| r3.o.lencr.org/ |  23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashd27590a1d3cbe1e9632b8ae92aaae3f4 202b34e8a0c3b88c8826fd56c6227b34f2cd6f46 6bcfa518476658128c1fb4ea2435c4e58531454cf97138dce7ece9def589aead
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6BCFA518476658128C1FB4EA2435C4E58531454CF97138DCE7ECE9DEF589AEAD"
Last-Modified: Wed, 16 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3508
Expires: Sat, 19 Nov 2022 01:20:13 GMT
Date: Sat, 19 Nov 2022 00:21:45 GMT
Connection: keep-alive
|
|
| ocsp.digicert.com/ |  93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hash67f53a639d57dd6237b5be86fe4f6c1b 287f09532dc331228d09c20b75f4160e91e9800a 41913a8af366685c42af59e9d8e02fccedbe68a3313d2d9fe353deb0c1019075
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5423
Cache-Control: max-age=128384
Content-Type: application/ocsp-response
Date: Sat, 19 Nov 2022 00:21:46 GMT
Etag: "63775eeb-1d7"
Expires: Sun, 20 Nov 2022 12:01:30 GMT
Last-Modified: Fri, 18 Nov 2022 10:31:07 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471
|
|
| r3.o.lencr.org/ | 23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash4e84f361a3c81abc5d665a5f441452a8 7aa4b9cb0a7ba1daa514dbb48fe8e74fdf09b60d 04d64920cc8e6b096841938b0c1140889f5d7a04eabd440934a31f1c7ab90352
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "04D64920CC8E6B096841938B0C1140889F5D7A04EABD440934A31F1C7AB90352"
Last-Modified: Wed, 16 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6499
Expires: Sat, 19 Nov 2022 02:10:05 GMT
Date: Sat, 19 Nov 2022 00:21:46 GMT
Connection: keep-alive
|
|
| firefox.settings.services.mozilla.com/v1/ |  34.102.187.140 | 200 OK | 939 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/ IP34.102.187.140:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hash4d7e4eed097b9c4e5d509419f1cfc85a 290bb3d428a7c6330e2e3d73a952b16f820896c8 0dc9ca0f57af15adcd416035e92794711434e3d53a1feff21d8481d6d500986c
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Length, Alert, Backoff, Retry-After
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 18 Nov 2022 23:44:50 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2216
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain | 34.160.144.191 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain IP34.160.144.191:0
File typePEM certificate\012- , ASCII text Hash67d5a988edcda47bc3b3b3f65d32b4b6 d4f0e0da8b3690cc7da925026d3414b68c7d954f 55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 2Izh89HgJFsXVYDME99ti2xD7mNdKm8rapSRo6reH3//QTCRpK1D4erHWTj4MtiQB4RMkPJjmmY=
x-amz-request-id: FBKPYTPAYD0KNVMD
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 18 Nov 2022 23:53:08 GMT
age: 1718
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash524aebcf08b4a13182db3656211b22ac 63a9433af63e33ce6c80fa504c1127c033c5d6e8 070b9a6d098adb9a91640b6c32f3f44bb7f790b02c664597fe06842c8807735f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "070B9A6D098ADB9A91640B6C32F3F44BB7F790B02C664597FE06842C8807735F"
Last-Modified: Fri, 18 Nov 2022 11:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21533
Expires: Sat, 19 Nov 2022 06:20:39 GMT
Date: Sat, 19 Nov 2022 00:21:46 GMT
Connection: keep-alive
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:46 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 34.102.187.140 | 200 OK | 329 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP34.102.187.140:0
File typeJSON data\012- , ASCII text, with very long lines (329), with no line terminators Hash0333b0655111aa68de771adfcc4db243 63f295a144ac87a7c8e23417626724eeca68a7eb 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Cache-Control, ETag, Pragma, Expires, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 18 Nov 2022 23:44:49 GMT
cache-control: public,max-age=3600
age: 2217
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.digicert.com/ | 93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hashfe40cc6ea871d80382b6082111393fbe 281f75d0a35dc8ef908bb0500e57abd86bd5388e 6d15422cdf7a6d72d06497188f27af893682314e82ac8a189a0ee2d798cb62d7
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5805
Cache-Control: max-age=123715
Content-Type: application/ocsp-response
Date: Sat, 19 Nov 2022 00:21:46 GMT
Etag: "63774b30-1d7"
Expires: Sun, 20 Nov 2022 10:43:41 GMT
Last-Modified: Fri, 18 Nov 2022 09:06:56 GMT
Server: ECS (ska/F714)
X-Cache: HIT
Content-Length: 471
|
|
| push.services.mozilla.com/ | 52.38.227.80 | 101 Switching Protocols | 0 B |
URL HTTP/1.1push.services.mozilla.com/ IP52.38.227.80:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: nYj6tHC4E75jV35vh8qPbQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: BYuDRuGoHXyCGzKwCjJauTlwRRQ=
|
|
| syscryptos.com/mul/index.php?qbot.zip |  135.181.142.201 | 301 Moved Permanently | 0 B |
URL HTTP/2syscryptos.com/mul/index.php?qbot.zip IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /mul/index.php?qbot.zip HTTP/1.1
Host: syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 301 Moved Permanently
server: nginx
date: Sat, 19 Nov 2022 00:21:47 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://www.syscryptos.com/mul/?qbot.zip
