d9 dd9cab4618e13ee142903e4794d467a7de3b1422b4662d0c3aa79846a912504b Loading...

	149.28.109.35/static/js/58.836527c2.chunk.js	102 kB	2023-03-26	2023-09-01
Pretty URL 149.28.109.35/static/js/58.836527c2.chunk.js IP 149.28.109.35 ASN #20473 AS-CHOOPA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 06:40:15 Last Seen2023-09-01 09:16:48 Times Seen20 Hash c4a0526c0671f69a60abc1aa781552f6 eed184bb5d19539f4bf4706c3b449622eaf5cf80 d43e9110f29d438ac54c99a8d9eeb85f4dfb47b5c2f679393ab6ea15ae2953d5 Loading...

		Size	First Seen	Last Seen
	#1 Eval - 800dbec788a9ec22bf54c350e340c61c	130 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 800dbec788a9ec22bf54c350e340c61c ba001db9de649bbcea0f463f4b9209e5327e821c 467b672e66454c23e5a6cc5663d6d37ad947d85a347b036220e08da888b58d0c Loading...

	#2 Eval - 572d461684f57bfc60d4908a6bb9749f	136 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 572d461684f57bfc60d4908a6bb9749f 5353084d7282169cc7e59084f9bdabaf5d7bbd05 5fde45a9b9ebc1e0564fca15a7af3d8792ec009e4f7402446230456553e58afe Loading...

	#3 Eval - 35b97a8b604597d3477824bb9152ee1d	76 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 35b97a8b604597d3477824bb9152ee1d b541e417068f5c3e3ff724497b5aba4b5c380015 80ba1fe0899b97e3685e8506435b653b425b6a66302057f579ea84f4ebc185bc Loading...

	#4 Eval - 58fe7cbe23fcb757bee684fd64bad13f	126 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 58fe7cbe23fcb757bee684fd64bad13f d688086300cb29d4d179ae2fa8dd39bd0df1b006 c6581e7ea2b6e64cc801d4858be620eb9da4b8161405b886f89c38e3ddd6b7ad Loading...

	#5 Eval - 5c899d49b7397e0786d5b35c9981ea38	74 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 5c899d49b7397e0786d5b35c9981ea38 42f1ee352e265690fd135c6727156a3a840cdf2f 64253f5322fc67e7b9cfa3ba776c65d1584262f1e7d3e3d8f23d0cd038446535 Loading...

	#6 Eval - 9ea397de3f9d4fab60760dbb75fbea58	125 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 9ea397de3f9d4fab60760dbb75fbea58 c5cc09afd41feaa853b34108e6db59feecf4e6a1 9fc1fb31ab819abfb98e7f78917fb871fc35af2a37a4331394def172a6bfad37 Loading...

	#7 Eval - d20bc6266f3bd00e3e706e1ac7c30eeb	81 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash d20bc6266f3bd00e3e706e1ac7c30eeb 28606f75a453e9ead9264fc923c5bbd6bff5a312 c750f99a5422c3dc1248d9fbdc03e75ea7b2fee462630b1239ffb1dec7e44fb2 Loading...

	#8 Eval - d62e3b81a5a50fb5ec9e37fd29959ac9	69 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash d62e3b81a5a50fb5ec9e37fd29959ac9 1fcabf1f2a010016b7328e0ebde14988ebf15a34 dc580038a80a4f22aef3a0c173fed02a81d0b41ed7b3452fd0207a6f9b3f408d Loading...

	#9 Eval - fe44c934b43b6e7137dba777acfe9449	97 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash fe44c934b43b6e7137dba777acfe9449 5af967c1ee553e6ba36f6b087daebaf33b99b635 bcb3b4e0624fbde04fbdd6bbc03232893a885360fb5d3c5d1700ff8d54063f5e Loading...

	#10 Eval - cfc16650b2e111a8d5a782d49227a133	95 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash cfc16650b2e111a8d5a782d49227a133 b927047b2ef23aaff3244e41612003a89820a728 27764634ee8ffcf2a0494364f6b5e9f5b2db1e4d887f25cfca168618456ecf65 Loading...

