Report - paste.fo/raw/297ac0c3d3feonallonall2vector

Report Overview

Submitted URL
paste.fo/raw/297ac0c3d3feonallonall2vector
IP
104.21.28.76
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-20 06:31:17
Access
public
Website Title
You have been rate limited!
Final URL
paste.fo/raw/297ac0c3d3feonallonall2vector
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
20

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
paste.fo	unknown	2022-08-23	2022-09-02	2024-04-18	4.2 kB	36 kB	104.21.28.76
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-20	529 B	22 kB	216.58.207.227
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-20	547 B	23 kB	142.250.74.106
static.cloudflareinsights.com	1294	2019-08-30	2019-09-24	2024-04-19	480 B	20 kB	104.16.80.73

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed
2024-04-20	medium	paste.fo	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	unknown	247 B	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 08:31:17 Last Seen2024-04-20 08:31:17 Times Seen1 Hash c5f79e5c235771edbe39e7118349cd44 2ca02d7e9bcd1e16d7ad6cafe63ebbe7101350cd cfaa46152f97cc945d3227b5b946328b7181bf5da48464aa987153906992a974 Loading...

	paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js	7.9 kB	2024-04-20	2024-04-20
Pretty URL paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 104.21.28.76 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 08:31:10 Last Seen2024-04-20 08:31:17 Times Seen4 Hash a75bd3030ceea433a3b3b54c736001d4 1d1e5993652ab8ed2fe6db5cf5be419ddf130e60 97523a6166db611532ba960575eaf536c9790002354c7d2567dafb9fef7da0fa Loading...

	paste.fo/raw/297ac0c3d3feonallonall2vector	1.1 kB	2024-04-20	2024-04-20
Pretty URL paste.fo/raw/297ac0c3d3feonallonall2vector IP 104.21.28.76 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-20 08:31:17 Last Seen2024-04-20 08:31:17 Times Seen1 Hash 0b23a6be197bf1c90bce3cf4ee617090 c4187653a81d84b18d0155f2e2d70781c287e9b8 db36cae37d3b6b1bbddef94dc4cea15e2374eb01774a8e4239e691a9fdbf95db Loading...

	static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793	19 kB	2024-04-17	2024-05-03
Pretty URL static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793 IP 104.16.80.73 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-17 04:05:01 Last Seen2024-05-03 04:44:29 Times Seen1486 Hash 3be93fd15d2f7dee2fc0c8981c6fa5c6 8cd88c36fad3e96641dbc4d781f5ddbe5123312f 17106bf803d42bcf2f2bdf778ece084d3f91c68e7ea41dae7bff61fefa573dee Loading...

HTTP Transactions (13)

URL IP Response Size

paste.fo/raw/297ac0c3d3feonallonall2vector

104.21.28.76

403 Forbidden

1.4 kB

URL User Request GET HTTP/2
paste.fo/raw/297ac0c3d3feonallonall2vector
IP
104.21.28.76:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (1494)
Size
1.4 kB (1411 bytes)
Hash
16837489c58793b088bafcc7f6edab9d
188b815611c8a2c558250289f81bb3ff8000084b
9750e8e99cbcdf23a66387ef5c95a8f78c7af5003bff60ddde07b4f41d7469d6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /raw/297ac0c3d3feonallonall2vector HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Sat, 20 Apr 2024 06:30:52 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Retry-After: 1
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uu%2BoiGuAF5g%2B16gWsBjZBBcbmyz6qmAwtb%2BHsAe7JV24l843KfmESJbDQCZRUNyiro%2Fv4m2v0dn8tUkm3CMQJshgSV1eYZ1m4IO3Phg727EMIBFw5dNMReXs5w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 877316901e1ab511-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.28.76

302 Moved Temporarily

143 B

URL GET HTTP/1.1
paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.28.76:80
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector

File type
HTML document, ASCII text, with CRLF line terminators
Size
143 B (143 bytes)
Hash
cb7b8f439b04c00f4a2d78160ddfee8d
9aa44b5d68f6359f10de0dcd24ea3e12548d9bd4
12755429beb15d5eb57eafa45b8dba326343dd099bf0552038694c3856e8860e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Sat, 20 Apr 2024 06:30:52 GMT
Content-Type: text/html
Content-Length: 143
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHH9%2FpuwISkSCvpdtXgt%2B0uBiExn5IOmsjuGe9%2Fo9daVKREzcD2sojZuine4hAxQJtkFw0Qk418Q45bvPTnW8a%2FfASwWZ%2B%2Bkav04c1Ov6iccMkPqNbQC0upBeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 877316917f09b511-OSL
alt-svc: h2=":443"; ma=60

paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js

104.21.28.76

302 Moved Temporarily

0 B

URL GET HTTP/1.1
paste.fo/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP
104.21.28.76:80
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sat, 20 Apr 2024 06:30:52 GMT
content-length: 0
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js
cache-control: max-age=300, public
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tLQXUtR7qsFyGgpavHOKN%2BCb%2Br6GfmWHaubM8YLWl2xZQ63ok2xjWxvZ50%2B2NKzmb7NOOdyhmIiRLyFdEqnBjEvcTbaJJyMlGfGkGeLfMAqXoSfBGJBYaYG%2Beg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87731691a993712d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

paste.fo/cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js

104.21.28.76

200 OK

4.3 kB

URL GET HTTP/2
paste.fo/cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js
IP
104.21.28.76:443
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (7937), with no line terminators
Size
4.3 kB (4317 bytes)
Hash
a75bd3030ceea433a3b3b54c736001d4
1d1e5993652ab8ed2fe6db5cf5be419ddf130e60
97523a6166db611532ba960575eaf536c9790002354c7d2567dafb9fef7da0fa

