Report - 149.28.109.35/8UsA.sh

Report Overview

Submitted URL
149.28.109.35/8UsA.sh
IP
149.28.109.35
ASN
#20473 AS-CHOOPA
Submitted
2023-03-23 08:53:32
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
30

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-29T05:09:03Z	337 B	1.4 kB	35.241.9.150
149.28.109.35	unknown	2020-12-02T22:54:08Z	2023-02-28T13:34:57Z	4.9 kB	5.3 MB	149.28.109.35
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-29T05:09:31Z	413 B	5.9 kB	34.160.144.191
cdnjs.cloudflare.com	235	2015-04-17T22:46:33Z	2023-03-29T05:16:53Z	412 B	16 kB	104.17.25.14
ocsp.pki.goog	175	2018-07-01T08:43:07Z	2023-03-29T05:09:04Z	686 B	1.4 kB	142.250.74.163
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-29T05:09:32Z	606 B	127 B	54.149.149.164
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-29T05:09:11Z	3.0 kB	8.0 kB	23.36.76.226
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-29T05:09:31Z	333 B	391 B	34.117.237.239
fonts.googleapis.com	8877	2013-06-10T22:14:26Z	2023-03-29T10:13:53Z	415 B	1.5 kB	172.217.21.170
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-29T05:09:12Z	3.2 kB	49 kB	34.120.237.76

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed
2023-03-23	medium	149.28.109.35	Sinkholed

ThreatFox

No alerts detected

JavaScript (17)

	URL	Size	First Seen	Last Seen
	149.28.109.35/static/js/main.b83caab5.js	2.1 MB	2023-03-26	2023-03-29
Pretty URL 149.28.109.35/static/js/main.b83caab5.js IP 149.28.109.35 ASN #20473 AS-CHOOPA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 14:44:54 Last Seen2023-03-29 23:46:07 Times Seen6 Hash 9c1081bb0d61be1255afd40e3c707aef e42d3f192d1b547b0ac33ea83e39f1dc550f090e a89a262baed6f94fcfe10eeaaa5bc243567ab2dc688d2472e1762be391d4e854 Loading...

	149.28.109.35/static/js/120.4d24b999.chunk.js	7.1 kB	2023-03-26	2023-04-05
Pretty URL 149.28.109.35/static/js/120.4d24b999.chunk.js IP 149.28.109.35 ASN #20473 AS-CHOOPA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 06:40:15 Last Seen2023-04-05 01:50:18 Times Seen18 Hash 493221350a56887ebabb6e16303aa045 afda99dc33a493c1785727fbfa7e1674ab0394d9 dd9cab4618e13ee142903e4794d467a7de3b1422b4662d0c3aa79846a912504b Loading...

	149.28.109.35/static/js/58.836527c2.chunk.js	102 kB	2023-03-26	2023-09-01
Pretty URL 149.28.109.35/static/js/58.836527c2.chunk.js IP 149.28.109.35 ASN #20473 AS-CHOOPA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 06:40:15 Last Seen2023-09-01 09:16:48 Times Seen20 Hash c4a0526c0671f69a60abc1aa781552f6 eed184bb5d19539f4bf4706c3b449622eaf5cf80 d43e9110f29d438ac54c99a8d9eeb85f4dfb47b5c2f679393ab6ea15ae2953d5 Loading...

		Size	First Seen	Last Seen
	#1 Eval - 800dbec788a9ec22bf54c350e340c61c	130 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 800dbec788a9ec22bf54c350e340c61c ba001db9de649bbcea0f463f4b9209e5327e821c 467b672e66454c23e5a6cc5663d6d37ad947d85a347b036220e08da888b58d0c Loading...

	#2 Eval - 9eed7053d9235919d1c0fe7184969523	100 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 9eed7053d9235919d1c0fe7184969523 73546d49161257e0d9729b16b5c0bfed35a8357e ff0c130d363d331d18f684c5596b2c2241077fab8deb41a429e00188d75f94be Loading...

