IP 23.224.170.153:0
File typeHTML document, ASCII text Hashd5c13417ce136aca698aaee6fb262ce8 74baafede22906d64b32053fedcb048c4a739808 e28abb4cf7008bf72b1bab2616be9ffbc4aa2e3947a79068eb06addc56411768
GET /41tk.exe HTTP/1.1
Host: 27tk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Cache-Control: max-age=86400
Content-Length: 1019
Connection: close
|
| 23.225.67.83:3355/?r=aHR0cDovLzI3dGsuY29tLzQxdGsuZXhl | 23.225.67.83 | 302 Found | 53 B |
URL User Request GET HTTP/1.123.225.67.83:3355/?r=aHR0cDovLzI3dGsuY29tLzQxdGsuZXhl IP23.225.67.83:3355
File typeHTML document, ASCII text Hash2c3ce0b2bf272f374e1b93431de3787c e15f81842074a0e7e2cab2bff71160c0feede46a d7d4248d253b962219f55f77229e3f4795e326b641eb0b3a072d9796335abf70
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /?r=aHR0cDovLzI3dGsuY29tLzQxdGsuZXhl HTTP/1.1
Host: 23.225.67.83:3355
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://27tk.com/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Thu, 28 Mar 2024 08:15:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 53
Connection: keep-alive
Location: https://www.baidu.com/41tk.exe
|
URL User Request GET HTTP/1.1IP 103.235.47.103:443
ASN#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
CertificateIssuerGlobalSign nv-sa Subjectbaidu.com Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT
File typeHTML document, ASCII text Hashb7e46eb21f3a90dded9194adff65ddca 000d3ed2d1798be85b7876cd16f6b9871242db86 e224e75c338cb9505290b9bcecc9b06bd8b49dcb50394e29b8690d5091398e28
GET /41tk.exe HTTP/1.1
Host: www.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://27tk.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Length: 206
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 28 Mar 2024 08:15:56 GMT
Server: Apache
|
| www.baidu.com/favicon.ico | 103.235.47.103 | 200 OK | 2.0 kB |
URL GET HTTP/1.1www.baidu.com/favicon.ico IP103.235.47.103:443 ASN#55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
Requested byhttps://www.baidu.com/41tk.exe CertificateIssuerGlobalSign nv-sa Subjectbaidu.com Fingerprint97:42:D5:98:27:D6:22:88:CF:59:C3:FF:75:86:8D:D5:D3:12:A0:AF ValidityThu, 06 Jul 2023 01:51:06 GMT - Tue, 06 Aug 2024 01:51:05 GMT
File typeMS Windows icon resource - 1 icon, 64x64, 32 bits/pixel Hash717b138033a41361b32b60fc5062ab2a af9841b6f0923f890f41feec52c94a0cd68f01d8 c70088079fe9441a726c66ce0e73ae38315ec80051d3dd542c41b82fa0a1993a
GET /favicon.ico HTTP/1.1
Host: www.baidu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.baidu.com/41tk.exe
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 1966
Content-Type: image/x-icon
Date: Thu, 28 Mar 2024 08:15:56 GMT
Etag: "423e-5bd257db4e500"
Last-Modified: Wed, 10 Mar 2021 02:33:24 GMT
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Server: Apache
Set-Cookie: BAIDUID=C257649411AC09884FF1D4076D2ABC8F:FG=1; expires=Fri, 28-Mar-25 08:15:56 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
Vary: Accept-Encoding,User-Agent
|