IP 172.64.149.23:0
Hashd51b1742ddd6951e68aead61ae118273 ce77495491f3fcedb4f05993a249494de04bdbb9 2ae7b30404a33081a02fe9d2aac907de73e0a5384723eda9d947c3eb5e1a4ccc
POST / HTTP/1.1
Host: ocsp.usertrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 14:53:44 GMT
Content-Type: application/ocsp-response
Content-Length: 472
Connection: keep-alive
Last-Modified: Wed, 24 Apr 2024 13:14:24 GMT
Expires: Wed, 01 May 2024 13:14:23 GMT
Etag: "ce77495491f3fcedb4f05993a249494de04bdbb9"
Cache-Control: max-age=511838,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: MISS
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 879f2a13ac8e568d-OSL
|
IP 120.25.221.144:0
ASN#37963 Hangzhou Alibaba Advertising Co.,Ltd.
File typeHTML document, ASCII text Hash7df3d7cf3358af3f470ac7229387ef94 c51a3f0e6de4eb802d5630941c3fd9e1d0efae4b fb47468a2cd3953c7131431991afcc6a2703f14640520102eea0a685a7e8d6de
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO Unconfigured nginx Access |
GET / HTTP/1.1
Host: 120.25.221.144
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.22.0
Date: Thu, 25 Apr 2024 14:53:45 GMT
Content-Type: text/html
Last-Modified: Mon, 23 May 2022 23:59:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"628c1fd6-267"
Content-Encoding: gzip
|
| 120.25.221.144/favicon.ico | 120.25.221.144 | 404 Not Found | 113 B |
URL GET HTTP/1.1120.25.221.144/favicon.ico IP120.25.221.144:80 ASN#37963 Hangzhou Alibaba Advertising Co.,Ltd.
File typeHTML document, ASCII text, with CRLF line terminators Hashac5ea41aae137cead073d37a7bb732bc 85bde4b57e1f38bd7ff0e6cf4b6ac5f626a5fbae fcdc802dabd14bed15efb9235ee0decac4adb6908dca03eeba74e2bf8f4eb5a7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 120.25.221.144
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://120.25.221.144/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.22.0
Date: Thu, 25 Apr 2024 14:53:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
|