	#3 Eval - 91e368393951f9175362b3829cf4e7b8	130 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 91e368393951f9175362b3829cf4e7b8 0c98a7dd95f1688c31cd82520e81a17de2921301 60bb1d5eef678820c6bf92239516216af21268fac1c8b1e74ec1d9b94f428f1f Loading...

	#4 Eval - 35b97a8b604597d3477824bb9152ee1d	76 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 35b97a8b604597d3477824bb9152ee1d b541e417068f5c3e3ff724497b5aba4b5c380015 80ba1fe0899b97e3685e8506435b653b425b6a66302057f579ea84f4ebc185bc Loading...

	#5 Eval - d20bc6266f3bd00e3e706e1ac7c30eeb	81 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:12 Times Seen133 Hash d20bc6266f3bd00e3e706e1ac7c30eeb 28606f75a453e9ead9264fc923c5bbd6bff5a312 c750f99a5422c3dc1248d9fbdc03e75ea7b2fee462630b1239ffb1dec7e44fb2 Loading...

	#6 Eval - ddaff3773b8bb0f79bbc1aae92e036dc	190 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash ddaff3773b8bb0f79bbc1aae92e036dc c4cd5fbacfa3f47c5e6461f1a80b951ee789b90b b23253118262433585b5d230c9ff805c256ed8b09b10690034acee405464e539 Loading...

	#7 Eval - 58fe7cbe23fcb757bee684fd64bad13f	126 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 58fe7cbe23fcb757bee684fd64bad13f d688086300cb29d4d179ae2fa8dd39bd0df1b006 c6581e7ea2b6e64cc801d4858be620eb9da4b8161405b886f89c38e3ddd6b7ad Loading...

	#8 Eval - cfc16650b2e111a8d5a782d49227a133	95 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:12 Times Seen133 Hash cfc16650b2e111a8d5a782d49227a133 b927047b2ef23aaff3244e41612003a89820a728 27764634ee8ffcf2a0494364f6b5e9f5b2db1e4d887f25cfca168618456ecf65 Loading...

	#9 Eval - 89fdf3447e5979f576d178d3be6fb7bb	205 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen132 Hash 89fdf3447e5979f576d178d3be6fb7bb 1ab7cd4f5d5a78037f0b14d4df42f505b5cc1665 b90fe63ce7febac63a2908b21690b48a9ab917dc7bc7954fa48ac33b2a4c8785 Loading...

	#10 Eval - d62e3b81a5a50fb5ec9e37fd29959ac9	69 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:14 Times Seen133 Hash d62e3b81a5a50fb5ec9e37fd29959ac9 1fcabf1f2a010016b7328e0ebde14988ebf15a34 dc580038a80a4f22aef3a0c173fed02a81d0b41ed7b3452fd0207a6f9b3f408d Loading...

	#11 Eval - fe44c934b43b6e7137dba777acfe9449	97 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash fe44c934b43b6e7137dba777acfe9449 5af967c1ee553e6ba36f6b087daebaf33b99b635 bcb3b4e0624fbde04fbdd6bbc03232893a885360fb5d3c5d1700ff8d54063f5e Loading...

	#12 Eval - 5c899d49b7397e0786d5b35c9981ea38	74 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 5c899d49b7397e0786d5b35c9981ea38 42f1ee352e265690fd135c6727156a3a840cdf2f 64253f5322fc67e7b9cfa3ba776c65d1584262f1e7d3e3d8f23d0cd038446535 Loading...

	#13 Eval - 572d461684f57bfc60d4908a6bb9749f	136 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 572d461684f57bfc60d4908a6bb9749f 5353084d7282169cc7e59084f9bdabaf5d7bbd05 5fde45a9b9ebc1e0564fca15a7af3d8792ec009e4f7402446230456553e58afe Loading...

	#14 Eval - 9ea397de3f9d4fab60760dbb75fbea58	125 B	2023-03-07	2024-04-10
Pretty Observations First Seen2023-03-07 12:07:50 Last Seen2024-04-10 09:38:13 Times Seen133 Hash 9ea397de3f9d4fab60760dbb75fbea58 c5cc09afd41feaa853b34108e6db59feecf4e6a1 9fc1fb31ab819abfb98e7f78917fb871fc35af2a37a4331394def172a6bfad37 Loading...