	#11 Eval - 89fdf3447e5979f576d178d3be6fb7bb	205 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen133 Hash 89fdf3447e5979f576d178d3be6fb7bb 1ab7cd4f5d5a78037f0b14d4df42f505b5cc1665 b90fe63ce7febac63a2908b21690b48a9ab917dc7bc7954fa48ac33b2a4c8785 Loading...

	#12 Eval - ddaff3773b8bb0f79bbc1aae92e036dc	190 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash ddaff3773b8bb0f79bbc1aae92e036dc c4cd5fbacfa3f47c5e6461f1a80b951ee789b90b b23253118262433585b5d230c9ff805c256ed8b09b10690034acee405464e539 Loading...

	#13 Eval - 9eed7053d9235919d1c0fe7184969523	100 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 9eed7053d9235919d1c0fe7184969523 73546d49161257e0d9729b16b5c0bfed35a8357e ff0c130d363d331d18f684c5596b2c2241077fab8deb41a429e00188d75f94be Loading...

	#14 Eval - 91e368393951f9175362b3829cf4e7b8	130 B	2023-03-07	2024-04-22
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-22 01:23:19 Times Seen134 Hash 91e368393951f9175362b3829cf4e7b8 0c98a7dd95f1688c31cd82520e81a17de2921301 60bb1d5eef678820c6bf92239516216af21268fac1c8b1e74ec1d9b94f428f1f Loading...

HTTP Transactions (37)

URL IP Response Size

149.28.109.35/8UsA.sh

149.28.109.35

200 OK

629 B

URL HTTP/1.1
149.28.109.35/8UsA.sh
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1079), with no line terminators
Size
629 B (629 bytes)
Hash
8188677948faf26ef8d714100cd3c92a
a023bc18d295c16a9906c322e3466dcfaa0bef01
f73e250a5d0f2a6a9eaa46c358b9141c4aee4c36f81377dd959faea33d59d9ee

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /8UsA.sh HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:46 GMT
Content-Type: text/html
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"64249203-437"
Content-Encoding: gzip

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
b93010cbf31ba3ec785b4088e5d0f529
c0f1ab8a2aae3c445a8f24959a4eea433a345caf
2cc1a5865dee7636b82a68deddd3aff8b697e846e37789a694cc3c7c47340590

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2CC1A5865DEE7636B82A68DEDDD3AFF8B697E846E37789A694CC3C7C47340590"
Last-Modified: Wed, 29 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14682
Expires: Fri, 31 Mar 2023 12:49:28 GMT
Date: Fri, 31 Mar 2023 08:44:46 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7af19a5145a4ee99bdf18831bad04bfd
7bdd2a4785b999ef54a2644211d2b2b7190fb8e1
3237bf0111ecdec3615c4d2d49a602f48f800335d0194f52b600bdaefbd63ed0

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "3237BF0111ECDEC3615C4D2D49A602F48F800335D0194F52B600BDAEFBD63ED0"
Last-Modified: Thu, 30 Mar 2023 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6026
Expires: Fri, 31 Mar 2023 10:25:12 GMT
Date: Fri, 31 Mar 2023 08:44:46 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
76218c893040d958ae1c4231cdd2133c
6a7b336dee91d4aec26ace0a5883ecdfac52e68f
d35492b04d16ed00e9e195e7c84c99aa6a2b8a93abeb656baae0918986f0a7e4

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D35492B04D16ED00E9E195E7C84C99AA6A2B8A93ABEB656BAAE0918986F0A7E4"
Last-Modified: Wed, 29 Mar 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6476
Expires: Fri, 31 Mar 2023 10:32:42 GMT
Date: Fri, 31 Mar 2023 08:44:46 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
7f03faaba3392caae6dae54467bfdf6d
57ea1f14e8bfbcca8190c706d708c9fda12442c1
02ac551ba61fcbc6b04f244df065948b181a8a258db5c2e197aae66fdfcea8ee

