| ocsp.r2m02.amazontrust.com/ |  143.204.53.97 | | 471 B |
URL ocsp.r2m02.amazontrust.com/ IP143.204.53.97:0
Hashf56e5176cd5f4d711e88caafa1b3034a 6848f48b6efe1dc43aa629197cba842acde8c539 a230e1c3de01454844be9b8ea72631398cf3ab827c328f77f990f687066133ea
POST / HTTP/1.1
Host: ocsp.r2m02.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Wed, 01 Nov 2023 06:40:09 GMT
Last-Modified: Wed, 01 Nov 2023 05:43:50 GMT
Server: ECAcc (ska/F7A5)
X-Cache: Miss from cloudfront
Via: 1.1 41dc61beb3fe8e8c2c299a2522d8330c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: Oo3cNk3pA7-rissh08-zAPqXMxsqb30BjwGVmjRPX-CWEwv6VMENzA==
Age: 3380
|
| api4.check-data.xyz/api/get_update_options/2C6A44CB_AD42_4731_A544_3FBD3D83AB5B/wrtzr_ytab_a_1/1/?0.1359406878459215 | 44.233.79.208 | 200 OK | 233 B |
URL User Request GET HTTP/1.1api4.check-data.xyz/api/get_update_options/2C6A44CB_AD42_4731_A544_3FBD3D83AB5B/wrtzr_ytab_a_1/1/?0.1359406878459215 IP44.233.79.208:443
CertificateIssuerAmazon Subject*.tracemonitors.com FingerprintA3:AE:70:A8:99:BA:9A:BB:A1:9D:3A:27:1D:80:3E:E9:45:B0:BB:1E ValidityMon, 02 Oct 2023 00:00:00 GMT - Wed, 30 Oct 2024 23:59:59 GMT
File typeJSON data\012- , ASCII text, with very long lines (437), with no line terminators Hashb2ce20025cc35cee8500dff517dc8008 3fbf6fa123474ad3efa6ce70bb2bb73a102031f4 b6a64fe41630bec33c1ed02c3ca1ca715806af44115278bc2dae298797ecfca9
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /api/get_update_options/2C6A44CB_AD42_4731_A544_3FBD3D83AB5B/wrtzr_ytab_a_1/1/?0.1359406878459215 HTTP/1.1
Host: api4.check-data.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Cache-control: no-cache="set-cookie"
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 01 Nov 2023 06:39:32 GMT
Server: nginx
Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
AWSELBCORS=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200;SECURE;SAMESITE=None
Content-Length: 233
Connection: keep-alive
|
| api4.check-data.xyz/favicon.ico | 44.233.79.208 | 200 OK | 372 B |
URL GET HTTP/1.1api4.check-data.xyz/favicon.ico IP44.233.79.208:443
Requested byhttps://api4.check-data.xyz/api/get_update_options/2C6A44CB_AD42_4731_A544_3FBD3D83AB5B/wrtzr_ytab_a_1/1/?0.1359406878459215 CertificateIssuerAmazon Subject*.tracemonitors.com FingerprintA3:AE:70:A8:99:BA:9A:BB:A1:9D:3A:27:1D:80:3E:E9:45:B0:BB:1E ValidityMon, 02 Oct 2023 00:00:00 GMT - Wed, 30 Oct 2024 23:59:59 GMT
File typePNG image data, 32 x 32, 8-bit colormap, non-interlaced\012- data Hash66b3119d379aee26ba668fef49188dd3 4569014add6981f25b53898dcf491a314c4418bb 2414211797f445e0d8286f799e2af9b4fa8efc8207e8c17d204323b0cf0b0d90
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: api4.check-data.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://api4.check-data.xyz/api/get_update_options/2C6A44CB_AD42_4731_A544_3FBD3D83AB5B/wrtzr_ytab_a_1/1/?0.1359406878459215
Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5; AWSELBCORS=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/x-icon
Date: Wed, 01 Nov 2023 06:39:32 GMT
ETag: "6541f06a-174"
Last-Modified: Wed, 01 Nov 2023 06:30:02 GMT
Server: nginx
Content-Length: 372
Connection: keep-alive
|