HTTP Transactions (38)

URL IP Response Size

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
bea3185dd820a31c1981317f37c3456d
1a548a5d27270fc11df9011837a7149571cedd78
469b97bf9f57401b3c9571039483589f2815f4794212b75c7c85cfefe0ae71e9

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "469B97BF9F57401B3C9571039483589F2815F4794212B75C7C85CFEFE0AE71E9"
Last-Modified: Wed, 22 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3287
Expires: Thu, 23 Mar 2023 09:48:07 GMT
Date: Thu, 23 Mar 2023 08:53:20 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
65fc860bc043f3fb83bdc3debdcd322d
418010755deae099ef1284e402813c5837a10f42
d93d50c523c7f735987aba09db628259441eb75efe713a2df3c214e1fb8b5171

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D93D50C523C7F735987ABA09DB628259441EB75EFE713A2DF3C214E1FB8B5171"
Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11514
Expires: Thu, 23 Mar 2023 12:05:14 GMT
Date: Thu, 23 Mar 2023 08:53:20 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
bc86ef2a0cee04915bc360f5821adc8f
3658f9028cce204d38f7f48fcfaa2a8e4f54383a
aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 23 Mar 2023 08:27:31 GMT
content-type: application/json
age: 1549
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
51a5d4696a6090c295850554508b51ce
c44e143c2223546e64b19f543b8101aaf3b11e97
8794223d5e8d4d276c35e2fdcc24bf99694240634dd749cd9b5bf874dec055cf

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8794223D5E8D4D276C35E2FDCC24BF99694240634DD749CD9B5BF874DEC055CF"
Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12287
Expires: Thu, 23 Mar 2023 12:18:07 GMT
Date: Thu, 23 Mar 2023 08:53:20 GMT
Connection: keep-alive

149.28.109.35/8UsA.sh

149.28.109.35

200 OK

630 B

URL HTTP/1.1
149.28.109.35/8UsA.sh
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1079), with no line terminators
Size
630 B (630 bytes)
Hash
a5df5a0d23912ac94e6dc7bceb58822b
d7e6cdd0e13f6cf32cf8b5ba1295c0e4cb51d5ec
f15b3261135df9da7690045a2e3225eb870a699e66a1d8b2651c429c5951dace

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /8UsA.sh HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:20 GMT
Content-Type: text/html
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"6419a56a-437"
Content-Encoding: gzip

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: m/xqHzZigC5b/Jj5IpZxLxcnKxmGWDgMhxKDTvMYG+i1J+X6ZI4tKRZOAlMvU1aHEiHUKmZbHuQ=
x-amz-request-id: 3JAN2XMPGR8S1G1Q
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 23 Mar 2023 07:53:58 GMT
age: 3562
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 23 Mar 2023 08:53:20 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css

104.17.25.14

200 OK

15 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
IP
104.17.25.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65311)
Size
15 kB (14850 bytes)
Hash
1201d85f25136b687e48b5c47c69e1ab
a054a126169ae99d19e2449de4b5cb8f3f439730
715dd041182920f894f96779030573777c231ec1c97215f6d6d51a3f8cf8cec2

HTTP Headers

GET /ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://149.28.109.35
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Thu, 23 Mar 2023 08:53:20 GMT
content-type: text/css; charset=utf-8
content-length: 14850
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "619c057b-3a02"
last-modified: Mon, 22 Nov 2021 21:02:51 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 549867
expires: Tue, 12 Mar 2024 08:53:20 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FZTStnNaTglgSUMt34Bkb7U9CO0Apid1A6zb8yjrJy5T%2BznzK4rKW4Owf25kn%2BXBZAbY6F%2F1n7zN0jBsi9T5Y5nYWMCffqRNGHUqoJjkbAAFmnRn6Msn9B0cN8gZ%2BR%2BLrbGBxp3q"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7ac5718599cafac0-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
342da587101df62e3e8f03dc4a87f93d
897c40f31b24adf281b804bbca7f0ffba5b86816
f6b8dde2c506c3ec03517324e93c04058e44e345dae5a52e5f49c97d77455aec