x-dns-prefetch-control: on
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
x-redirect-by: WordPress
x-litespeed-cache-control: public,max-age=3600
x-litespeed-tag: c25_HTTP.404,c25_HTTP.301,c25_404,c25_URL.f58b56d63beabd38bc5f1b9d0563fcf9,c25_guest,c25_
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: MISS
x-server-powered-by: Engintron
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash17af07b019100dc8adb529ce85f827bd 602adaa722e9a3ee89600ebe40cea7033c435483 aec801578f867078e0a82d90e78290f0a3ef4f1f4936eb763801b869e0fae747
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AEC801578F867078E0A82D90E78290F0A3EF4F1F4936EB763801B869E0FAE747"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3540
Expires: Sat, 19 Nov 2022 01:20:48 GMT
Date: Sat, 19 Nov 2022 00:21:48 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash17af07b019100dc8adb529ce85f827bd 602adaa722e9a3ee89600ebe40cea7033c435483 aec801578f867078e0a82d90e78290f0a3ef4f1f4936eb763801b869e0fae747
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AEC801578F867078E0A82D90E78290F0A3EF4F1F4936EB763801B869E0FAE747"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3540
Expires: Sat, 19 Nov 2022 01:20:48 GMT
Date: Sat, 19 Nov 2022 00:21:48 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash17af07b019100dc8adb529ce85f827bd 602adaa722e9a3ee89600ebe40cea7033c435483 aec801578f867078e0a82d90e78290f0a3ef4f1f4936eb763801b869e0fae747
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AEC801578F867078E0A82D90E78290F0A3EF4F1F4936EB763801B869E0FAE747"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3540
Expires: Sat, 19 Nov 2022 01:20:48 GMT
Date: Sat, 19 Nov 2022 00:21:48 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.76.226 | 200 OK | 503 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash17af07b019100dc8adb529ce85f827bd 602adaa722e9a3ee89600ebe40cea7033c435483 aec801578f867078e0a82d90e78290f0a3ef4f1f4936eb763801b869e0fae747
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "AEC801578F867078E0A82D90E78290F0A3EF4F1F4936EB763801B869E0FAE747"
Last-Modified: Wed, 16 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3540
Expires: Sat, 19 Nov 2022 01:20:48 GMT
Date: Sat, 19 Nov 2022 00:21:48 GMT
Connection: keep-alive
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0d2467c-b158-442b-92be-e4cb236d17fa.jpeg | 34.120.237.76 | 200 OK | 3.0 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0d2467c-b158-442b-92be-e4cb236d17fa.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hashd6b026c34985bbf2ebf89a62d0724c66 72369ebeccf447fa91ef77711d6297063c99777e e5598ada634274ab9995dedda8c1fd18344abcfdd49b3a1aaede0a86fafc0f40
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc0d2467c-b158-442b-92be-e4cb236d17fa.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3035
x-amzn-requestid: 3e3f3a7f-9a1d-4b37-b932-22c6e3e638f1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b0QRcFOuoAMF_fQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6377fa6f-09dc20ea5620dd167e3f7265;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 21:34:39 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: xvVfLfP2DUilu7GSJMGArO90Kdoq5cPBVtmtyVjZmX5ZKnvOjpR_UQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 e80693c02cfdfd081110512210d57840.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 21:36:25 GMT
age: 9923
etag: "72369ebeccf447fa91ef77711d6297063c99777e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce07c59e-2c1b-4d3b-8c02-f1ed4bca6607.jpeg | 34.120.237.76 | 200 OK | 4.0 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce07c59e-2c1b-4d3b-8c02-f1ed4bca6607.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash49115517a3f79b5092934e128d54c721 14582e35cacbfc2543587e546cb3b4faf2c898bf 0f9015683cacc252fb5e5053681da1b85b3dd0694e2cd04417e73e5e82ecac2f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce07c59e-2c1b-4d3b-8c02-f1ed4bca6607.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3962
x-amzn-requestid: 29b553ab-9ef2-44b8-aea9-b1582b207a6b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b0QRWGKmIAMFSWQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6377fa6e-3fb68804386112d17eba689d;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 21:34:38 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: NlXk5HDtG5jJpocFatW40jmG60DcpFCl4o6MqkAPSHH13lP66E4d6w==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 21:36:25 GMT
age: 9923
etag: "14582e35cacbfc2543587e546cb3b4faf2c898bf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac98a873-8b46-43f5-9ac0-fc1cc1a0cd81.jpeg | 34.120.237.76 | 200 OK | 11 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac98a873-8b46-43f5-9ac0-fc1cc1a0cd81.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash481c033b9ffd030ff0de6e35cf788b47 85d3baad9217af2b5d75c019d2ef95dbb919a788 02443c7869914c2b29892deb0c645395bcf4e8379da3cf20974614ff9c92893b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fac98a873-8b46-43f5-9ac0-fc1cc1a0cd81.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11249
x-amzn-requestid: c5283740-7c8e-44fd-9302-cb37f4694629
