| r10.o.lencr.org/ |  23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash5c35a3180482afadf4e89f4cc249fa7b 8a088c184606fe3e4e0da8cd90b6eb5e6d30fb97 146fe131cf8436e3de4832a23b351400b4819dbd9b9716302248d3ab447f000c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "146FE131CF8436E3DE4832A23B351400B4819DBD9B9716302248D3AB447F000C"
Last-Modified: Sat, 15 Jun 2024 13:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17885
Expires: Mon, 17 Jun 2024 04:16:00 GMT
Date: Sun, 16 Jun 2024 23:17:55 GMT
Connection: keep-alive
|
|
| akhwbjyshezaxck.buzz/static/js/foundation-1.5.3.min.js |  188.114.96.1 | 200 OK | 3.3 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/js/foundation-1.5.3.min.js IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typegzip compressed data, from Unix Hash186195d6459f9108c2fc067579cbb67b be76f4f31caee046651bcf4ceb832e71398bfbf5 1f1c34a0370ab34cde302f2486982debb9f5fae577ec4e00e15ef8a7431dabee
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/foundation-1.5.3.min.js HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: application/javascript
last-modified: Thu, 14 Mar 2024 10:18:26 GMT
vary: Accept-Encoding
etag: W/"65f2cef2-7bb"
access-control-allow-origin: *
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: HIT
age: 624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETl%2Fs8oo84aB6B46NQfEJ%2FxFyqfHZUVg%2BaFYDHkI9bscLibxKPxD7xJxNf%2FKqUU%2Fqa%2FL%2BlyhuxWhKiNPxK6yy8rwxf9skWNZ%2B7pscR7mBoBLycam6N61J54vIJ9hkBnHZlFsOsN8DA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8429280c56a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| bjqug.xyz/img/js3960x80.gif |  172.67.160.237 | 200 OK | 791 kB |
URL GET HTTP/3bjqug.xyz/img/js3960x80.gif IP172.67.160.237:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerCloudflare, Inc. Subjectbjqug.xyz Fingerprint07:6D:66:4C:E1:35:70:F0:99:9B:37:6F:66:14:B7:47:3C:8C:BA:AD ValidityWed, 21 Feb 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT
File typeGIF image data, version 89a, 960 x 80 Size791 kB (790871 bytes) Hashb633258f260703d31a52c872a0d6c761 c69390420e7e29b27dcd779e9fe024ef68749beb 9f7fb2bcc8a152506965588375928b62179887b45fd3dc4aad53f10d9ed88918
GET /img/js3960x80.gif HTTP/1.1
Host: bjqug.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: image/gif
content-length: 790871
last-modified: Wed, 28 Dec 2022 12:09:20 GMT
etag: "63ac31f0-c1157"
expires: Sun, 14 Jul 2024 13:32:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 207901
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zcoSPAFbSHgOQdDMajFXEmna4C19%2BZoY%2FTPO%2Bf%2BnzTSFAUOJlmtOWlmrWbY5xi4gvo%2B7Z88rnKbpQe6uj9ZitBNk53s4RR5MbkNiQWsnaFHn1VOV%2F5y4wBPHBJA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e842afad75696-OSL
alt-svc: h3=":443"; ma=86400
|
|
| bjqug.xyz/img/wnsr960x803.gif | 172.67.160.237 | 200 OK | 369 kB |
URL GET HTTP/3bjqug.xyz/img/wnsr960x803.gif IP172.67.160.237:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerCloudflare, Inc. Subjectbjqug.xyz Fingerprint07:6D:66:4C:E1:35:70:F0:99:9B:37:6F:66:14:B7:47:3C:8C:BA:AD ValidityWed, 21 Feb 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT
File typeGIF image data, version 89a, 960 x 80 Size369 kB (369414 bytes) Hashe9e75ef3578e3d129ecc03992504f6ea 9ab1c878e3d73621f3e8930deede26c722320437 c0e911b492e5b9cef6787ea62d91f60072cf6db0ed84b246e1821dbf6fe3238d
GET /img/wnsr960x803.gif HTTP/1.1
Host: bjqug.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: image/gif
content-length: 369414
last-modified: Wed, 28 Dec 2022 12:09:17 GMT
etag: "63ac31ed-5a306"
expires: Sat, 13 Jul 2024 14:25:15 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 291162
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=liQ4FKuqgI4IDQCUmWirzxEZgFOZ3RtzqaT2MqespZvsAKgPU9p4x5CchA%2FPEapNzMIoiC%2BoR2sI0GNvU3Nb72VYpP3pesSCgIzh6rDz%2BAmPPJzqkSIaLDwEQwA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e842afad85696-OSL
alt-svc: h3=":443"; ma=86400
|
|
| bjqug.xyz/img/xpj3960x80.gif | 172.67.160.237 | 200 OK | 64 kB |
URL GET HTTP/3bjqug.xyz/img/xpj3960x80.gif IP172.67.160.237:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerCloudflare, Inc. Subjectbjqug.xyz Fingerprint07:6D:66:4C:E1:35:70:F0:99:9B:37:6F:66:14:B7:47:3C:8C:BA:AD ValidityWed, 21 Feb 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT
