IP
Hash 3959d14fd3a4c0107e5fd07cc9062594
ad00e46922e212bea5e3252c5e6fe7642c1bc943
89673f13b1b9d5c24dd91cf5f232731fec356fe3b9a1c5f31db31db181827e4c
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 19 May 2023 18:01:55 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 17 May 2023 18:16:07 GMT
Expires: Wed, 24 May 2023 18:16:06 GMT
Etag: "ad00e46922e212bea5e3252c5e6fe7642c1bc943"
Cache-Control: max-age=432250,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7c9e3f7669c31c06-OSL
thehometownair.com/cache/rentfree.zip
200 OK 0 B URL User Request GET HTTP/2 thehometownair.com/cache/rentfree.zip
IP
Certificate IssuerSectigo Limited
Subjectthehometownair.com
Fingerprint0A:BF:DB:8B:04:9F:AA:F8:9B:9E:03:95:2E:11:0A:88:D0:D7:C3:93
ValidityFri, 24 Mar 2023 00:00:00 GMT - Sun, 24 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
threatfox QakBot
mnemonic_dns Sinkholed
quad9 Sinkholed
GET /cache/rentfree.zip HTTP/1.1
Host: thehometownair.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/7.3.33
content-type: text/html; charset=UTF-8
cache-control: public, max-age=0
expires: Fri, 19 May 2023 18:01:55 GMT
content-length: 0
date: Fri, 19 May 2023 18:01:55 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
thehometownair.com/favicon.ico
404 Not Found 1.2 kB URL GET HTTP/2 thehometownair.com/favicon.ico
IP
Requested by https://thehometownair.com/cache/rentfree.zip
Certificate IssuerSectigo Limited
Subjectthehometownair.com
Fingerprint0A:BF:DB:8B:04:9F:AA:F8:9B:9E:03:95:2E:11:0A:88:D0:D7:C3:93
ValidityFri, 24 Mar 2023 00:00:00 GMT - Sun, 24 Mar 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF, LF line terminators
Hash 0bde7d4b3da67537eaf9188e6f8049cf
64300fc482d01d38b40ab20e15960b6509665e5a
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
Analyzer Verdict Alert mnemonic_dns Sinkholed
quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: thehometownair.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thehometownair.com/cache/rentfree.zip
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 1238
date: Fri, 19 May 2023 18:01:55 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
66.29.146.74
104.18.32.68