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Type, Content-Length, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 31 Mar 2023 08:16:10 GMT
content-type: application/json
age: 1716
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: Pu5LkbEJVLW4tPQUr+VdFnPBYhRcPKrLJfxZll8nzHpd1NDBFaxWLbZrRppUKeRosCNMZ8020TM=
x-amz-request-id: RMW4M25ZXTJF0XWT
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 31 Mar 2023 08:34:01 GMT
age: 645
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 31 Mar 2023 08:44:46 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css

104.17.24.14

200 OK

15 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
IP
104.17.24.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65311)
Size
15 kB (14850 bytes)
Hash
1201d85f25136b687e48b5c47c69e1ab
a054a126169ae99d19e2449de4b5cb8f3f439730
715dd041182920f894f96779030573777c231ec1c97215f6d6d51a3f8cf8cec2

HTTP Headers

GET /ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://149.28.109.35
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Fri, 31 Mar 2023 08:44:46 GMT
content-type: text/css; charset=utf-8
content-length: 14850
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "619c057b-3a02"
last-modified: Mon, 22 Nov 2021 21:02:51 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 652333
expires: Wed, 20 Mar 2024 08:44:46 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7JbMZy5YshnzPqujOCsXr8oCExoza1E5KTUwEp%2FtoulOq6NqcCzRAKSFFln5%2BIXrndoc6mBpR1OHlXYCXrwy%2BqCil%2FfiHthuz%2Bzq29vffXZDsfS8tWRmCjdh%2Bu3VzyTQ0pq%2Bni4z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7b074ff969a91c0a-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
7117d0725779b203269d6c54c3ccedcf
24f4e806fd15c39484288a88c67117c918ce0829
ecfdfee4723c973d404d5e580a8cead357de755354328bfa40c1041350a76504

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 08:44:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
7117d0725779b203269d6c54c3ccedcf
24f4e806fd15c39484288a88c67117c918ce0829
ecfdfee4723c973d404d5e580a8cead357de755354328bfa40c1041350a76504

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 31 Mar 2023 08:44:47 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

149.28.109.35/static/css/main.dc45f2d9.css

149.28.109.35

200 OK

24 kB

URL HTTP/1.1
149.28.109.35/static/css/main.dc45f2d9.css
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (23727)
Size
24 kB (23772 bytes)
Hash
c6b5d1822d46c3689ba0879c1c04060a
5f184b73c869baf19baef8affc8f7fc5f3515a5f
60ea61164b4b95a2d669226ac627d22f2c457b05cd718ab5f59f78c6b2fe90e3

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/css/main.dc45f2d9.css HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:46 GMT
Content-Type: text/css
Content-Length: 23772
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-5cdc"
Accept-Ranges: bytes

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ab61862f016dea85f8aa55e59369d905
a5e81f13052b9e9184caf05a9740c345a40d1f22
e0d580c313088d524a5338e63e4acf9f3f3cb45a54f2528c5d1c4915d71b255b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E0D580C313088D524A5338E63E4ACF9F3F3CB45A54F2528C5D1C4915D71B255B"
Last-Modified: Thu, 30 Mar 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10096
Expires: Fri, 31 Mar 2023 11:33:03 GMT
Date: Fri, 31 Mar 2023 08:44:47 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Backoff, Last-Modified, Alert, Content-Length, Pragma, Cache-Control, Retry-After, ETag, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 31 Mar 2023 08:17:26 GMT
age: 1641
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

push.services.mozilla.com/

34.117.65.55

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.117.65.55:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Da2fj5I+RThg+GkjeLOeXg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: TCoo7D/AlQfFzIbeHbwYX+EAWqs=
Date: Fri, 31 Mar 2023 08:44:47 GMT
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

149.28.109.35/static/js/main.fda4b6be.js

149.28.109.35

200 OK

2.4 MB

URL HTTP/1.1
149.28.109.35/static/js/main.fda4b6be.js
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (65465)
Size
2.4 MB (2390791 bytes)
Hash
fb256fbbbe823ff919bada1832053005
3b42d2be9daef27687b47b28c31439a0781dbbe6
9f012dd8fbcd0dad5b8366926d2aac376a1c696fd37721a881846c88b69bd43f

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /static/js/main.fda4b6be.js HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:46 GMT
Content-Type: application/javascript
Content-Length: 2390791
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-247b07"
Accept-Ranges: bytes

