| |  154.19.207.153 | 302 Moved Temporarily | 142 B |
URL User Request GET HTTP/1.1IP154.19.207.153:443 ASN#140224 STARCLOUD GLOBAL PTE., LTD.
CertificateIssuerLet's Encrypt Subjectupdate.systimes.top FingerprintD9:8E:88:46:CC:CC:71:E0:B7:12:8D:B9:83:B6:28:1D:B6:1A:25:21 ValidityWed, 25 Dec 2024 01:04:41 GMT - Tue, 25 Mar 2025 01:04:40 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash82c98e8e012b79c922655461171cc2fa 0828d79135573276005b04be42d79a8a3291292b 745173bcc5c57ce9751dd019606e877e0aae13b60372fdb090f3db0470c3a43c
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO HTTP Request to a *.top domain |
GET / HTTP/1.1
Host: update.systimes.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: openresty
Date: Sat, 01 Feb 2025 22:29:41 GMT
Content-Type: text/html
Content-Length: 142
Connection: keep-alive
Location: http://154.19.207.153/4.html
Via: 11-12-24
|
|
| GET 154.19.207.153/4.html | 154.19.207.153 | 200 OK | 8.2 kB |
URL User Request GET HTTP/1.1IP154.19.207.153:80 ASN#140224 STARCLOUD GLOBAL PTE., LTD.
File typeHTML document, Unicode text, UTF-8 text, with CRLF line terminators Hash5058ab270c024dfd84873c5b346d7e79 7fdf22cd773059f492c8881723b5eaeabd5c755d d5824db2647f1870eaa403c284d082e5484299418df145eb5e1156d9f6963dd9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /4.html HTTP/1.1
Host: 154.19.207.153
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Sat, 01 Feb 2025 22:29:42 GMT
Content-Type: text/html
Content-Length: 8230
Last-Modified: Fri, 24 Jan 2025 08:25:53 GMT
Connection: keep-alive
ETag: "67934e91-2026"
Accept-Ranges: bytes
|
|
| | 154.19.207.153 | 302 Moved Temporarily | 142 B |
URL User Request GET HTTP/1.1IP154.19.207.153:443 ASN#140224 STARCLOUD GLOBAL PTE., LTD.
CertificateIssuerLet's Encrypt Subjectupdate.systimes.top FingerprintD9:8E:88:46:CC:CC:71:E0:B7:12:8D:B9:83:B6:28:1D:B6:1A:25:21 ValidityWed, 25 Dec 2024 01:04:41 GMT - Tue, 25 Mar 2025 01:04:40 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash82c98e8e012b79c922655461171cc2fa 0828d79135573276005b04be42d79a8a3291292b 745173bcc5c57ce9751dd019606e877e0aae13b60372fdb090f3db0470c3a43c
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO HTTP Request to a *.top domain |
GET / HTTP/1.1
Host: update.systimes.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: openresty
Date: Sat, 01 Feb 2025 22:29:44 GMT
Content-Type: text/html
Content-Length: 142
Connection: keep-alive
Location: http://154.19.207.153/4.html
Via: 11-12-24
|
|
| GET api.ipify.org/?format=json |  172.67.74.152 | 200 OK | 21 B |
URL GET HTTP/2api.ipify.org/?format=json IP172.67.74.152:443
Requested byhttp://154.19.207.153/4.html CertificateIssuerGoogle Trust Services Subjectipify.org Fingerprint92:76:3B:C3:C6:C1:D6:7F:27:6D:BF:B7:64:AE:F7:5A:4F:84:4C:A0 ValiditySat, 11 Jan 2025 09:28:32 GMT - Fri, 11 Apr 2025 10:28:29 GMT
Hash7d69c71af0f191e9a72db6153f8018d1 f67c5f2887bc05654b47f76e9621e53a4091aed1 5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65
GET /?format=json HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://154.19.207.153/
Origin: http://154.19.207.153
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 01 Feb 2025 22:29:44 GMT
content-type: application/json
content-length: 21
access-control-allow-origin: *
vary: Origin
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 90b561ca3ae75699-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=6774&min_rtt=744&rtt_var=11977&sent=6&recv=11&lost=0&retrans=0&sent_bytes=3190&recv_bytes=1086&delivery_rate=4880898&cwnd=254&unsent_bytes=0&cid=5dde873fc3f361df&ts=128&x=0"
X-Firefox-Spdy: h2
|
|
| GET 154.19.207.153/4.html | 154.19.207.153 | 200 OK | 8.2 kB |
URL User Request GET HTTP/1.1IP154.19.207.153:80 ASN#140224 STARCLOUD GLOBAL PTE., LTD.
File typeHTML document, Unicode text, UTF-8 text, with CRLF line terminators Hash5058ab270c024dfd84873c5b346d7e79 7fdf22cd773059f492c8881723b5eaeabd5c755d d5824db2647f1870eaa403c284d082e5484299418df145eb5e1156d9f6963dd9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /4.html HTTP/1.1
Host: 154.19.207.153
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Sat, 01 Feb 2025 22:29:44 GMT
Content-Type: text/html
Content-Length: 8230
Last-Modified: Fri, 24 Jan 2025 08:25:53 GMT
Connection: keep-alive
ETag: "67934e91-2026"
Accept-Ranges: bytes
|
|
| GET 154.19.207.153/favicon.ico | 154.19.207.153 | 404 Not Found | 150 B |
URL GET HTTP/1.1154.19.207.153/favicon.ico IP154.19.207.153:80 ASN#140224 STARCLOUD GLOBAL PTE., LTD.
