| 85.239.53.219/api/gatewaylhof | 85.239.53.219 | 302 Found | 10 B |
URL User Request GET HTTP/1.185.239.53.219/api/gatewaylhof IP85.239.53.219:80
File typeASCII text, with no line terminators Hasha8e03540dce77ac5043211d114328eb8 d7ddfe518c491af3a0dc594fa6890ae3dbd45a7b 2df1e0cd7190e6485b41ba12f0a445a2422a720cc97e6419160206383a481c5c
Analyzer | Verdict | Alert | ThreatFox | malicious | Emotet | Quad9 DNS | malicious | Sinkholed |
NIDS | Severity | Alert | suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 50%) | suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 50%) |
GET /api/gatewaylhof HTTP/1.1
Host: 85.239.53.219
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Thu, 18 Apr 2024 09:21:44 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 10
Connection: keep-alive
Location: /404
Referrer-Policy: no-referrer
|
URL User Request GET HTTP/1.1IP85.239.53.219:80
File typeHTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer | Verdict | Alert | ThreatFox | malicious | Emotet | Quad9 DNS | malicious | Sinkholed |
GET /404 HTTP/1.1
Host: 85.239.53.219
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 18 Apr 2024 09:21:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
|
| 85.239.53.219/favicon.ico | 85.239.53.219 | 404 Not Found | 107 B |
URL GET HTTP/1.185.239.53.219/favicon.ico IP85.239.53.219:80
File typeHTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer | Verdict | Alert | ThreatFox | malicious | Emotet | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 85.239.53.219
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://85.239.53.219/404
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 18 Apr 2024 09:21:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
|