149.28.109.35/img/neuron_icon.png

149.28.109.35

200 OK

1.3 kB

URL HTTP/1.1
149.28.109.35/img/neuron_icon.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 14 x 16, 8-bit colormap, non-interlaced\012- data
Size
1.3 kB (1295 bytes)
Hash
65702faebadab030826636560199e6e8
29c0eda0067792013ae087bc944ff2dd58ee828f
9831cc45adeaea00ad5085f49b913f8b779f16ba22d54e9f37e5ed36b24fdba2

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /img/neuron_icon.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/png
Content-Length: 1295
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-50f"
Accept-Ranges: bytes

149.28.109.35/logo192.png

149.28.109.35

200 OK

629 B

URL HTTP/1.1
149.28.109.35/logo192.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1079), with no line terminators
Size
629 B (629 bytes)
Hash
8188677948faf26ef8d714100cd3c92a
a023bc18d295c16a9906c322e3466dcfaa0bef01
f73e250a5d0f2a6a9eaa46c358b9141c4aee4c36f81377dd959faea33d59d9ee

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /logo192.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: text/html
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"64249203-437"
Content-Encoding: gzip

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14139
Expires: Fri, 31 Mar 2023 12:40:28 GMT
Date: Fri, 31 Mar 2023 08:44:49 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14139
Expires: Fri, 31 Mar 2023 12:40:28 GMT
Date: Fri, 31 Mar 2023 08:44:49 GMT
Connection: keep-alive

r3.o.lencr.org/

95.101.11.115

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
95.101.11.115:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
195589ff3c6c50463257f10da16de114
7119aeba010d5c5c224fa544feff6f1761739929
dbb5774621e0eee6f9641f6078a650a78d281019726ade7a52c150f0988cd12b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DBB5774621E0EEE6F9641F6078A650A78D281019726ADE7A52C150F0988CD12B"
Last-Modified: Wed, 29 Mar 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14139
Expires: Fri, 31 Mar 2023 12:40:28 GMT
Date: Fri, 31 Mar 2023 08:44:49 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29b45e61-5c2e-4b1b-929e-70c72bde0787.jpeg

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29b45e61-5c2e-4b1b-929e-70c72bde0787.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (11114 bytes)
Hash
211d737362f7cbcd8c77cee7d29fa2f5
668d1d80c88082928c6ca01fbf1ccbfcd079f64f
05672d4ab964a706c41d73b51592ca2425983e77544f08198dd2d3a7dcc5b3a1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F29b45e61-5c2e-4b1b-929e-70c72bde0787.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11114
x-amzn-requestid: e9e6a6b5-e6e8-4ca4-9302-a1fc023a38af
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CkypoH5goAMF6Hw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6424fe3d-63c6c8465407f5dc26e9aced;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 03:13:01 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: br3zxfuvcl_y9fkridQmtf6qWp6sd9N6bcmJuFcNcozeTRqPGOgtFQ==
via: 1.1 8ead054384c1626556ee4410cad35692.cloudfront.net (CloudFront), 1.1 aa623e134417515bd2496cb01d5e5626.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:26:10 GMT
age: 40719
etag: "668d1d80c88082928c6ca01fbf1ccbfcd079f64f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

