URL User Request GET HTTP/1.1IP172.67.143.19:80
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | fortinet | Malware | | threatfox | QakBot | | mnemonic_dns | Sinkholed | | quad9 | Sinkholed | |
NIDS | Severity | Alert | suricata | high | URLhaus Known malware download URL detected (2625477) |
GET /palu/ HTTP/1.1
Host: eweelz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Sun, 07 May 2023 04:47:52 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 07 May 2023 05:47:52 GMT
Location: https://eweelz.com/palu/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cza2V126e0VAxufe0gstnqyxjuGUdnjmlqFb%2FaOMqrgXW6qOB0eNIVoDMyzWEi2pqt6bY7OZ3DRNKAQxzM4r4e9sl%2FAKdqwe9gM80396A8VEYUs0fmXm0QROQIbE"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7c36d3d128b51c16-OSL
alt-svc: h2=":443"; ma=60
|
IP172.67.143.19:443
CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintCE:15:CE:2A:4F:67:E7:DD:38:36:5A:65:58:A0:11:2A:A0:0D:94:E3 ValidityFri, 28 Oct 2022 00:00:00 GMT - Sat, 28 Oct 2023 23:59:59 GMT
File typePNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data Hashc4dfab323bcf67cc9d2dbdd1b3234bea dedf2e7d51f26b07de3ba889f079aa30c01e1ff3 7b4b81e8a3c153717c9b100cd0c5a3ffe25838d3491a53314022cff23c431a7c
Analyzer | Verdict | Alert | mnemonic_dns | Sinkholed | | quad9 | Sinkholed | |
GET /favicon.ico HTTP/1.1
Host: eweelz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eweelz.com/palu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sun, 07 May 2023 04:47:53 GMT
content-type: text/html; charset=UTF-8
location: https://eweelz.com/wp-content/uploads/2022/02/cropped-logo-32x32.png
x-powered-by: PHP/8.1.17
link: <https://eweelz.com/wp-json/>; rel="https://api.w.org/"
x-redirect-by: WordPress
vary: Accept-Encoding
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KaqRNkTmv%2FkYp%2F1mPPuiWi6O5HeoyzZe26A5XgFv9V8GGq0UP%2Fb2%2BdskFq6%2FDowN7X7Ei7VDp8Xr1CllOjPBWPXx0zZ50PsZA73uOUtSvwdl9bB%2BhPXTSxqVsYEP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7c36d3d43c6bb512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
|
| eweelz.com/wp-content/uploads/2022/02/cropped-logo-32x32.png | 172.67.143.19 | 200 OK | 945 B |
URL GET HTTP/3eweelz.com/wp-content/uploads/2022/02/cropped-logo-32x32.png IP172.67.143.19:443
CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com FingerprintCE:15:CE:2A:4F:67:E7:DD:38:36:5A:65:58:A0:11:2A:A0:0D:94:E3 ValidityFri, 28 Oct 2022 00:00:00 GMT - Sat, 28 Oct 2023 23:59:59 GMT
File typePNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced\012- data Hashc4dfab323bcf67cc9d2dbdd1b3234bea dedf2e7d51f26b07de3ba889f079aa30c01e1ff3 7b4b81e8a3c153717c9b100cd0c5a3ffe25838d3491a53314022cff23c431a7c
Analyzer | Verdict | Alert | mnemonic_dns | Sinkholed | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/02/cropped-logo-32x32.png HTTP/1.1
Host: eweelz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eweelz.com/palu/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 07 May 2023 04:47:53 GMT
content-type: image/png
content-length: 945
last-modified: Tue, 08 Feb 2022 13:43:31 GMT
etag: "3e61008-3b1-5d781e713ed6a"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O98otMhCR4MoRKJsYT52%2BDGewz5e4DQjfthUf3W5WOtnXKVZwSCbYtyT%2BjY7nJkXYOXJkXeHt3Up2bHxHgmePh75dxwofmHWIT85BgIuJoDhs4M%2Bqx9lfYgqWk8Y"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7c36d3d5ad62b512-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
|