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 23 Mar 2023 08:53:20 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

149.28.109.35/static/css/main.ce589fb9.css

149.28.109.35

200 OK

1.6 kB

URL HTTP/1.1
149.28.109.35/static/css/main.ce589fb9.css
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (1508)
Size
1.6 kB (1553 bytes)
Hash
d90ef786160675fe5f2e4002870667a5
fc389c1e3b241b1a0fde1155cd914b37f766ad52
7e31ec88835bb290c4ab7012d0153b49ea13ee2e24bc3f3d34ac2a0d284af467

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/css/main.ce589fb9.css HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:20 GMT
Content-Type: text/css
Content-Length: 1553
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-611"
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.163

200 OK

471 B

URL HTTP/1.1
ocsp.pki.goog/gts1c3
IP
142.250.74.163:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
342da587101df62e3e8f03dc4a87f93d
897c40f31b24adf281b804bbca7f0ffba5b86816
f6b8dde2c506c3ec03517324e93c04058e44e345dae5a52e5f49c97d77455aec

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 23 Mar 2023 08:53:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.googleapis.com/css2?family=Ubuntu:wght@300;400;700&display=swap

172.217.21.170

200 OK

916 B

URL HTTP/2
fonts.googleapis.com/css2?family=Ubuntu:wght@300;400;700&display=swap
IP
172.217.21.170:0
ASN
#15169 GOOGLE

File type
data
Size
916 B (916 bytes)
Hash
4dc784d40b25a781ca5cac27cc6368f8
42ccd7d121c5c84e2c3ae47b3cfe97d70b8c404a
131fb58cea4ada37400b663ab6b024ba09425e0cd2ecbb433c29fa02ade56d03

HTTP Headers

GET /css2?family=Ubuntu:wght@300;400;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://149.28.109.35/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 23 Mar 2023 08:53:20 GMT
date: Thu, 23 Mar 2023 08:53:20 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
050ca4dc2182e0a27573b0d9f32b7834
bec14dc5af0d0b32210470673511acd8db404308
b6129b9d1848f75265dca4446c5399927bdaf15c7b49c083765847b0fe276eaf

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "B6129B9D1848F75265DCA4446C5399927BDAF15C7B49C083765847B0FE276EAF"
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5774
Expires: Thu, 23 Mar 2023 10:29:35 GMT
Date: Thu, 23 Mar 2023 08:53:21 GMT
Connection: keep-alive

push.services.mozilla.com/

54.149.149.164

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
54.149.149.164:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: x541Z+dPtoHc7NQXk6pfow==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: +QD9cSqHEZXUBGomRmfcfirYryY=

149.28.109.35/static/js/main.b83caab5.js

149.28.109.35

200 OK

2.1 MB

URL HTTP/1.1
149.28.109.35/static/js/main.b83caab5.js
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (65465)
Size
2.1 MB (2063439 bytes)
Hash
9c1081bb0d61be1255afd40e3c707aef
e42d3f192d1b547b0ac33ea83e39f1dc550f090e
a89a262baed6f94fcfe10eeaaa5bc243567ab2dc688d2472e1762be391d4e854

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/js/main.b83caab5.js HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:20 GMT
Content-Type: application/javascript
Content-Length: 2063439
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-1f7c4f"
Accept-Ranges: bytes

149.28.109.35/static/media/sansation.9be04a011dc2beea9985.ttf

149.28.109.35

200 OK

78 kB

URL HTTP/1.1
149.28.109.35/static/media/sansation.9be04a011dc2beea9985.ttf
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
TrueType Font data, 16 tables, 1st "GDEF", 16 names, Macintosh\012- data
Size
78 kB (78464 bytes)
Hash
14df84ca92de1925877ef2ea23edf8b0
cce586ccae3991a117fb36f80e4f71cc321fd670
c0770982633d933a09da349cf0dde6cfd70d6f9d91f1df436410c4d014a3216d