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/471dc2adc340/main.js HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 20 Apr 2024 06:30:52 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
content-encoding: br
vary: accept-encoding
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x5pK6eXhHdQNjN6raJCKMa5qm5l7QwYjzAgXMXWvlt0iA9UN4rR0l%2FQTLe0WoMAsTNzaavlqHCjYbA1jydKuV6snUHVvyT40AIya1aqMrVA60m9X5v2cyeNWdw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87731691b9a5712d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2

216.58.207.227

200 OK

22 kB

URL GET HTTP/2
fonts.gstatic.com/s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 21528, version 1.0
Size
22 kB (21528 bytes)
Hash
6113a25a586aeb6d0d3af5b5b652b973
25619eeae1fe17389310e4d392c427b7711dba44
539bdb4bd9bb71c694451bbf2d5d7c0b2849e3584f0b50be3588a07605d3337f

HTTP Headers

GET /s/sourcecodepro/v23/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://paste.fo
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 21528
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 17:41:33 GMT
expires: Fri, 18 Apr 2025 17:41:33 GMT
cache-control: public, max-age=31536000
age: 132559
last-modified: Wed, 13 Sep 2023 23:21:57 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Source+Code+Pro:ital,wght@0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

142.250.74.106

200 OK

23 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Source+Code+Pro:ital,wght@0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
23 kB (22770 bytes)
Hash
357d1122c532f909d9b5fd6b7ef4bc42
b9c4a35f23df155528b05981bef85eccdfb3ea5b
da80b32a4d2139d9add377dc0ef7e0163a98a14ba0e9df061d85304f110dc65f

HTTP Headers

GET /css2?family=Source+Code+Pro:ital,wght@0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://paste.fo/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 20 Apr 2024 06:30:52 GMT
date: Sat, 20 Apr 2024 06:30:52 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

paste.fo/favicon.ico

104.21.28.76

167 B

URL GET
paste.fo/favicon.ico
IP
104.21.28.76:0
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
167 B (167 bytes)
Hash
0104c301c5e02bd6148b8703d19b3a73
7436e0b4b1f8c222c38069890b75fa2baf9ca620
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://paste.fo/raw/297ac0c3d3feonallonall2vector
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Sat, 20 Apr 2024 06:30:52 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 20 Apr 2024 07:30:52 GMT
Location: https://paste.fo/favicon.ico
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B5h8Pt%2FxPYWKFX%2BPmu8kVE%2BEz4UPu%2Fm6Eli2hQg00t8X7LFwC0iaaAXx442VRwSWsmappPSG6wrBu%2BHhxrTCEgMYNhvQK5DqKlRw9wF3Xb2es9Xtv8oTJm1Pdw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 877316926fceb511-OSL
alt-svc: h2=":443"; ma=60

paste.fo/cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511

104.21.28.76

400 Bad Request

143 B

URL OPTIONS HTTP/3
paste.fo/cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511
IP
104.21.28.76:443
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
143 B (143 bytes)
Hash
cb7b8f439b04c00f4a2d78160ddfee8d
9aa44b5d68f6359f10de0dcd24ea3e12548d9bd4
12755429beb15d5eb57eafa45b8dba326343dd099bf0552038694c3856e8860e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511 HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 11583
Origin: http://paste.fo
DNT: 1
Connection: keep-alive
Referer: http://paste.fo/raw/297ac0c3d3feonallonall2vector
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Sat, 20 Apr 2024 06:30:52 GMT
Content-Type: text/html
Content-Length: 143
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://paste.fo/cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lN9SlKK4Z8%2BCqv0pyC81y%2FTvjkFiE7ytUB8HevqVuS%2F2gTI64n2%2FSaxNyCi%2FhzTiqhAvAyMI25jqFxWZ%2F%2FWiRzqxfK89mknjw4J%2FlBOC6uD9WKDAL2dHuWJGhg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87731692b800b511-OSL
alt-svc: h2=":443"; ma=60

paste.fo/cdn-cgi/rum?