14 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F067b6c49-6e52-4dcc-af72-f7292299f912.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
14 kB (13775 bytes)
Hash
876e5464aba1639f3b07b07d1d694514
93885a6205be71d16187782b1803f53d5c8538cb
6e2b6b15f462922a9e8260f55cfcd94d488d1a48435458db43270ea3b825d8c4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F067b6c49-6e52-4dcc-af72-f7292299f912.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 13775
x-amzn-requestid: 43d1a1f3-b189-4fcd-a298-429123d1921b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUloF9woAMFU4w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260156-13778451622503253ea252eb;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:30 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: bXA995GxGti4_AzSi9F19ZNvUwm5_ZSBw0BB0lRIfNHcmX7Ajt6bSg==
via: 1.1 8731d2a1a7d15f67b588bf58f652f9f0.cloudfront.net (CloudFront), 1.1 331202b5b8aab67acbf389883133f256.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:46:36 GMT
age: 39493
etag: "93885a6205be71d16187782b1803f53d5c8538cb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5ac5665-fe23-4026-a00b-567f98678f9e.webp
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10706 bytes)
Hash
e55c2ccec92fa37b631f5616ba5e1b77
c3f1113bad672968f22e63693ef4481f7f5616fe
10bfe1a2cf0b6e0a2a548935a1afc061fc61990a121a84580f3969df68b7974c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5ac5665-fe23-4026-a00b-567f98678f9e.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10706
x-amzn-requestid: 2e382033-306f-40ed-b259-76790e5e3ac9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUlmGujoAMFamQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260156-3856db4579fce52a18219166;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:30 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: pcFiVnrSVAh6gQ3VuQDE32650Yoj5bcTJrishSOFVpR3DHh4lUvdag==
via: 1.1 8ead054384c1626556ee4410cad35692.cloudfront.net (CloudFront), 1.1 4d8620b80ebe37d366388e117039aa8e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 22:05:16 GMT
age: 38373
etag: "c3f1113bad672968f22e63693ef4481f7f5616fe"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccede828-1c24-4287-bb00-f793263370cf.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.4 kB (6380 bytes)
Hash
8a2b8f737604b7983cf686c82599dc73
aa63be93c4cd641f09ce0d5144ef60aab21caed1
78835586bfd170fee7e6f70b2b426ed186f5aeae969459c6dcbf527ba9c0deec

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fccede828-1c24-4287-bb00-f793263370cf.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6380
x-amzn-requestid: 0a129a69-0720-47a0-8b0e-b3200de24204
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUn6E19IAMF9SQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260165-564474a42e79d1dc4eb9558f;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:45 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 3paQf8BhyRcZoZNox8660Zyzz0WaiQxJuHmDbj4wpo-rgbDdkxrYgQ==
via: 1.1 b5695e36d7fbc522ece27885d73757ae.cloudfront.net (CloudFront), 1.1 b48dedcc55e63f14261aa92cf2d61522.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:47:23 GMT
age: 39446
etag: "aa63be93c4cd641f09ce0d5144ef60aab21caed1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2d531a5-067e-452b-8349-d9f2a461ba4a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9055 bytes)
Hash
1688ae550e5e9181de2448a9cade8a26
a46eb0cd75f46778dc802b648f7c391ce801c700
e717e6e64c928571506bc6d19e3d9ce19bea3292f01618a6d9ddbbaffe65ffd1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe2d531a5-067e-452b-8349-d9f2a461ba4a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9055
x-amzn-requestid: 1fad6d1e-3380-4574-9796-ca6bde35b507
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CnUneEK8IAMF1EQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64260162-690f6e9933616e9b74b70435;Sampled=0;lineage=69363f46:0
x-amzn-remapped-date: Thu, 30 Mar 2023 21:38:42 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 5qljjE3ByqQaRJhcpkBZFcYVH4lCoP2idQM0iPBAT7znLfoZmO0lUg==
via: 1.1 ee6ea1e4552345de209d26f9ffb35d4a.cloudfront.net (CloudFront), 1.1 b23fb37cd7fff033ab21e3284f558a28.cloudfront.net (CloudFront), 1.1 google
date: Thu, 30 Mar 2023 21:52:53 GMT
age: 39116
etag: "a46eb0cd75f46778dc802b648f7c391ce801c700"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0794d5a0-7014-425b-9ea0-5dca44ddb4dd.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.7 kB (8745 bytes)
Hash
ef54a1ed997cc09495edb102ccdf6803
f5637efb37b5eecff77e60e6bcf5f599991f334f
fa76d7a82dc15baf02b207cea874d1332c20a0ebe1eea99929a6f2746608412c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0794d5a0-7014-425b-9ea0-5dca44ddb4dd.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8745
x-amzn-requestid: e1d8dab6-4c15-4752-b528-21854c93a11c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CguJ5Hy5oAMFyAg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64235d72-4bd62c8472f7257a155b2a80;Sampled=0
x-amzn-remapped-date: Tue, 28 Mar 2023 21:34:42 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: YJQbVC3HpHtLrNiTzsUmCOMIWgRik2lIhvpAz0DfmUNSznCXw6ipYw==
via: 1.1 8f251d23da31b683c3c9d6fad6ca944c.cloudfront.net (CloudFront), 1.1 60b744e5b364d04abea9fa6686121242.cloudfront.net (CloudFront), 1.1 google
date: Fri, 31 Mar 2023 06:47:32 GMT
age: 7037
etag: "f5637efb37b5eecff77e60e6bcf5f599991f334f"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

