IP 162.241.139.159:0
ASN#19871 NETWORK-SOLUTIONS-HOSTING
File typeASCII text, with no line terminators Hash9edfc3516f4c8df038d494f1871ad380 6bf6c02de15267aea5f7b7382bb864c223769538 491ee8907b70d9017c907e036c366d41e804cf63d3fb428b8ec19629ed0cc2fc
GET /kvish6.html HTTP/1.1
Host: creavas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Sat, 20 Apr 2024 09:45:31 GMT
accept-ranges: bytes
content-length: 83
content-type: text/html
date: Fri, 26 Apr 2024 18:29:15 GMT
server: Apache
X-Firefox-Spdy: h2
|
| apexmedicalpc.com/ilhigh1.html | 132.148.114.104 | 200 OK | 3.2 MB |
URL User Request GET HTTP/2apexmedicalpc.com/ilhigh1.html IP132.148.114.104:443 ASN#398101 GO-DADDY-COM-LLC
CertificateIssuerLet's Encrypt Subjectmail.apexmedicalpc.com Fingerprint39:BC:E7:83:3B:65:0E:B0:D8:35:4F:C6:C6:CE:0D:28:17:DD:EE:14 ValidityWed, 10 Apr 2024 02:16:15 GMT - Tue, 09 Jul 2024 02:16:14 GMT
Size3.2 MB (3168958 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ilhigh1.html HTTP/1.1
Host: apexmedicalpc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Sat, 20 Apr 2024 09:32:27 GMT
etag: "4e835ff-305abe-61683e1f5132d-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-type: text/html
date: Fri, 26 Apr 2024 18:29:17 GMT
server: Apache
X-Firefox-Spdy: h2
|
| tdgband.com/8cc4b/index.php |  0.0.0.0 | | 0 B |
URL GET tdgband.com/8cc4b/index.php IP0.0.0.0:0
Requested byhttps://apexmedicalpc.com/ilhigh1.html
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /8cc4b/index.php HTTP/1.1
Host: tdgband.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://apexmedicalpc.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|