104.21.28.76

204 No Content

0 B

URL POST HTTP/1.1
paste.fo/cdn-cgi/rum?
IP
104.21.28.76:80
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cdn-cgi/rum? HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/json
Content-Length: 1060
Origin: http://paste.fo
DNT: 1
Connection: keep-alive
Referer: http://paste.fo/raw/297ac0c3d3feonallonall2vector
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Date: Sat, 20 Apr 2024 06:30:52 GMT
Connection: keep-alive
access-control-allow-origin: http://paste.fo
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
Server: cloudflare
CF-RAY: 87731692c803b511-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff

paste.fo/cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511

104.21.28.76

400 Bad Request

7 B

URL OPTIONS HTTP/3
paste.fo/cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511
IP
104.21.28.76:443
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
7 B (7 bytes)
Hash
fedb2d84cafe20862cb4399751a8a7e3
81f344a7686a80b4c5293e8fdc0b0160c82c06a8
f1234d75178d892a133a410355a5a990cf75d2f33eba25d575943d4df632f3a4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /cdn-cgi/challenge-platform/h/b/jsd/r/877316901e1ab511 HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Referer: http://paste.fo/
Origin: http://paste.fo
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 400 Bad Request
date: Sat, 20 Apr 2024 06:30:52 GMT
content-type: application/json
content-length: 7
cf-chl-out: guTcfU/bNHQaMtkHv2VXkA==$PYVthiMiCRgMhXVGhyp2AA==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iH4U7yQENMufo5pNcPA0PxSGjP50eIyq9E2bj6Pr5c10e4OA8ppTSYrtPCQDcVtkYwGWdJ1NR7QzGlHDZlclsP9oRbAF9ia3QYXd%2B1wierIploHWqgHYywH8RA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87731692dbe8569b-OSL
alt-svc: h3=":443"; ma=86400

paste.fo/favicon.ico

104.21.28.76

16 kB

URL GET
paste.fo/favicon.ico
IP
104.21.28.76:0
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Size
16 kB (15756 bytes)
Hash
cf593ad6a070c546ba238d5172b52aa1
9bed079538917ab59999ea26e8becca1cec74af8
d19e9b6b10d3890ef6cffdc76821fca266f2c0db6c653ffe16b5984a200a4015

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://paste.fo/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 20 Apr 2024 06:30:52 GMT
content-type: image/vnd.microsoft.icon
last-modified: Fri, 29 Mar 2024 15:28:29 GMT
etag: W/"3bec-614ce4abd368d"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sYCFnszMSCKBB7%2BVEdPyfbl9Nbs2eUjfoxq8WykgBlalI9xtxxAvJH4aozgf%2FkccPcb27EzImH3LeKYVoP9q3Z4XGkWgxk7YWT4tmWhI3rlKOvCX5u%2B8m%2F23PQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87731692bba8569b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

paste.fo/raw/297ac0c3d3feonallonall2vector

172.67.144.225

403 Forbidden

7.7 kB

URL User Request GET HTTP/2
paste.fo/raw/297ac0c3d3feonallonall2vector
IP
172.67.144.225:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectpaste.fo
Fingerprint45:4F:E3:CB:01:43:C2:8B:CA:E1:64:B0:D4:A7:73:8A:C0:79:E2:22
ValidityWed, 17 Jan 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (1494)
Size
7.7 kB (7738 bytes)
Hash
99f9c1d0d4c9e5ed2a8d14d5abfa3e5a
26188c5bfac6ec065ecc814405f65f35377c5ced
baf88fbace15dc41c09ccc172401eb01a7864b7c763789142a9785f4eefbafe8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /raw/297ac0c3d3feonallonall2vector HTTP/1.1
Host: paste.fo
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Sat, 20 Apr 2024 06:30:52 GMT
content-type: text/html
retry-after: 1
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QTj6SyrU3LIdfld2%2F52ylbbYtyZoPUN1kHO6YUYsjia0WIBQpgr0xuXfGumSgWhEOJuuXYsrdT%2Bciu3zqSMLWUIvvqKHz2rq5XXEEMI%2BYX1fvcUwsviPqACbEA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8773168f7e900b51-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793

104.16.80.73

200 OK

19 kB

URL GET HTTP/2
static.cloudflareinsights.com/beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793
IP
104.16.80.73:443
ASN
#13335 CLOUDFLARENET

Requested by
http://paste.fo/raw/297ac0c3d3feonallonall2vector
Certificate
IssuerGoogle Trust Services LLC
Subjectcloudflareinsights.com
Fingerprint73:92:5A:16:97:55:FC:A5:32:7C:F3:9D:0C:84:EF:F3:2F:AA:B5:00
ValiditySun, 10 Mar 2024 02:33:42 GMT - Sat, 08 Jun 2024 02:33:41 GMT

File type
JavaScript source, ASCII text, with very long lines (19261), with no line terminators
Size
19 kB (19261 bytes)
Hash
3be93fd15d2f7dee2fc0c8981c6fa5c6
8cd88c36fad3e96641dbc4d781f5ddbe5123312f
17106bf803d42bcf2f2bdf778ece084d3f91c68e7ea41dae7bff61fefa573dee

HTTP Headers

GET /beacon.min.js/v55bfa2fee65d44688e90c00735ed189a1713218998793 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://paste.fo
DNT: 1
Connection: keep-alive
Referer: http://paste.fo/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 06:30:52 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.4.0"
last-modified: Mon, 15 Apr 2024 22:09:58 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 87731690bc8fb529-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2