IP 172.64.155.188:0
Hash 25b8a223b0253ffcf30efaa5af5c3f12
f3500b20cb1eb9ec499b55b8301f4e4251926f5a
2e9152d163c3a594002df2b9e06be8b9be9f6c15b3529128502d1cd722e01b32
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 17 May 2023 12:16:17 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Sun, 14 May 2023 06:16:00 GMT
Expires: Sun, 21 May 2023 06:15:59 GMT
Etag: "f3500b20cb1eb9ec499b55b8301f4e4251926f5a"
Cache-Control: max-age=323381,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7c8bca6e0ea7b4f9-OSL
thehometownair.com/cache/rentfree.zip
66.29.146.74200 OK 0 B URL User Request GET HTTP/2 thehometownair.com/cache/rentfree.zip
IP 66.29.146.74:443
Certificate IssuerSectigo Limited
Subjectthehometownair.com
Fingerprint0A:BF:DB:8B:04:9F:AA:F8:9B:9E:03:95:2E:11:0A:88:D0:D7:C3:93
ValidityFri, 24 Mar 2023 00:00:00 GMT - Sun, 24 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
threatfox QakBot
mnemonic_dns Sinkholed
quad9 Sinkholed
GET /cache/rentfree.zip HTTP/1.1
Host: thehometownair.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/7.3.33
content-type: text/html; charset=UTF-8
cache-control: public, max-age=0
expires: Wed, 17 May 2023 12:16:18 GMT
content-length: 0
date: Wed, 17 May 2023 12:16:18 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
thehometownair.com/favicon.ico
66.29.146.74404 Not Found 1.2 kB URL GET HTTP/2 thehometownair.com/favicon.ico
IP 66.29.146.74:443
Requested by https://thehometownair.com/cache/rentfree.zip
Certificate IssuerSectigo Limited
Subjectthehometownair.com
Fingerprint0A:BF:DB:8B:04:9F:AA:F8:9B:9E:03:95:2E:11:0A:88:D0:D7:C3:93
ValidityFri, 24 Mar 2023 00:00:00 GMT - Sun, 24 Mar 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 0bde7d4b3da67537eaf9188e6f8049cf
64300fc482d01d38b40ab20e15960b6509665e5a
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
Analyzer Verdict Alert mnemonic_dns Sinkholed
quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: thehometownair.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thehometownair.com/cache/rentfree.zip
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 1238
date: Wed, 17 May 2023 12:16:18 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2