www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
115.126.35.218530 39 B URL User Request GET HTTP/1.1 www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
IP 115.126.35.218:80
ASN #397373 H4Y-TECHNOLOGIES
File type HTML document, ASCII text, with no line terminators
Hash 9dbcb63d814cfb9b052a3d0569fef319
ce3a22b5a3a9980ef57635a168a17a79ecb904f9
494940a379099b683daa072d552a515fe93bdcc33c48901b7f53eab1add19174
GET /he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ HTTP/1.1
Host: www.678ap.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 530
Date: Mon, 29 May 2023 18:41:30 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: guard=cc21f636kHR4bK+NIHOVVhf3iaQtlYyhxQ==; path=/;Expires=Mon, 29-May-23 18:51:30 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: cdn
www.678ap.com/_guard/auto.js
115.126.35.218 6.7 kB URL www.678ap.com/_guard/auto.js
IP 115.126.35.218:0
ASN #397373 H4Y-TECHNOLOGIES
File type ASCII text, with very long lines (35740)
Hash 447a485048b884607ecc86beb97952f7
9bbe9b1b019b65b03494d398c0c02735128526e1
8c9c1b490076431f0360a4158944bbd9b0019d3e73d3663664e74b2678dc751b
NIDS Severity Alert suricata low ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
suricata low ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2
suricata low ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3
GET /_guard/auto.js HTTP/1.1
Host: www.678ap.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
Cookie: guard=cc21f636kHR4bK+NIHOVVhf3iaQtlYyhxQ==
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 29 May 2023 18:41:30 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
content-encoding: gzip
Server: cdn
www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
115.126.35.218530 4.2 kB URL User Request GET HTTP/1.1 www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
IP 115.126.35.218:80
ASN #397373 H4Y-TECHNOLOGIES
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- assembler source text\012- exported SGML document, Unicode text, UTF-8 text
Hash 7759ba64e85e65f2d3817a448bc93246
6a5129613e388227b360c0978154ac9483601245
8d39205772b67845083bfff6ce742c05e2dcaad01cdeb1ed27e66b05f4200af4
GET /he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ HTTP/1.1
Host: www.678ap.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: guardret=i00tu246CmS45DdoDaj4RQ==; guard=cc21f636kHR4bK+NIHOVVhf3iaQtlYyhxQ==
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 530
Date: Mon, 29 May 2023 18:41:30 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
ETag: "643d5687-1035"
Server: cdn
www.678ap.com/favicon.ico
115.126.35.218404 Not Found 150 B URL GET HTTP/1.1 www.678ap.com/favicon.ico
IP 115.126.35.218:80
ASN #397373 H4Y-TECHNOLOGIES
Requested by http://www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 597ba0d4396e9c906225140ce907092c
28ae2ba65ccdb583d79f85b8cc9509fae697493b
ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6
GET /favicon.ico HTTP/1.1
Host: www.678ap.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://www.678ap.com/he2a/?w83LZLv0=7y9ty+cCycR76A7DMuNNUDreZy8ejhJkOm+jo3h7d1mKqs4X14nvzoR3JQqYBBvVrJk=&9rF0=nN6tXHRxm2vXRZ
Cookie: guard=cc21f636kHR4bK+NIHOVVhf3iaQtlYyhxQ==
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Mon, 29 May 2023 18:41:31 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 150
Connection: keep-alive
Server: cdn