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bubp1HUmIAMFykw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6375a63e-4026e895406d36f257a574da;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 03:10:54 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: ICD4VOHAUcJinoxRmZv-4rDSX_9XxTNY59BJh4hIIDiE2zPPmyE94w==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 73cb83fe6699afc2791b5c690c1ff8c6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 03:43:52 GMT
age: 74276
etag: "85d3baad9217af2b5d75c019d2ef95dbb919a788"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6865a9f2-7103-433d-8ba8-2a1cca0f76d1.jpeg | 34.120.237.76 | 200 OK | 5.2 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6865a9f2-7103-433d-8ba8-2a1cca0f76d1.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hashb834de670098398062ac06865cfa82a4 6b50f4fdc7d7dcbb11d8739b71e8e1eecec047b4 9eefe7101330de28d8d0fdb3f17a5453f3368324fbacb9f3a36826f76b7c9bde
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6865a9f2-7103-433d-8ba8-2a1cca0f76d1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5226
x-amzn-requestid: c0655cd4-83f6-4c7c-97b6-2847f38df126
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b0QRwFPwoAMFV5Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6377fa71-5f7eca026395cbe72daed116;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 21:34:41 GMT
x-amz-cf-pop: SEA19-C3, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: gSAFmiB37Xf-Ytu7_BEwytLEY9rflh0ruTy-mU3vHQlS9Amx90qUcg==
via: 1.1 2c6b5dd77f1abe60653ce0454f344b64.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 21:36:25 GMT
age: 9923
etag: "6b50f4fdc7d7dcbb11d8739b71e8e1eecec047b4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F141ee43e-4742-4784-a9a2-359cfa7ac9a3.jpeg | 34.120.237.76 | 200 OK | 9.7 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F141ee43e-4742-4784-a9a2-359cfa7ac9a3.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash859348e84041e7934b7f959f087a3679 583310946175391015cb46fcfa476cca96ebb9a9 7fba6813b2d8f06a6098b2c628580190b094c79e300744506344a3febc5f06de
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F141ee43e-4742-4784-a9a2-359cfa7ac9a3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9681
x-amzn-requestid: 73f28d59-8922-473c-9977-df0c39f9cc6f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bZ3t-FC1oAMFQdQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-636d6cbf-6607d2be74559f1d3448dab7;Sampled=0
x-amzn-remapped-date: Thu, 10 Nov 2022 21:27:27 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: aXtuckvPNMzB0frJPAOosiNpmhd_VNb4RHUj8fVkZjVtDxRXwoU33w==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 cd64decb1403270c914848213601a674.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 20:18:57 GMT
age: 14571
etag: "583310946175391015cb46fcfa476cca96ebb9a9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5730155a-f68f-483a-a61b-7d881a44a39b.jpeg | 34.120.237.76 | 200 OK | 12 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5730155a-f68f-483a-a61b-7d881a44a39b.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash58c1f2de229260cce98461e5c7d4d282 136e095a89fb0a5aae3e5d653906865da15df7b6 1d623baac44dce6d882e161ccf7dae4e7689fedf5904a12a8bedc2b4c6daa46b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5730155a-f68f-483a-a61b-7d881a44a39b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12472
x-amzn-requestid: 1291abd8-15e9-463f-a106-927785f93e5d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: byQ_nGwwoAMF3nw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63772eca-3164b923612df3841423a11c;Sampled=0
x-amzn-remapped-date: Fri, 18 Nov 2022 07:05:46 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: wd9AzMTWZs0KECKZ5UKkJaxw8k5qQQ-iofcXxuSg7yTqWgUmHuKw1w==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 07:12:43 GMT
age: 61745
etag: "136e095a89fb0a5aae3e5d653906865da15df7b6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 | 135.181.142.201 | 200 OK | 48 kB |
URL HTTP/2www.syscryptos.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Hash082d45acc5c4d1145c52ffde3fb7a6e5 83e9ed0c3e2281a00f6728f0088399207343b85b d27ae19317723bac9e78c3e38ec94b28489e0108c8db43f87e3d360b50140c85
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 02 Nov 2022 03:11:59 GMT
expires: Mon, 19 Dec 2022 00:21:49 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/06/icon-logo-150x150.png | 135.181.142.201 | 200 OK | 6.4 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/06/icon-logo-150x150.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 150 x 150, 8-bit colormap, non-interlaced\012- data Hashab7844e03bc294ad5d5f3adaad448ecb 04b30f28ccecf4d804da95571fd586579d54b855 9f0b25bb5f11310c825b1c8651f7f9c2c76f92d1df77de12a67d06442e035cd0
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/06/icon-logo-150x150.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: image/png
content-length: 6350
last-modified: Thu, 28 Jul 2022 08:14:40 GMT