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/sansation.9be04a011dc2beea9985.ttf HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/static/css/main.ce589fb9.css

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:22 GMT
Content-Type: application/octet-stream
Content-Length: 78464
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-13280"
Accept-Ranges: bytes

149.28.109.35/static/js/120.4d24b999.chunk.js

149.28.109.35

200 OK

7.1 kB

URL HTTP/1.1
149.28.109.35/static/js/120.4d24b999.chunk.js
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (7029)
Size
7.1 kB (7076 bytes)
Hash
493221350a56887ebabb6e16303aa045
afda99dc33a493c1785727fbfa7e1674ab0394d9
dd9cab4618e13ee142903e4794d467a7de3b1422b4662d0c3aa79846a912504b

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/js/120.4d24b999.chunk.js HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:22 GMT
Content-Type: application/javascript
Content-Length: 7076
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-1ba4"
Accept-Ranges: bytes

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0d3d7099bbc5fed74a6e78e1a3096bf
96afaf8b3ac053577c56aca5f4a20d8655ecb771
c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8355
Expires: Thu, 23 Mar 2023 11:12:37 GMT
Date: Thu, 23 Mar 2023 08:53:22 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0d3d7099bbc5fed74a6e78e1a3096bf
96afaf8b3ac053577c56aca5f4a20d8655ecb771
c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8355
Expires: Thu, 23 Mar 2023 11:12:37 GMT
Date: Thu, 23 Mar 2023 08:53:22 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0d3d7099bbc5fed74a6e78e1a3096bf
96afaf8b3ac053577c56aca5f4a20d8655ecb771
c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8355
Expires: Thu, 23 Mar 2023 11:12:37 GMT
Date: Thu, 23 Mar 2023 08:53:22 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0d3d7099bbc5fed74a6e78e1a3096bf
96afaf8b3ac053577c56aca5f4a20d8655ecb771
c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8355
Expires: Thu, 23 Mar 2023 11:12:37 GMT
Date: Thu, 23 Mar 2023 08:53:22 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a0d3d7099bbc5fed74a6e78e1a3096bf
96afaf8b3ac053577c56aca5f4a20d8655ecb771
c8ff32c6809a506d4c656d3200dbfc6682c156c3de0647d13ab8f07a6f9a38ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8355
Expires: Thu, 23 Mar 2023 11:12:37 GMT
Date: Thu, 23 Mar 2023 08:53:22 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255e6a5a-97bb-4a35-8a48-4d120747a63c.jpeg

34.120.237.76

200 OK

4.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255e6a5a-97bb-4a35-8a48-4d120747a63c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.0 kB (4000 bytes)
Hash
85351059b67b0a42eda7e69a31b3b4b4
b798268806dc2f79f033e5872676019faf0e0cc1
86e163b7159b197d6358ab01333ac6da221de0ebe1c5da8d5cef2977d38625fe

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255e6a5a-97bb-4a35-8a48-4d120747a63c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4000
x-amzn-requestid: 68dc01d7-3eed-48f6-8532-8efaa96cc1ec
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CJpraEqyoAMFgNQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641a2315-3852cc8961365a560d1fa02f;Sampled=0
x-amzn-remapped-date: Tue, 21 Mar 2023 21:35:17 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: k6VaCG5oTQnKOvKJnleVqxIIc9yOgdOL0oPcL0ZSVw7DZQ8_GzFoZQ==
via: 1.1 288c777a01e22425da9494dad7a69734.cloudfront.net (CloudFront), 1.1 4d8620b80ebe37d366388e117039aa8e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:47:43 GMT
age: 39939
etag: "b798268806dc2f79f033e5872676019faf0e0cc1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32536e34-d62f-40f1-b196-c4bbe784cca6.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.4 kB (5356 bytes)
Hash
f148d2e3cd5679fe5cb9cd58630517c7
b312f7c6526254709a0f7424502952e9eaff9c78
6e98a90935a53caa8871238088e77269e5d7215d16dccabe7e9e4af09f39f7b0