Requested byhttp://154.19.207.153/4.html
File typeHTML document, ASCII text, with CRLF line terminators Hash597ba0d4396e9c906225140ce907092c 28ae2ba65ccdb583d79f85b8cc9509fae697493b ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 154.19.207.153
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://154.19.207.153/4.html
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: openresty
Date: Sat, 01 Feb 2025 22:29:45 GMT
Content-Type: text/html
Content-Length: 150
Connection: keep-alive
|
|
| GET libs.jshub.com/font-awesome/5.10.0-12/webfonts/fa-solid-900.woff2 |  206.238.215.9 | 200 OK | 75 kB |
URL GET HTTP/2libs.jshub.com/font-awesome/5.10.0-12/webfonts/fa-solid-900.woff2 IP206.238.215.9:443
Requested byhttp://154.19.207.153/4.html CertificateIssuerLet's Encrypt Subjectjshub.com Fingerprint32:EB:8B:1A:98:99:D7:4D:9A:97:C2:73:A1:BB:25:7D:7F:A5:E5:5E ValiditySat, 16 Nov 2024 02:49:01 GMT - Fri, 14 Feb 2025 02:49:00 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 75388, version 330.15728 Hash8c4c207eb242cc9e1812d2b87671d720 94d5d0723d5407fa263d2c9d09a53b619c8fd239 f2949cd5ce820f0cef3fb73e4e500de19bf07d37ba16e3cdead66009758896a1
GET /font-awesome/5.10.0-12/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: libs.jshub.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://154.19.207.153
DNT: 1
Connection: keep-alive
Referer: https://libs.jshub.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: NgxFence
date: Sat, 01 Feb 2025 22:29:44 GMT
content-type: application/octet-stream
content-length: 75388
last-modified: Sat, 08 May 2021 06:52:50 GMT
etag: "60963542-1267c"
expires: Mon, 18 Nov 2024 05:10:06 GMT
cache-control: max-age=604800
access-control-allow-origin: *
timing-allow-origin: *
x-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| GET libs.jshub.com/font-awesome/5.10.0-12/css/fontawesome.min.css | 206.238.215.9 | 200 OK | 55 kB |
URL GET HTTP/2libs.jshub.com/font-awesome/5.10.0-12/css/fontawesome.min.css IP206.238.215.9:443
Requested byhttp://154.19.207.153/4.html CertificateIssuerLet's Encrypt Subjectjshub.com Fingerprint32:EB:8B:1A:98:99:D7:4D:9A:97:C2:73:A1:BB:25:7D:7F:A5:E5:5E ValiditySat, 16 Nov 2024 02:49:01 GMT - Fri, 14 Feb 2025 02:49:00 GMT
File typeASCII text, with very long lines (54863) Hash5c045b693ba1a430cf485edb1ed18001 d76ec28f4513960890693c7fb00dd753d4af48cd 30b1069dd2957763248b73c6f2bb82794e1b22a625cd4084537a41c70373042f
GET /font-awesome/5.10.0-12/css/fontawesome.min.css HTTP/1.1
Host: libs.jshub.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://154.19.207.153/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: NgxFence
date: Sat, 01 Feb 2025 22:29:44 GMT
content-type: text/css
last-modified: Sat, 08 May 2021 06:52:50 GMT
etag: W/"60963542-d70c"
expires: Mon, 18 Nov 2024 04:59:40 GMT
cache-control: max-age=604800
access-control-allow-origin: *
timing-allow-origin: *
x-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2
|
|
| GET libs.jshub.com/font-awesome/5.10.0-12/css/solid.min.css | 206.238.215.9 | 200 OK | 671 B |
URL GET HTTP/2libs.jshub.com/font-awesome/5.10.0-12/css/solid.min.css IP206.238.215.9:443
Requested byhttp://154.19.207.153/4.html CertificateIssuerLet's Encrypt Subjectjshub.com Fingerprint32:EB:8B:1A:98:99:D7:4D:9A:97:C2:73:A1:BB:25:7D:7F:A5:E5:5E ValiditySat, 16 Nov 2024 02:49:01 GMT - Fri, 14 Feb 2025 02:49:00 GMT
File typeASCII text, with very long lines (689), with no line terminators Hash8c61015bad8efc53e686b7836a359ddc 725319cd18a0ac061b6af880aed2d705921152d9 a281f967e4a9f7361ebe8dd09ef0ae530ccd5034ff64b21a510820775a6bed52
GET /font-awesome/5.10.0-12/css/solid.min.css HTTP/1.1
Host: libs.jshub.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://154.19.207.153/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: NgxFence
date: Sat, 01 Feb 2025 22:29:43 GMT
content-type: text/css
last-modified: Sat, 08 May 2021 06:52:50 GMT
etag: W/"60963542-29f"
expires: Mon, 18 Nov 2024 05:09:19 GMT
cache-control: max-age=604800
access-control-allow-origin: *
timing-allow-origin: *
x-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2
|
|
172.67.74.152