expires: Wed, 18 Jan 2023 00:21:49 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/a944cd41dc98776aedf27bebe1137c48.js?ver=1e3b0 | 135.181.142.201 | 200 OK | 183 kB |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/a944cd41dc98776aedf27bebe1137c48.js?ver=1e3b0 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Size183 kB (182584 bytes) Hash11eb05683bba3318a7137de05c8ea0ae 98d8703eae9450e03a59bc3edad5275ea584c2dc b5b70dbcf3d08c877c887745438b3eecfaa17b7de4ec6885af05d7a75bd34da2
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/a944cd41dc98776aedf27bebe1137c48.js?ver=1e3b0 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Sun, 30 Oct 2022 06:49:00 GMT
expires: Mon, 19 Dec 2022 00:21:49 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtm.js?id=GTM-PB3HSKV | 142.250.74.168 | 200 OK | 38 kB |
URL HTTP/2www.googletagmanager.com/gtm.js?id=GTM-PB3HSKV IP142.250.74.168:0
File typeASCII text, with very long lines (1921) Hash4565affd616adfc6398c25553fd7146d 6d3434cc1f597bdff29f34a1c62c7cde0cfe686f cc4598bb2e7775cac1735e49add8b2d0dbf4fd3dd546eed36750979c858cb385
GET /gtm.js?id=GTM-PB3HSKV HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Nov 2022 00:21:49 GMT
expires: Sat, 19 Nov 2022 00:21:49 GMT
cache-control: private, max-age=900
last-modified: Sat, 19 Nov 2022 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 37694
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.35 | 200 OK | 472 B |
IP142.250.74.35:0
Hashf17b03be491bcd758ad58f33ac7c094c c02829213f2c3afc21026a24b413585804ba17de e4085af005b24bc39492d37826b238a7e32d85037c9dcfc658171e73325ec0d5
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 19 Nov 2022 00:21:49 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js |  104.17.25.14 | 200 OK | 1.0 kB |
URL HTTP/2cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js IP104.17.25.14:0
File typeASCII text, with very long lines (2609) Hashf56bc0a6837b34f783f73cd70cd9f2c1 a093b6f45674f1cac3ccc35498eb1a5945f7dde9 0c67ee4dc6af2a5a0b020d3e2e5b049720e516bb4faf6b0b60bd96bf3eba1199
GET /ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: application/javascript; charset=utf-8
content-length: 1046
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec2-ad3"
last-modified: Mon, 04 May 2020 16:11:46 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 8746874
expires: Thu, 09 Nov 2023 00:21:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AAW6vo3VG0Mi8t62HDmLHJuV1PAc5ezuNCiHkq9c7ZjDeNea%2FG3vkEhM4kx16XlVtLiKX2Sw4qI3UblXe7HdPnumq6q84INjRQCQeJrk6oWtwf3ee8ozBCceY4bLytCuLiwXR7Pm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 76c4c9b86a62b4eb-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/burst-statistics-endpoint.php | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/burst-statistics-endpoint.php IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
POST /burst-statistics-endpoint.php HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 318
Origin: https://www.syscryptos.com
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-server-powered-by: Engintron
X-Firefox-Spdy: h2
|
|
| region1.google-analytics.com/g/collect?v=2&tid=G-WZE1EZPHTE>m=2oeb90&_p=1163329138&gdid=dZTNiMT&cid=1245161344.1668817308&ul=en-us&sr=1280x1024&_s=1&sid=1668817307&sct=1&seg=0&dl=https%3A%2F%2Fwww.syscryptos.com%2Fmul%2F%3Fqbot.zip&dt=Page%20not%20found%20%7C%20System%20Crypto&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 | 216.239.34.36 | 204 No Content | 0 B |
URL HTTP/2region1.google-analytics.com/g/collect?v=2&tid=G-WZE1EZPHTE>m=2oeb90&_p=1163329138&gdid=dZTNiMT&cid=1245161344.1668817308&ul=en-us&sr=1280x1024&_s=1&sid=1668817307&sct=1&seg=0&dl=https%3A%2F%2Fwww.syscryptos.com%2Fmul%2F%3Fqbot.zip&dt=Page%20not%20found%20%7C%20System%20Crypto&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 IP216.239.34.36:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /g/collect?v=2&tid=G-WZE1EZPHTE>m=2oeb90&_p=1163329138&gdid=dZTNiMT&cid=1245161344.1668817308&ul=en-us&sr=1280x1024&_s=1&sid=1668817307&sct=1&seg=0&dl=https%3A%2F%2Fwww.syscryptos.com%2Fmul%2F%3Fqbot.zip&dt=Page%20not%20found%20%7C%20System%20Crypto&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.syscryptos.com
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://www.syscryptos.com
date: Sat, 19 Nov 2022 00:21:50 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/burst-statistics-endpoint.php | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/burst-statistics-endpoint.php IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
POST /burst-statistics-endpoint.php HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 145
Origin: https://www.syscryptos.com
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-server-powered-by: Engintron
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtm.js?id=GTM-PB3HSKV | 142.250.74.168 | 200 OK | 38 kB |
URL HTTP/2www.googletagmanager.com/gtm.js?id=GTM-PB3HSKV IP142.250.74.168:0
File typeASCII text, with very long lines (1921) Hashf76703e04863227a6ce0714d1da16132 732aee2cff0a22c9684d3fe3a4a9055f387dd268 79e810bf9c8388014e0b5b43c375d4be47d81348681c6e565b5f16db6fbfff38
GET /gtm.js?id=GTM-PB3HSKV HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Nov 2022 00:21:51 GMT
expires: Sat, 19 Nov 2022 00:21:51 GMT
cache-control: private, max-age=900
last-modified: Sat, 19 Nov 2022 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 37692