149.28.109.35/static/media/sansation.9be04a011dc2beea9985.ttf

149.28.109.35

200 OK

78 kB

URL HTTP/1.1
149.28.109.35/static/media/sansation.9be04a011dc2beea9985.ttf
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
TrueType Font data, 16 tables, 1st "GDEF", 16 names, Macintosh\012- data
Size
78 kB (78464 bytes)
Hash
14df84ca92de1925877ef2ea23edf8b0
cce586ccae3991a117fb36f80e4f71cc321fd670
c0770982633d933a09da349cf0dde6cfd70d6f9d91f1df436410c4d014a3216d

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /static/media/sansation.9be04a011dc2beea9985.ttf HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/static/css/main.dc45f2d9.css

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: application/octet-stream
Content-Length: 78464
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-13280"
Accept-Ranges: bytes

149.28.109.35/static/js/120.4d24b999.chunk.js

149.28.109.35

200 OK

7.1 kB

URL HTTP/1.1
149.28.109.35/static/js/120.4d24b999.chunk.js
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (7029)
Size
7.1 kB (7076 bytes)
Hash
493221350a56887ebabb6e16303aa045
afda99dc33a493c1785727fbfa7e1674ab0394d9
dd9cab4618e13ee142903e4794d467a7de3b1422b4662d0c3aa79846a912504b

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /static/js/120.4d24b999.chunk.js HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: application/javascript
Content-Length: 7076
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-1ba4"
Accept-Ranges: bytes

149.28.109.35/static/js/58.836527c2.chunk.js

149.28.109.35

200 OK

102 kB

URL HTTP/1.1
149.28.109.35/static/js/58.836527c2.chunk.js
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (65536), with no line terminators
Size
102 kB (101765 bytes)
Hash
c4a0526c0671f69a60abc1aa781552f6
eed184bb5d19539f4bf4706c3b449622eaf5cf80
d43e9110f29d438ac54c99a8d9eeb85f4dfb47b5c2f679393ab6ea15ae2953d5

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /static/js/58.836527c2.chunk.js HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: application/javascript
Content-Length: 101765
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-18d85"
Accept-Ranges: bytes

149.28.109.35/static/media/brazil.5fd45b4f086915f0da20.png

149.28.109.35

200 OK

761 kB

URL HTTP/1.1
149.28.109.35/static/media/brazil.5fd45b4f086915f0da20.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 3536 x 2475, 8-bit/color RGBA, non-interlaced\012- data
Size
761 kB (761444 bytes)
Hash
ea30c37bbaec88009e6e93feece9edf0
d98005f278895bc5542b56aedbde87d05c61087e
080e7d7d3630399818289882c39a4bbe7e39515c50f5ca05966abe088287b034

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/brazil.5fd45b4f086915f0da20.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/png
Content-Length: 761444
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-b9e64"
Accept-Ranges: bytes

149.28.109.35/static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg

149.28.109.35

200 OK

1.9 kB

URL HTTP/1.1
149.28.109.35/static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1671)
Size
1.9 kB (1919 bytes)
Hash
f998dad25eb38e300a9ff0afa6f5daff
27b38d61af8ee5648dd68f9f0c07b3dcceb448dd
fc6f0b149b98ddfd7ee21daaae65cfd1a8841555bf74b604abb365ae5908ecea

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/svg+xml
Content-Length: 1919
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-77f"
Accept-Ranges: bytes

