IP 192.229.221.95:0
Hashda15a5af31202eeef5e99ce887fe768c 71395719cdf356ce82954011c36f92f138d45b8f 13905f5ae929d47013ca66e7b27934f7935f6706038a33eaf28dd0b878c19c37
POST / HTTP/1.1
Host: status.geotrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4529
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Mon, 04 Dec 2023 22:18:00 GMT
Last-Modified: Mon, 04 Dec 2023 21:02:31 GMT
Server: ECAcc (amb/6AB3)
X-Cache: HIT
Content-Length: 471
|
URL User Request GET HTTP/1.1IP 85.118.196.6:80
ASN#29244 CETIN Bulgaria EAD
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hash0152ed695f4291488741d98ba066d280 3f009ac70c08b4403406cdd038bb1a6ed94b083f e6134491cb1cd3e211b94d20b48482caeec46813007e918bc824a06f102ff021
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 85.118.196.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Mon, 04 Dec 2023 22:18:00 GMT
Server: Apache
Content-Length: 202
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Set-Cookie: BIGipServer~lb_public_wf_wp_app_services~prod_pool_25080_heid_telenor_bg=rd13o00000000000000000000ffffc0a8970bo25080; path=/; Httponly
|
IP85.118.196.6:80 ASN#29244 CETIN Bulgaria EAD
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hash18ffb59b61525f781cf9251045be575d bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 85.118.196.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://85.118.196.6/
Cookie: BIGipServer~lb_public_wf_wp_app_services~prod_pool_25080_heid_telenor_bg=rd13o00000000000000000000ffffc0a8970bo25080
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Mon, 04 Dec 2023 22:18:00 GMT
Server: Apache
Content-Length: 209
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|