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
X-Firefox-Early-Data: accepted
|
|
| www.syscryptos.com/burst-statistics-endpoint.php | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/burst-statistics-endpoint.php IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
POST /burst-statistics-endpoint.php HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 318
Origin: https://www.syscryptos.com
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-server-powered-by: Engintron
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js | 104.17.25.14 | 200 OK | 1.0 kB |
URL HTTP/2cdnjs.cloudflare.com/ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js IP104.17.25.14:0
File typeASCII text, with very long lines (2609) Hashf56bc0a6837b34f783f73cd70cd9f2c1 a093b6f45674f1cac3ccc35498eb1a5945f7dde9 0c67ee4dc6af2a5a0b020d3e2e5b049720e516bb4faf6b0b60bd96bf3eba1199
GET /ajax/libs/jquery-mousewheel/3.1.13/jquery.mousewheel.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript; charset=utf-8
content-length: 1046
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec2-ad3"
last-modified: Mon, 04 May 2020 16:11:46 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 8746876
expires: Thu, 09 Nov 2023 00:21:51 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2IHob6FgZAgSmZRMACW6vAe4Jf6m6LcgDo84wTFUAHxl06rS49R9I9PsMWigISrIju5ZapSCjW1U4PcpAIASV0AFK%2BRG2%2FQeB7teYKNwuxWzdStH5bGTv%2B3aTmrDsRug%2FbqwnGEo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 76c4c9c46ed7b500-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
X-Firefox-Early-Data: accepted
|
|
| www.googletagmanager.com/gtag/js?id= | 142.250.74.168 | 200 OK | 38 kB |
URL HTTP/2www.googletagmanager.com/gtag/js?id= IP142.250.74.168:0
File typeASCII text, with very long lines (1921) Hash60d919a9519b91dc12ebf7c1e88e2f88 4a7b5468065d71df6a1c77465ec9be41b30fbd68 9cb2c2ced423e3830dbd8196d704cdf71da275fc6e707073af260ccdcdb3921e
GET /gtag/js?id= HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Nov 2022 00:21:51 GMT
expires: Sat, 19 Nov 2022 00:21:51 GMT
cache-control: private, max-age=900
last-modified: Sat, 19 Nov 2022 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 37483
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=UA-232954226-1 | 142.250.74.168 | 200 OK | 44 kB |
URL HTTP/2www.googletagmanager.com/gtag/js?id=UA-232954226-1 IP142.250.74.168:0
File typeASCII text, with very long lines (1921) Hash7d95add7f1baad80461cb9e57bd5388a a51b3d976308af25a151f4d0db0f208c107b80f6 90b105445cf0042506314a4d6feb6bc1d0dd2c92996e4f049ce5024f7d9e4f64
GET /gtag/js?id=UA-232954226-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Nov 2022 00:21:51 GMT
expires: Sat, 19 Nov 2022 00:21:51 GMT
cache-control: private, max-age=900
last-modified: Sat, 19 Nov 2022 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 43682
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=UA-232954226-1&l=dataLayer&cx=c | 142.250.74.168 | 200 OK | 44 kB |
URL HTTP/2www.googletagmanager.com/gtag/js?id=UA-232954226-1&l=dataLayer&cx=c IP142.250.74.168:0
File typeASCII text, with very long lines (1921) Hashec510a1ec651f50f1ec4929080718362 12f8e2eb773c336ec57efae443b5ea009fde225f c86d3cb2bc87210ad2bc0688b35f3dea33e14fb3e0d081d4fee6878b488df63c
GET /gtag/js?id=UA-232954226-1&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Nov 2022 00:21:51 GMT
expires: Sat, 19 Nov 2022 00:21:51 GMT
cache-control: private, max-age=900
last-modified: Sat, 19 Nov 2022 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 43675
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-WZE1EZPHTE&l=dataLayer&cx=c | 142.250.74.168 | 200 OK | 77 kB |
URL HTTP/2www.googletagmanager.com/gtag/js?id=G-WZE1EZPHTE&l=dataLayer&cx=c IP142.250.74.168:0
File typeASCII text, with very long lines (21484) Hash19b757bdc3c1fa049160ce4db0a2defe 8def50225503ca69151d409ace6e63e929924989 5044f9173e32d1f95f92bf5ff57e021bf687be10444e370383ce34d62e941d76
GET /gtag/js?id=G-WZE1EZPHTE&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Nov 2022 00:21:51 GMT
expires: Sat, 19 Nov 2022 00:21:51 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 76584
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/06/icon-logo-280x280.png | 135.181.142.201 | 200 OK | 17 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/06/icon-logo-280x280.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 280 x 280, 8-bit colormap, non-interlaced\012- data Hashb14a63e8a548bb3a6b0cca66833d023d fcf2c1dcce0b22fe081dd5fcc85a02c0646177f9 9c35b873348aee1ba08ac99a1079bf530879058952c6205237fa3c26ea2098fb
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/06/icon-logo-280x280.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 17017
last-modified: Thu, 28 Jul 2022 08:14:43 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: HIT
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/06/icon-logo-150x150.png | 135.181.142.201 | 200 OK | 6.4 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/06/icon-logo-150x150.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 150 x 150, 8-bit colormap, non-interlaced\012- data Hashab7844e03bc294ad5d5f3adaad448ecb 04b30f28ccecf4d804da95571fd586579d54b855 9f0b25bb5f11310c825b1c8651f7f9c2c76f92d1df77de12a67d06442e035cd0
