IP 114.80.179.242:0
ASN#4812 China Telecom Group
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hashff11e8e4c414148f2f27de2d1eb7d88b bcf746644ef178a1a970773b798ec39327813edb 12525656d604a5cca334b6625c7cd48dc40575189853d015e8dcde568a28939b
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ETPRO HUNTING HTTP 200 Stat Code with 404 in Body |
GET / HTTP/1.1
Host: 05.xz2.pogou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: text/html
Content-Length: 144
Connection: keep-alive
Date: Sat, 27 May 2023 02:59:58 GMT
x-oss-request-id: 6471722E801565383679DF15
x-oss-cdn-auth: success
Accept-Ranges: bytes
ETag: "FF11E8E4C414148F2F27DE2D1EB7D88B"
Last-Modified: Tue, 04 Apr 2023 01:57:53 GMT
x-oss-object-type: Normal
x-oss-storage-class: Standard
Content-MD5: /xHo5MQUFI8vJ94tHrfYiw==
x-oss-server-time: 21
Ali-Swift-Global-Savetime: 1685156398
Via: cache54.l2cn2647[0,0,304-0,H], cache21.l2cn2647[1,0], cache14.cn3259[46,45,200-0,H], cache13.cn3259[47,0]
x-oss-hash-crc64ecma: 7663099018064963612
Age: 14
X-Cache: HIT TCP_REFRESH_HIT dirn:11:408129422
X-Swift-SaveTime: Sat, 27 May 2023 03:00:12 GMT
X-Swift-CacheTime: 3600
Timing-Allow-Origin: *
EagleId: 7250b3a116851564129325284e
|
| 05.xz2.pogou.net/appsoft/niimbot.apk |  0.0.0.0 | | 0 B |
URL User Request GET 05.xz2.pogou.net/appsoft/niimbot.apk IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /appsoft/niimbot.apk HTTP/1.1
Host: 05.xz2.pogou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/vnd.android.package-archive
Content-Length: 110680202
Connection: keep-alive
Date: Sat, 27 May 2023 02:59:56 GMT
x-oss-request-id: 6471722CC0F7D53335FACAA6
x-oss-cdn-auth: success
Accept-Ranges: bytes
ETag: "0B8532E6B106A9D59B47487212768C2C-11"
Last-Modified: Mon, 27 Jun 2022 02:19:08 GMT
x-oss-object-type: Multipart
x-oss-hash-crc64ecma: 12212604452193876977
x-oss-storage-class: Standard
x-oss-server-time: 90
Ali-Swift-Global-Savetime: 1685156396
Via: cache25.l2cn2647[129,140,200-0,M], cache30.l2cn2647[144,0], cache13.cn3259[0,0,200-0,H], cache9.cn3259[2,0]
Age: 17
X-Cache: HIT TCP_MEM_HIT dirn:0:803017778
X-Swift-SaveTime: Sat, 27 May 2023 02:59:56 GMT
X-Swift-CacheTime: 3600
Timing-Allow-Origin: *
EagleId: 7250b39d16851564138686333e
|
| 05.xz2.pogou.net/appsoft/niimbot.apk | 0.0.0.0 | | 0 B |
URL User Request GET 05.xz2.pogou.net/appsoft/niimbot.apk IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /appsoft/niimbot.apk HTTP/1.1
Host: 05.xz2.pogou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|