| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash882613f845901733a5cf44444eaf24c0 e44e954f2102a5700060c41150dcb37c9d6ba2de 1dde5010695d8b0880ff77100af0c78afc7c692d4cf6caf1fd4487009d37b8cb
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1DDE5010695D8B0880FF77100AF0C78AFC7C692D4CF6CAF1FD4487009D37B8CB"
Last-Modified: Fri, 09 Aug 2024 00:39:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10876
Expires: Fri, 09 Aug 2024 10:35:32 GMT
Date: Fri, 09 Aug 2024 07:34:16 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash19cd88f88651f2e9f42740350df4b4d1 c6c7026e15281db4f24b3bc4ee2cfc2ecc26362c b41a248824843236c8691934a5dfd24daa01f05cdc8cff81afdb9588dee24946
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B41A248824843236C8691934A5DFD24DAA01F05CDC8CFF81AFDB9588DEE24946"
Last-Modified: Thu, 08 Aug 2024 18:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12703
Expires: Fri, 09 Aug 2024 11:05:59 GMT
Date: Fri, 09 Aug 2024 07:34:16 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hasha7b6b62c40d039614a8e497e28dfcb92 e5883c177b8d622fd5fc7a925e437df4c3fdb984 496d0482a522c54fcea43174ca83c7a72bcb5cfd6c15c02ecd955557ee00eb03
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "496D0482A522C54FCEA43174CA83C7A72BCB5CFD6C15C02ECD955557EE00EB03"
Last-Modified: Thu, 08 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12085
Expires: Fri, 09 Aug 2024 10:55:42 GMT
Date: Fri, 09 Aug 2024 07:34:17 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash9ee33ad49fc95cbec52887b67a3f8f92 a692164ae79e5d194dac7945b76eb493f261a103 f6e3ff7fe8c3e33cc9a5f443e3772734a7026ec834f48a39703f23467f33c23f
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F6E3FF7FE8C3E33CC9A5F443E3772734A7026EC834F48A39703F23467F33C23F"
Last-Modified: Thu, 08 Aug 2024 18:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7814
Expires: Fri, 09 Aug 2024 09:44:31 GMT
Date: Fri, 09 Aug 2024 07:34:17 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash3c9eed2fec24829a27e34778ffb2a08d 3c419b3947c7acd38fa1f8ba03fdd0bc5edb8241 1f3082fe17b3928cd059cf5c6f7f9f0901d0b02edc522adb594611df615657c0
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1F3082FE17B3928CD059CF5C6F7F9F0901D0B02EDC522ADB594611DF615657C0"
Last-Modified: Thu, 08 Aug 2024 18:57:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8722
Expires: Fri, 09 Aug 2024 09:59:39 GMT
Date: Fri, 09 Aug 2024 07:34:17 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hashe1cd74cbd513bcac7faf7147dd0e9db3 5c83e98e78beec3020f4942369d9c2365a7de76f dd403ef6d8531526826d75c9ceda54beea36b5c8b8a281297331818ac6336b23
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DD403EF6D8531526826D75C9CEDA54BEEA36B5C8B8A281297331818AC6336B23"
Last-Modified: Thu, 08 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15132
Expires: Fri, 09 Aug 2024 11:46:30 GMT
Date: Fri, 09 Aug 2024 07:34:18 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash4cbc9626c73be7d5dcbbe058e55aad0b 528901752567f5c63aaf2b16986a78317b103bcd 9860b5df8ec5968b5115bd6d6a842912b43bc5418cb2baa4a4c1303800f3e571
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9860B5DF8EC5968B5115BD6D6A842912B43BC5418CB2BAA4A4C1303800F3E571"
Last-Modified: Thu, 08 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8061
Expires: Fri, 09 Aug 2024 09:48:40 GMT
Date: Fri, 09 Aug 2024 07:34:19 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash4cbc9626c73be7d5dcbbe058e55aad0b 528901752567f5c63aaf2b16986a78317b103bcd 9860b5df8ec5968b5115bd6d6a842912b43bc5418cb2baa4a4c1303800f3e571
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9860B5DF8EC5968B5115BD6D6A842912B43BC5418CB2BAA4A4C1303800F3E571"
Last-Modified: Thu, 08 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8061
Expires: Fri, 09 Aug 2024 09:48:40 GMT
Date: Fri, 09 Aug 2024 07:34:19 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash4cbc9626c73be7d5dcbbe058e55aad0b 528901752567f5c63aaf2b16986a78317b103bcd 9860b5df8ec5968b5115bd6d6a842912b43bc5418cb2baa4a4c1303800f3e571