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/06/icon-logo-150x150.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 6350
last-modified: Thu, 28 Jul 2022 08:14:40 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: HIT
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.google-analytics.com/analytics.js | 142.250.74.174 | 200 OK | 20 kB |
URL HTTP/2www.google-analytics.com/analytics.js IP142.250.74.174:0
File typeASCII text, with very long lines (1325) Hash47e6f374ca946fddd5b59871b325736c baa9282efc8785e84d247c3bff518eaa45f101c4 16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Fri, 18 Nov 2022 22:41:09 GMT
expires: Sat, 19 Nov 2022 00:41:09 GMT
cache-control: public, max-age=7200
age: 6042
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/71cbfbfd775bae1138d785bcf381d61d.js?ver=913a5 | 135.181.142.201 | 200 OK | 11 kB |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/71cbfbfd775bae1138d785bcf381d61d.js?ver=913a5 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typeC source textAlgol 68 source text\012- Pascal source, ASCII text, with very long lines (48384) Hash7880eacd4a5b93bc5f684e4ac5170075 cbabf03cb532bd36837e16628d5f1bca18709e22 4c770f777077d4497d9cc732ac9e5164779be1943dd3d55e418c57d24e7d684c
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/71cbfbfd775bae1138d785bcf381d61d.js?ver=913a5 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:29 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/10/solana-480x238.png | 135.181.142.201 | 200 OK | 48 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/10/solana-480x238.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 480 x 238, 8-bit/color RGB, non-interlaced\012- data Hashc8b77cf8f061772a6532801abdb2a329 b3db4a1e88c8b9d7bddd34c92c85b0f4fc949af2 43dd85e519d6a50210e9a52298f3138f259263d1b8f7b95d9b7fc16f7c8941a9
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/10/solana-480x238.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.2.1245161344.1668817308; _gid=GA1.2.1001664679.1668817310
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 47566
last-modified: Mon, 03 Oct 2022 14:07:36 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/09/immutable-480x320.png | 135.181.142.201 | 200 OK | 105 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/09/immutable-480x320.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 480 x 320, 8-bit/color RGB, non-interlaced\012- data Size105 kB (105245 bytes) Hash9da8f18f3d3eb11d43672fb73a0706a6 88bc6026eeb6d2319304e8afeb04f0b21240c153 ea09e463dedd557b92e2af9ed106f5dc813417a532f006adc0f3ddc0358a4424
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/09/immutable-480x320.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.2.1245161344.1668817308; _gid=GA1.2.1001664679.1668817310
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 105245
last-modified: Sun, 18 Sep 2022 10:16:11 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-json/complianz/v1/cookie_data | 135.181.142.201 | 200 OK | 126 kB |
URL HTTP/2www.syscryptos.com/wp-json/complianz/v1/cookie_data IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Size126 kB (126450 bytes) Hashcd71a021711c30687665f5aa5f5fe9b1 2a9cf42893ff78119404c225968caaab104681bd a6bf76b694bfc9de959d375528cfa5d4d6ed83962ee2521390376c89f2e75684
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-json/complianz/v1/cookie_data HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/json
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/json
vary: Accept-Encoding
x-dns-prefetch-control: on
x-robots-tag: noindex
link: <https://www.syscryptos.com/wp-json/>; rel="https://api.w.org/"
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
x-litespeed-cache-control: public,max-age=604800
x-litespeed-tag: c25_default,c25_URL.d3ae5f1d6de48883ecbbc7c4a58f00e4,c25_REST,c25_
x-xss-protection: 1; mode=block
x-content-type-options: nosniff, nosniff
x-nginx-upstream-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/07/Metaverse-1-480x320.png | 135.181.142.201 | 200 OK | 65 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/07/Metaverse-1-480x320.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 480 x 320, 8-bit/color RGB, non-interlaced\012- data Hash1646e8572f39090d8b658e07af372cd0 b1d4817a1c7f163ce6c1c6d95030573e17564efd a99ae8787a912b0a1f776e00b7508c8236619e1749e44efdcf3ea3a7c1f7f987
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/07/Metaverse-1-480x320.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.2.1245161344.1668817308; _gid=GA1.2.1001664679.1668817310
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 65374
last-modified: Thu, 28 Jul 2022 07:44:50 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/07/nft-mint-452x320.png | 135.181.142.201 | 200 OK | 78 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/07/nft-mint-452x320.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 452 x 320, 8-bit/color RGB, non-interlaced\012- data Hashe238a03a7ccc11bc3c596e2b995a287d 64895e2a7dab1b45b1ec26e02c16d75891f1e3dd 423bae0e0eb326e051e6f969ea8c99dcea21f0df2baa43090805c08e58823879
