{"report_id":"910191bc-2ef1-4697-be80-2d479cc5e35a","version":6,"status":"done","tags":[],"date":"2025-07-31T22:57:57Z","url":{"schema":"http","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":0,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//6pbnwdzscp.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"title":"Warning: Potential Security Risk Ahead"},"submit":{"url":{"schema":"http","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":0,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-09-04T22:57:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"mdhtbca4s2.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.499754Z","last_seen":"2025-07-31T22:57:57.499754Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"n82myrk7je.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.500964Z","last_seen":"2025-07-31T22:57:57.500964Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"qy2yxcmbn8.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.497839Z","last_seen":"2025-07-31T22:57:57.497839Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"2zb2wccmht.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.495153Z","last_seen":"2025-07-31T22:57:57.495153Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"8xe2eeerrk.498929com-dh.top","ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.498826Z","last_seen":"2025-07-31T22:57:57.498826Z","alert_count":11,"request_count":11,"received_data":2089,"sent_data":5372,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"6pbnwdzscp.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.924424Z","last_seen":"2025-07-31T22:57:57.924424Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"shzms2xekd.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.908998Z","last_seen":"2025-07-31T22:57:57.908998Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"2g3znwwxqy.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.501859Z","last_seen":"2025-07-31T22:57:57.501859Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null},{"fqdn":"prmywz3tbh.498929com-dh.top","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-02-18","domain_rank":0,"first_seen":"2025-07-31T22:57:57.94431Z","last_seen":"2025-07-31T22:57:57.94431Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":501,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//2g3znwwxqy.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//8xe2eeerrk.498929com-dh.top/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//shzms2xekd.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//qy2yxcmbn8.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//prmywz3tbh.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//6pbnwdzscp.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//2zb2wccmht.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//mdhtbca4s2.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:certerror?e=nssBadCert\u0026u=https%3A//n82myrk7je.498929com-dh.top/demo/\u0026c=UTF-8\u0026d=%20","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"1fc778fb81973516c7df9ee7caca05e6","sha1":"7953945d192422cc2b1d8610d1b0fa1469bb5b7f","sha256":"a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb","sha512":"12c9fa58aadc72e4ea186baa2249de3f9b8e9e3220205e924d072f702e46e0e1ef4e30c78f3f6cdb2c6c1706f7613ce2c9a081d67ea234a66fd932e4eaea3207","ssdeep":"","tlshash":"f0b0124e75a6c4a116fbf87a01374204283731133444ea9e3d5c09804f50964a3836c5","size":111,"data":"","first_seen":"2025-03-02T08:59:45.587636Z","last_seen":"2025-08-04T22:29:31.323865Z","times_seen":45796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"2zb2wccmht.498929com-dh.top/demo/","fqdn":"2zb2wccmht.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:37.109Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: 2zb2wccmht.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":871,"timings":{"blocked":871,"dns":0,"connect":148,"send":0,"wait":0,"receive":0,"ssl":160},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:41.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:41 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://QY2yXCmBN8.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"2g3znwwxqy.498929com-dh.top/demo/","fqdn":"2g3znwwxqy.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:45.839Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: 2g3znwwxqy.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":593,"timings":{"blocked":593,"dns":0,"connect":149,"send":0,"wait":0,"receive":0,"ssl":161},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"6pbnwdzscp.498929com-dh.top/demo/","fqdn":"6pbnwdzscp.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:52.589Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: 6pbnwdzscp.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":801,"timings":{"blocked":801,"dns":0,"connect":154,"send":0,"wait":0,"receive":0,"ssl":165},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:34.806Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate: Thu, 31 Jul 2025 22:57:34 GMT\r\nContent-Type: text/html\r\nContent-Length: 162\r\nConnection: keep-alive\r\nLocation: https://8xe2eeerrk.498929com-dh.top/\r\nStrict-Transport-Security: max-age=31536000\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":446,"timings":{"blocked":146,"dns":1,"connect":149,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"shzms2xekd.498929com-dh.top/demo/","fqdn":"shzms2xekd.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:39.628Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: shzms2xekd.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":665,"timings":{"blocked":0,"dns":356,"connect":149,"send":0,"wait":0,"receive":0,"ssl":157},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mdhtbca4s2.498929com-dh.top/demo/","fqdn":"mdhtbca4s2.