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9860B5DF8EC5968B5115BD6D6A842912B43BC5418CB2BAA4A4C1303800F3E571"
Last-Modified: Thu, 08 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8061
Expires: Fri, 09 Aug 2024 09:48:40 GMT
Date: Fri, 09 Aug 2024 07:34:19 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash4cbc9626c73be7d5dcbbe058e55aad0b 528901752567f5c63aaf2b16986a78317b103bcd 9860b5df8ec5968b5115bd6d6a842912b43bc5418cb2baa4a4c1303800f3e571
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9860B5DF8EC5968B5115BD6D6A842912B43BC5418CB2BAA4A4C1303800F3E571"
Last-Modified: Thu, 08 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8105
Expires: Fri, 09 Aug 2024 09:49:24 GMT
Date: Fri, 09 Aug 2024 07:34:19 GMT
Connection: keep-alive
|
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml | 35.244.181.201 | | 5.8 kB |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP 35.244.181.201:0
ASN#396982 GOOGLE-CLOUD-PLATFORM
File typegzip compressed data, max speed, from Unix Hash00655012f99e64c9c0c3f108dbbed6d6 2956724c924d10d72dfb04d9a60a79dd3bd682b2 b9c12de485db2942443eeda0ac5ce31f6952610789ad72a444a591687540ef73
GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 09 Aug 2024 07:34:36 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2024-09-23-08-12-55.chain; p384ecdsa=eT0jg9bbqntuTwNMnGQ0TabM-rtoeDiBa3-IIxd7iWBVJqyZ_VmIBXf0TnjQ8kkP8l5qoiuGGjz6pXmoueoC5mpenVEPLz9v0B8EGMM-Vf5EyFE6v6Qh1Wn6sHX047HT
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ydlnpu.ctozee.top/door_list/new_door_20230821/2.txt | 104.21.80.213 | 200 OK | 44 kB |
URL User Request GET HTTP/2ydlnpu.ctozee.top/door_list/new_door_20230821/2.txt IP 104.21.80.213:443
CertificateIssuerGoogle Trust Services Subjectctozee.top Fingerprint51:92:C6:75:5C:75:F8:A9:75:35:60:01:8C:2D:95:4E:59:D2:10:8E ValiditySat, 27 Jul 2024 02:15:21 GMT - Fri, 25 Oct 2024 02:15:20 GMT
File typePHP script, ASCII text, with very long lines (44130) Hash6d5e9d15b9b8294d82021250ef096805 00ee6addda098fda06ad589ad0c9181b5677523a 17310c836c78b094f7a10c07c93f3fb2dcde2ca38967e7908abdb6fde7868317
Analyzer | Verdict | Alert | Public Nextron YARA rules | malware | php webshell containing base64 encoded payload |
GET /door_list/new_door_20230821/2.txt HTTP/1.1
Host: ydlnpu.ctozee.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 09 Aug 2024 07:34:17 GMT
content-type: text/plain
last-modified: Fri, 17 Nov 2023 03:02:56 GMT
vary: Accept-Encoding
etag: W/"6556d7e0-ac6c"
content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KS%2BO%2BI3n8AwzrBvNNLikA159yDUqavZXTfbiJkPc4VhdOtp%2B02g4qJVMqfuN8CZ1MQyPzNwY9tLePfCXStV3LeolQ%2BxF5xRIduDoqpt%2F4G%2BUWC1aFCtTBzXyJELgQuZURwslLA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8b061017d939712f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| ydlnpu.ctozee.top/favicon.ico | 104.21.80.213 | 404 Not Found | 146 B |
URL GET HTTP/3ydlnpu.ctozee.top/favicon.ico IP 104.21.80.213:443
Requested byhttps://ydlnpu.ctozee.top/door_list/new_door_20230821/2.txt CertificateIssuerGoogle Trust Services Subjectctozee.top Fingerprint51:92:C6:75:5C:75:F8:A9:75:35:60:01:8C:2D:95:4E:59:D2:10:8E ValiditySat, 27 Jul 2024 02:15:21 GMT - Fri, 25 Oct 2024 02:15:20 GMT
File typeHTML document, ASCII text, with no line terminators Hash40b3fc14254227ec5012d996bf90c4e1 b0dd06eb5a779151151101337889ff09953f8ac0 740816c1b61e4a8443c26d30d3eecfea04815fca8cd605a142f9d8a35f86ceca
GET /favicon.ico HTTP/1.1
Host: ydlnpu.ctozee.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ydlnpu.ctozee.top/door_list/new_door_20230821/2.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 09 Aug 2024 07:34:18 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2BmSNBNvq6P5abST2VskEtPpHvP0aY3ci5%2FngIWwppVUHt3M6xVJrrgrKgzPgjDPp%2BbFDzHAzbLpmuF4QoYvzyoLT%2FMPdlmb%2BUpCHsdfF%2FhXKBu%2FAfx3ZvhpN9vb%2FU0RsJjX%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8b06101b3cd056b1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|