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/07/nft-mint-452x320.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.2.1245161344.1668817308; _gid=GA1.2.1001664679.1668817310
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 78418
last-modified: Thu, 28 Jul 2022 07:55:08 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/06/headerlogo-1.png | 135.181.142.201 | 200 OK | 803 B |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/06/headerlogo-1.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 513 x 60, 1-bit colormap, non-interlaced\012- data Hashea138ce5dd7de9acb9df343f79250973 1f1f84b7c6a7a09aeed9c3303416b8cf59abf1f5 69019cad886b2ca57186aead97a0c9c1dadcb27c98ec843f549202ebd8515de4
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/06/headerlogo-1.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.2.1245161344.1668817308; _gid=GA1.2.1001664679.1668817310; _gat_gtag_UA_232954226_1=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 803
last-modified: Thu, 28 Jul 2022 08:14:52 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/115534ff1bcac6c13dd42bda558ee1cc.js?ver=593c1 | 135.181.142.201 | 200 OK | 277 kB |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/115534ff1bcac6c13dd42bda558ee1cc.js?ver=593c1 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
Size277 kB (276896 bytes) Hash28b73522612896c868878fecea77cbab 2e63fda73dfacdd9d4d0e449b5f45a2f2f0cdebd 99be193b0277c18eaaba3e30a1e458af75d9dfce9d600f87dfafeec8c52586f8
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/115534ff1bcac6c13dd42bda558ee1cc.js?ver=593c1 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/2022/08/web3f-min-480x320.png | 135.181.142.201 | 200 OK | 156 kB |
URL HTTP/2www.syscryptos.com/wp-content/uploads/2022/08/web3f-min-480x320.png IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
File typePNG image data, 480 x 320, 8-bit/color RGB, non-interlaced\012- data Size156 kB (156257 bytes) Hash03f58667c2f06d34fffc5c623cc4d76a 54ac00600a6d81bc336e3873fbd16cb06a84f3d0 ad7c53ddf5a94f155abb791172e811bfedc716257d54c48f97cc037206c5248a
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/2022/08/web3f-min-480x320.png HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.1.1668817309.0.0.0; _ga=GA1.2.1245161344.1668817308; _gid=GA1.2.1001664679.1668817310
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: image/png
content-length: 156257
last-modified: Sat, 13 Aug 2022 13:35:37 GMT
expires: Wed, 18 Jan 2023 00:21:51 GMT
cache-control: max-age=5184000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53a83e17-462d-4d4f-8f42-f44460fc79a2.jpeg | 34.120.237.76 | 200 OK | 7.4 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53a83e17-462d-4d4f-8f42-f44460fc79a2.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash50a8727077dd86072a07bd2077c252a8 0e2df523714ca147a69465f3ad4867a33314acb2 9fd12b1e80aa231ffd709c05edda762a4c63d0c70010fb62efdf21c73e657459
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F53a83e17-462d-4d4f-8f42-f44460fc79a2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7445
x-amzn-requestid: 10c0e6f1-9264-49a0-93b1-16f291edb643
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: bu9_nGVwIAMFlKQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6375dd30-42e9fc0207225de072a699c6;Sampled=0
x-amzn-remapped-date: Thu, 17 Nov 2022 07:05:20 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Z7UqLro_YPrsSZEMfCuHtkHSv_JSUjySa_uzw0SDRq3XbR412AxFQg==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 2f7934de1dfe281c3e4446892eab6462.cloudfront.net (CloudFront), 1.1 google
date: Fri, 18 Nov 2022 07:17:48 GMT
age: 61446
etag: "0e2df523714ca147a69465f3ad4867a33314acb2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/cbda4b90d5d27d42ac08a4e85074f440.js?ver=edb77 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/cbda4b90d5d27d42ac08a4e85074f440.js?ver=edb77 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/cbda4b90d5d27d42ac08a4e85074f440.js?ver=edb77 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Wed, 02 Nov 2022 03:11:59 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: HIT
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/bb2e5fa648e86473a208b4d9e6efb333.js?ver=32de9 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/bb2e5fa648e86473a208b4d9e6efb333.js?ver=32de9 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/bb2e5fa648e86473a208b4d9e6efb333.js?ver=32de9 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/e33aa35add1b399062de8a25f4affb45.js?ver=b15f7 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/e33aa35add1b399062de8a25f4affb45.js?ver=b15f7 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/e33aa35add1b399062de8a25f4affb45.js?ver=b15f7 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/complianz/css/banner-1-optout.css?v=20 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/uploads/complianz/css/banner-1-optout.css?v=20 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/complianz/css/banner-1-optout.css?v=20 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 30 Oct 2022 06:34:47 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: HIT