149.28.109.35/static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg

149.28.109.35

200 OK

513 B

URL HTTP/1.1
149.28.109.35/static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (409)
Size
513 B (513 bytes)
Hash
d9de3293a55aa81e69f644f5ab99e01c
ffdfc391dbfc1675a92eafc240828b47a7f58da2
1de61ca04bf64fc8908ea8659c53d6abedc7e2ebba60ec3dc4d0a5b26370fcea

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

HTTP Headers

GET /static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/svg+xml
Content-Length: 513
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-201"
Accept-Ranges: bytes

149.28.109.35/static/media/Logo.6f2535092e89593864e2.png

149.28.109.35

200 OK

142 kB

URL HTTP/1.1
149.28.109.35/static/media/Logo.6f2535092e89593864e2.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 1900 x 735, 8-bit/color RGBA, non-interlaced\012- data
Size
142 kB (142241 bytes)
Hash
41efe7c1fbd720e5cbb077d11812b596
d12e2cd7760ee702a31f80e09d0a7060acadfe5a
f79f286149898c62fed28d39e9679e0c6a62237e45b57d4ec973e93240136d56

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/Logo.6f2535092e89593864e2.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/png
Content-Length: 142241
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-22ba1"
Accept-Ranges: bytes

149.28.109.35/static/media/new_bg_login.e58e195037d050e22075.png

149.28.109.35

200 OK

35 kB

URL HTTP/1.1
149.28.109.35/static/media/new_bg_login.e58e195037d050e22075.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 988 x 639, 8-bit/color RGBA, non-interlaced\012- data
Size
35 kB (35283 bytes)
Hash
04bfe8082f0a1b8dfa38a5c7c5351fe3
9cdbe7e05c39b18c2b60a7b09e1961e310ae2722
10c00a7b84cadd243de4a3ced0bc618b4f3e4934c484fafa17064e14bca15046

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/new_bg_login.e58e195037d050e22075.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/png
Content-Length: 35283
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-89d3"
Accept-Ranges: bytes

149.28.109.35/static/media/eua.bd4257f1510ff0c52b44.png

149.28.109.35

200 OK

669 kB

URL HTTP/1.1
149.28.109.35/static/media/eua.bd4257f1510ff0c52b44.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 3536 x 2475, 8-bit/color RGBA, non-interlaced\012- data
Size
669 kB (668701 bytes)
Hash
9471d8dfea7261f5511c605b60135037
15dc1c25b2e405dbaae99b73210a83aab262cb66
fbae12200b06073f2c6e87ea71a6b6e72c1e7053e59f15fa60b1cdc1ab5365e8

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/eua.bd4257f1510ff0c52b44.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/png
Content-Length: 668701
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-a341d"
Accept-Ranges: bytes

149.28.109.35/static/media/espanha.92225a9cfd7d0aed87e6.png

149.28.109.35

200 OK

1.4 MB

URL HTTP/1.1
149.28.109.35/static/media/espanha.92225a9cfd7d0aed87e6.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 3536 x 2475, 8-bit/color RGBA, non-interlaced\012- data
Size
1.4 MB (1424628 bytes)
Hash
1818f399424be30348c3e97071a8ad22
abf66be82ef664c8a5e71f3d262329cfbcd0e92b
164bf67606b82379a567a268d7b65485468f54abe1c1aa21c6781ebe144e27af

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/espanha.92225a9cfd7d0aed87e6.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 31 Mar 2023 08:44:49 GMT
Content-Type: image/png
Content-Length: 1424628
Last-Modified: Wed, 29 Mar 2023 19:31:15 GMT
Connection: keep-alive
ETag: "64249203-15bcf4"
Accept-Ranges: bytes

fonts.googleapis.com/css2?family=Ubuntu:wght@300;400;700&display=swap

142.250.74.74

200 OK

0 B

URL HTTP/2
fonts.googleapis.com/css2?family=Ubuntu:wght@300;400;700&display=swap
IP
142.250.74.74:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /css2?family=Ubuntu:wght@300;400;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://149.28.109.35/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 31 Mar 2023 08:44:47 GMT
date: Fri, 31 Mar 2023 08:44:47 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (17)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (37)

URL HTTP/1.1

IP

ASN

File type