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:43.707Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: mdhtbca4s2.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":591,"timings":{"blocked":591,"dns":0,"connect":154,"send":0,"wait":0,"receive":0,"ssl":166},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:47.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:47 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://n82MYRK7Je.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":157,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"n82myrk7je.498929com-dh.top/demo/","fqdn":"n82myrk7je.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:47.959Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: n82myrk7je.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":658,"timings":{"blocked":658,"dns":0,"connect":147,"send":0,"wait":0,"receive":0,"ssl":158},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:34.235Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":556,"timings":{"blocked":0,"dns":240,"connect":152,"send":0,"wait":0,"receive":0,"ssl":160},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:36.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://2Zb2WcCmHt.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":811,"timings":{"blocked":327,"dns":1,"connect":156,"send":0,"wait":157,"receive":0,"ssl":167},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:43.542Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:43 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://mDhTBCa4s2.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:45.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:45 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://2G3zNwwXQY.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":157,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:52.426Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:52 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://6pbnwdZsCp.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":157,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:35.111Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":5,"connect":151,"send":0,"wait":0,"receive":0,"ssl":168},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qy2yxcmbn8.498929com-dh.top/demo/","fqdn":"qy2yxcmbn8.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:41.520Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: qy2yxcmbn8.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":665,"timings":{"blocked":665,"dns":0,"connect":148,"send":0,"wait":0,"receive":0,"ssl":164},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:49.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:49 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://PRmYwZ3tbH.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":157,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"prmywz3tbh.498929com-dh.top/demo/","fqdn":"prmywz3tbh.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:50.133Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /demo/ HTTP/1.1\r\nHost: prmywz3tbh.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":904,"timings":{"blocked":904,"dns":0,"connect":155,"send":0,"wait":0,"receive":0,"ssl":169},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"8xe2eeerrk.498929com-dh.top/","fqdn":"8xe2eeerrk.498929com-dh.top","domain":"498929com-dh.top","tld":"top"},"ip":{"addr":"154.84.56.135","port":443,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-07-31T22:57:39.466Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.498929.com","organization":""},"issuer":{"commonName":"R11","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Apr 2025 07:06:53 GMT","end":"Fri, 11 Jul 2025 07:06:52 GMT"},"fingerprint":{"sha1":"51:66:DB:10:36:42:E7:8B:88:33:F9:7F:10:F9:D5:7E:69:2C:83:E0","sha256":"DA:E1:BB:34:8E:71:2C:A6:6B:25:3C:13:9A:5D:B1:EB:E0:70:13:29:0A:A8:9F:C1:8A:7F:09:E2:AD:B3:FC:82"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: 8xe2eeerrk.498929com-dh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Thu, 31 Jul 2025 22:57:39 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://sHzmS2xeKD.498929com-dh.top/demo/\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-16T05:02:04.498424Z","times_seen":13809798,"resource_available":true,"data":null}},"time_used":158,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"","description":"","date":"2025-07-31T22:57:35Z","timestamp":1754002655,"ip_dst":{"addr":"154.84.56.135","port":80,"asn":35916,"as":"MULTA-ASN1","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.25","port":46608,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO HTTP Request to a *.top domain","source":"{\"timestamp\":\"2025-07-31T22:57:35.101075+0000\",\"flow_id\":1878090227531222,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.25\",\"src_port\":46608,\"dest_ip\":\"154.84.56.135\",\"dest_port\":80,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.SuspExeTLDs\"]},\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2023882,\"rev\":5,\"signature\":\"ET INFO HTTP Request to a *.top domain\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2017_02_07\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"http\":{\"hostname\":\"8xe2eeerrk.498929com-dh.top\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":301,\"redirect\":\"https://8xe2eeerrk.498929com-dh.top/\",\"length\":162},\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":684,\"bytes_toclient\":617,\"start\":\"2025-07-31T22:57:34.802262+0000\"}}"}],"analyzer":null,"urlquery":null}}]}