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/1b5cc437d9e50b0183cc25cbb83dfa65.js?ver=6de17 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/1b5cc437d9e50b0183cc25cbb83dfa65.js?ver=6de17 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/1b5cc437d9e50b0183cc25cbb83dfa65.js?ver=6de17 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/40df93c4dce30ed27e4a1e42869e57e9.js?ver=87305 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/40df93c4dce30ed27e4a1e42869e57e9.js?ver=87305 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/40df93c4dce30ed27e4a1e42869e57e9.js?ver=87305 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:29 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/plugins/litespeed-cache/guest.vary.php | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/plugins/litespeed-cache/guest.vary.php IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
POST /wp-content/plugins/litespeed-cache/guest.vary.php HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.syscryptos.com/mul/?qbot.zip
Origin: https://www.syscryptos.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 0
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-litespeed-cache-control: no-cache
set-cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; expires=Mon, 21-Nov-2022 00:21:49 GMT; Max-Age=172800; path=/; secure; HttpOnly
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/uploads/complianz/css/banner-1-optout.css?v=20 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/uploads/complianz/css/banner-1-optout.css?v=20 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/uploads/complianz/css/banner-1-optout.css?v=20 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 30 Oct 2022 06:34:47 GMT
expires: Mon, 19 Dec 2022 00:21:49 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/mul/?qbot.zip | 135.181.142.201 | 404 Not Found | 0 B |
URL HTTP/2www.syscryptos.com/mul/?qbot.zip IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /mul/?qbot.zip HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-dns-prefetch-control: on
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://www.syscryptos.com/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache-control: public,max-age=3600
x-litespeed-tag: c25_HTTP.404,c25_404,c25_URL.587bae08079b8a13957d5e525cceacc4,c25_
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/ae9ed6165338a91527efc516b8234f40.js?ver=03a9a | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/ae9ed6165338a91527efc516b8234f40.js?ver=03a9a IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/ae9ed6165338a91527efc516b8234f40.js?ver=03a9a HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/31c0653d1e62f390183feb979858592f.js?ver=1a0db | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/31c0653d1e62f390183feb979858592f.js?ver=1a0db IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/31c0653d1e62f390183feb979858592f.js?ver=1a0db HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/4750148f60addc2200c9affda6e78250.js?ver=f0371 | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/4750148f60addc2200c9affda6e78250.js?ver=f0371 IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/4750148f60addc2200c9affda6e78250.js?ver=f0371 HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:28 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/mul/?qbot.zip | 135.181.142.201 | 404 Not Found | 0 B |
URL HTTP/2www.syscryptos.com/mul/?qbot.zip IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /mul/?qbot.zip HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Sat, 19 Nov 2022 00:21:49 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-dns-prefetch-control: on
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://www.syscryptos.com/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache-control: public,max-age=3600
x-litespeed-tag: c25_HTTP.404,c25_404,c25_URL.587bae08079b8a13957d5e525cceacc4,c25_guest,c25_,c25_MIN.a944cd41dc98776aedf27bebe1137c48.js
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| www.syscryptos.com/wp-content/litespeed/js/7c0862c731946131f906bf0cb02863ed.js?ver=e5b2a | 135.181.142.201 | 200 OK | 0 B |
URL HTTP/2www.syscryptos.com/wp-content/litespeed/js/7c0862c731946131f906bf0cb02863ed.js?ver=e5b2a IP135.181.142.201:0 ASN#24940 Hetzner Online GmbH
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | | | mnemonic_dns | Sinkholed | | | quad9 | Sinkholed | |
GET /wp-content/litespeed/js/7c0862c731946131f906bf0cb02863ed.js?ver=e5b2a HTTP/1.1
Host: www.syscryptos.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.syscryptos.com/mul/?qbot.zip
Cookie: _lscache_vary=61eaf94a6caa877ceb839c4308b015a1; _ga_WZE1EZPHTE=GS1.1.1668817307.1.0.1668817309.0.0.0; _ga=GA1.1.1245161344.1668817308
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 19 Nov 2022 00:21:51 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 18 Nov 2022 22:55:29 GMT
expires: Mon, 19 Dec 2022 00:21:51 GMT
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: STALE
x-server-powered-by: Engintron
content-encoding: gzip
X-Firefox-Spdy: h2
|
|