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F32536e34-d62f-40f1-b196-c4bbe784cca6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5356
x-amzn-requestid: a49dca74-54fa-457c-a5b6-e347fd139d1d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM8ovEgAIAMFcnA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b749e-673461e13b7d2f4e7ad66e7f;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:35:26 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: ATbmD8auxaSsKlj6KDtI9biU-euAHDVEIVMiHR7hmroViIWghZUsKQ==
via: 1.1 88a7ff956a5b49ec3a35abfc0027af12.cloudfront.net (CloudFront), 1.1 7514e5e25722778fd4b1744d4ecc67e0.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:45 GMT
age: 40177
etag: "b312f7c6526254709a0f7424502952e9eaff9c78"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.7 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5be1b286-007a-44a5-a6fd-872190ecfa0b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.7 kB (6692 bytes)
Hash
c05bfdf1411a931d8ea9adc64b07bc74
156ef59e53564a4f2b27002b2695fafecd578d82
15d17c0df2d2b0625ecf5f576a7ff630ae8b923b28be354ad23aec6a284a801a

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5be1b286-007a-44a5-a6fd-872190ecfa0b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6692
x-amzn-requestid: 3a0f6a8d-89b1-43f4-8a15-8749bdbc047b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM9d9FcOoAMFaFQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b75f2-3540256d6be3d4f85bba65ea;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:41:06 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: Jj5lAwItWYm45j5kLqQnd3fhsiGsiuSiSVtrBUOolyHvPAmCc0S71A==
via: 1.1 e92cc925fc8895560cd0628c67f58828.cloudfront.net (CloudFront), 1.1 b23fb37cd7fff033ab21e3284f558a28.cloudfront.net (CloudFront), 1.1 google
date: Thu, 23 Mar 2023 07:54:24 GMT
age: 3538
etag: "156ef59e53564a4f2b27002b2695fafecd578d82"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffa9cba5-a508-44d3-b8ad-393590528e8b.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.6 kB (9550 bytes)
Hash
9a774aa1a206523471dfa75b624be2af
e41ca3e0550e74562b0374565225444ffb977c4e
208ea0f25d7bde64057701891811cdb8c0a67b6f60899ca514fbaf2e04d595bc

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffa9cba5-a508-44d3-b8ad-393590528e8b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9550
x-amzn-requestid: 0c3d2b49-9407-4d12-930a-83e585c165b8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CBF7kFvwIAMF43g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6416b6b0-59461f0119abb54f773150a0;Sampled=0
x-amzn-remapped-date: Sun, 19 Mar 2023 07:16:00 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: wVn33PkqDp-KFwzsDiNz8uSRuW2lwBLllYsQevboO6qidq1OkL-X5Q==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 0a2ce08fa1ec3c33302a7547d3305978.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 22:33:44 GMT
age: 37178
etag: "e41ca3e0550e74562b0374565225444ffb977c4e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcbdd70a4-b533-4e87-84d2-c2122ca1cdc5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.9 kB (5915 bytes)
Hash
31ad983ec21e3dee7b6083bc04742aee
a98933e2845c02158175a54d9648f12086a96569
8cb18730db03dd8727b2ff42ecfa7885b9e8dbe3c37c08b1ad0c67e629338b95

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcbdd70a4-b533-4e87-84d2-c2122ca1cdc5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5915
x-amzn-requestid: 1c6acb42-48cc-4113-a8d0-6a811cd16613
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B9xXaGUVoAMFwIw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64156295-0edcaad90df031882fa7457c;Sampled=0
x-amzn-remapped-date: Sat, 18 Mar 2023 07:04:53 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: 6f6NSPPmIBAP_pxmZuHRz6WJJjnp3NIO26SNyKYhq2FikQkP5hOe7w==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 599f04a365a179d553682d476509c388.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:58:52 GMT
age: 39270
etag: "a98933e2845c02158175a54d9648f12086a96569"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F26aea22c-e627-45d1-bce6-55eaa4acfd06.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
11 kB (10816 bytes)
Hash
f3aa18378fc5715083fb26bd0d62f382
ee683e481a4501d2ab8ca63d1426d6fab6f2b064
8aade71c4b55f6a9daab28a05a90bcc3c6c01b700aa48d2f8ccdb1992fa5ee81

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F26aea22c-e627-45d1-bce6-55eaa4acfd06.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10816
x-amzn-requestid: 60a537d2-1b8a-4ae2-967c-a7e57c818cc6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B9xY0EHqoAMFrrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6415629e-1be08f9f3a13492717fdaa48;Sampled=0
x-amzn-remapped-date: Sat, 18 Mar 2023 07:05:02 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: pFf9EtVQUyRcUOT6Aj_L88__ZyBlVX61cOmPi70WnyxxPteVUFFXEw==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 3f3347264bcaae7af741e2a2f692c6a0.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 20:21:35 GMT
age: 45107
etag: "ee683e481a4501d2ab8ca63d1426d6fab6f2b064"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

149.28.109.35/logo192.png

149.28.109.35

200 OK

630 B

URL HTTP/1.1
149.28.109.35/logo192.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1079), with no line terminators
Size
630 B (630 bytes)
Hash
a5df5a0d23912ac94e6dc7bceb58822b
d7e6cdd0e13f6cf32cf8b5ba1295c0e4cb51d5ec
f15b3261135df9da7690045a2e3225eb870a699e66a1d8b2651c429c5951dace

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /logo192.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:22 GMT
Content-Type: text/html
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"6419a56a-437"
Content-Encoding: gzip

149.28.109.35/img/neuron_icon.png

149.28.109.35

200 OK

1.3 kB

URL HTTP/1.1
149.28.109.35/img/neuron_icon.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 14 x 16, 8-bit colormap, non-interlaced\012- data
Size
1.3 kB (1295 bytes)
Hash
65702faebadab030826636560199e6e8
29c0eda0067792013ae087bc944ff2dd58ee828f
9831cc45adeaea00ad5085f49b913f8b779f16ba22d54e9f37e5ed36b24fdba2

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /img/neuron_icon.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:22 GMT
Content-Type: image/png
Content-Length: 1295
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-50f"
Accept-Ranges: bytes

149.28.109.35/static/js/58.836527c2.chunk.js

149.28.109.35

200 OK

102 kB

URL HTTP/1.1
149.28.109.35/static/js/58.836527c2.chunk.js
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
ASCII text, with very long lines (65536), with no line terminators
Size
102 kB (101765 bytes)
Hash
c4a0526c0671f69a60abc1aa781552f6
eed184bb5d19539f4bf4706c3b449622eaf5cf80
d43e9110f29d438ac54c99a8d9eeb85f4dfb47b5c2f679393ab6ea15ae2953d5

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/js/58.836527c2.chunk.js HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:22 GMT
Content-Type: application/javascript
Content-Length: 101765
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-18d85"
Accept-Ranges: bytes

149.28.109.35/static/media/brazil.5fd45b4f086915f0da20.png

149.28.109.35

200 OK

761 kB

URL HTTP/1.1
149.28.109.35/static/media/brazil.5fd45b4f086915f0da20.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 3536 x 2475, 8-bit/color RGBA, non-interlaced\012- data
Size
761 kB (761444 bytes)
Hash
ea30c37bbaec88009e6e93feece9edf0
d98005f278895bc5542b56aedbde87d05c61087e
080e7d7d3630399818289882c39a4bbe7e39515c50f5ca05966abe088287b034

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/brazil.5fd45b4f086915f0da20.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/png
Content-Length: 761444
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-b9e64"
Accept-Ranges: bytes

149.28.109.35/static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg

149.28.109.35

200 OK

1.9 kB

URL HTTP/1.1
149.28.109.35/static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1671)
Size
1.9 kB (1919 bytes)
Hash
f998dad25eb38e300a9ff0afa6f5daff
27b38d61af8ee5648dd68f9f0c07b3dcceb448dd
fc6f0b149b98ddfd7ee21daaae65cfd1a8841555bf74b604abb365ae5908ecea

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/Login.6942ad8b9fd970fb005e72012114e9c5.svg HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/svg+xml
Content-Length: 1919
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-77f"
Accept-Ranges: bytes

149.28.109.35/static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg

149.28.109.35

200 OK

513 B

URL HTTP/1.1
149.28.109.35/static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (409)
Size
513 B (513 bytes)
Hash
d9de3293a55aa81e69f644f5ab99e01c
ffdfc391dbfc1675a92eafc240828b47a7f58da2
1de61ca04bf64fc8908ea8659c53d6abedc7e2ebba60ec3dc4d0a5b26370fcea

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/Password.f143e80c11b10f463bd16d7b96bb16ef.svg HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/svg+xml
Content-Length: 513
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-201"
Accept-Ranges: bytes

149.28.109.35/static/media/new_bg_login.e58e195037d050e22075.png

149.28.109.35

200 OK

35 kB

URL HTTP/1.1
149.28.109.35/static/media/new_bg_login.e58e195037d050e22075.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 988 x 639, 8-bit/color RGBA, non-interlaced\012- data
Size
35 kB (35283 bytes)
Hash
04bfe8082f0a1b8dfa38a5c7c5351fe3
9cdbe7e05c39b18c2b60a7b09e1961e310ae2722
10c00a7b84cadd243de4a3ced0bc618b4f3e4934c484fafa17064e14bca15046

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/new_bg_login.e58e195037d050e22075.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/8UsA.sh

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/png
Content-Length: 35283
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-89d3"
Accept-Ranges: bytes

149.28.109.35/static/media/espanha.92225a9cfd7d0aed87e6.png

149.28.109.35

200 OK

1.4 MB

URL HTTP/1.1
149.28.109.35/static/media/espanha.92225a9cfd7d0aed87e6.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 3536 x 2475, 8-bit/color RGBA, non-interlaced\012- data
Size
1.4 MB (1424628 bytes)
Hash
1818f399424be30348c3e97071a8ad22
abf66be82ef664c8a5e71f3d262329cfbcd0e92b
164bf67606b82379a567a268d7b65485468f54abe1c1aa21c6781ebe144e27af

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/espanha.92225a9cfd7d0aed87e6.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/png
Content-Length: 1424628
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-15bcf4"
Accept-Ranges: bytes

149.28.109.35/static/media/eua.bd4257f1510ff0c52b44.png

149.28.109.35

200 OK

669 kB

URL HTTP/1.1
149.28.109.35/static/media/eua.bd4257f1510ff0c52b44.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 3536 x 2475, 8-bit/color RGBA, non-interlaced\012- data
Size
669 kB (668701 bytes)
Hash
9471d8dfea7261f5511c605b60135037
15dc1c25b2e405dbaae99b73210a83aab262cb66
fbae12200b06073f2c6e87ea71a6b6e72c1e7053e59f15fa60b1cdc1ab5365e8

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/eua.bd4257f1510ff0c52b44.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/png
Content-Length: 668701
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-a341d"
Accept-Ranges: bytes

149.28.109.35/static/media/Logo.6f2535092e89593864e2.png

149.28.109.35

200 OK

142 kB

URL HTTP/1.1
149.28.109.35/static/media/Logo.6f2535092e89593864e2.png
IP
149.28.109.35:0
ASN
#20473 AS-CHOOPA

File type
PNG image data, 1900 x 735, 8-bit/color RGBA, non-interlaced\012- data
Size
142 kB (142241 bytes)
Hash
41efe7c1fbd720e5cbb077d11812b596
d12e2cd7760ee702a31f80e09d0a7060acadfe5a
f79f286149898c62fed28d39e9679e0c6a62237e45b57d4ec973e93240136d56

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /static/media/Logo.6f2535092e89593864e2.png HTTP/1.1
Host: 149.28.109.35
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://149.28.109.35/

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 23 Mar 2023 08:53:23 GMT
Content-Type: image/png
Content-Length: 142241
Last-Modified: Tue, 21 Mar 2023 12:39:06 GMT
Connection: keep-alive
ETag: "6419a56a-22ba1"
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (17)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (38)

URL HTTP/1.1

IP

ASN

File type