File typeGIF image data, version 89a, 960 x 80 Hashe7a5980477484771337359108a7d58f2 d8a81935ae7fc70b38175ac7b84412d6ccab03c1 f32bc469670e00531379916baa0dbab9f261456132e0d93607e18c4ec65f0590
GET /img/xpj3960x80.gif HTTP/1.1
Host: bjqug.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: image/gif
content-length: 63698
last-modified: Wed, 28 Dec 2022 12:09:18 GMT
etag: "63ac31ee-f8d2"
expires: Sat, 13 Jul 2024 14:25:15 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 291162
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7vPFQO63N4hrno63ZAXZJQ5lOYafJDXAXMrW1gtcwBmJRnWPoI2MMSh1lBByvvf5027BioW2gIcVuBECGW0Z%2BT%2FI2ewjs%2BbueCQ88p6MVnt0mK%2FnklAQaskBsiM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e842afada5696-OSL
alt-svc: h3=":443"; ma=86400
|
|
| bjqug.xyz/img/tyc960x803.gif | 172.67.160.237 | 200 OK | 460 kB |
URL GET HTTP/3bjqug.xyz/img/tyc960x803.gif IP172.67.160.237:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerCloudflare, Inc. Subjectbjqug.xyz Fingerprint07:6D:66:4C:E1:35:70:F0:99:9B:37:6F:66:14:B7:47:3C:8C:BA:AD ValidityWed, 21 Feb 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT
File typeGIF image data, version 89a, 960 x 80 Size460 kB (459926 bytes) Hash6d6d9238a84b0e7b97fc17dfe8a8649e 21f3576af89a5f782f9e7d0831c8565aa1037884 edb4f57856d11d24a08338bb8c37b6a164c0268d71f547e2050af0f7a45352d0
GET /img/tyc960x803.gif HTTP/1.1
Host: bjqug.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: image/gif
content-length: 459926
last-modified: Wed, 28 Dec 2022 12:09:16 GMT
etag: "63ac31ec-70496"
expires: Sat, 13 Jul 2024 14:25:17 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 291160
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PX9KZLzFegrXb%2BSPrgp1TIpapOSen7O0NLb7hVmfNybEwdy4%2BMbqWawAKx8176dZiFSJ9kaKaCV70Kj7sDpStARfvUcDnZuzHX6G6UUjR3VQBaYoDirZpvwhrGY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e842afadb5696-OSL
alt-svc: h3=":443"; ma=86400
|
|
| fmtu.sltusl.com/upload/vod/20220903-4/06878c02424c1daa8048e51d8600c23f.jpg | 156.238.194.98 | 403 Forbidden | 1 B |
URL GET HTTP/1.1fmtu.sltusl.com/upload/vod/20220903-4/06878c02424c1daa8048e51d8600c23f.jpg IP156.238.194.98:443 ASN#50183 CenturyNetworks Ltd
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerUnizeto Technologies S.A. Subjectfmtu.sltusl.com Fingerprint0C:9D:33:0C:67:64:A0:4F:00:84:3D:09:9F:90:A8:2B:20:6B:AB:0A ValiditySun, 31 Dec 2023 04:59:55 GMT - Wed, 29 Jan 2025 04:59:54 GMT
File typevery short file (no magic) Hash7215ee9c7d9dc229d2921a40e899ec5f b858cb282617fb0956d960215c8e84d1ccf909c6 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
GET /upload/vod/20220903-4/06878c02424c1daa8048e51d8600c23f.jpg HTTP/1.1
Host: fmtu.sltusl.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: openresty
Date: Sun, 16 Jun 2024 23:17:58 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 1
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2"
Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11755
Expires: Mon, 17 Jun 2024 02:33:53 GMT
Date: Sun, 16 Jun 2024 23:17:58 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2"
Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11755
Expires: Mon, 17 Jun 2024 02:33:53 GMT
Date: Sun, 16 Jun 2024 23:17:58 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2"
Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11755
Expires: Mon, 17 Jun 2024 02:33:53 GMT
Date: Sun, 16 Jun 2024 23:17:58 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2"
Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11755
Expires: Mon, 17 Jun 2024 02:33:53 GMT
Date: Sun, 16 Jun 2024 23:17:58 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2"
Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11755
Expires: Mon, 17 Jun 2024 02:33:53 GMT
Date: Sun, 16 Jun 2024 23:17:58 GMT
Connection: keep-alive
|
|
| akhwbjyshezaxck.buzz/info/id/1090082.html | 188.114.96.1 | 200 OK | 17 kB |
URL User Request GET HTTP/2akhwbjyshezaxck.buzz/info/id/1090082.html IP188.114.96.1:443
CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typeHTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators Hashb1268c387d2c0e42dcf639739c4478ee a9fcd00fe6c395ec766cfb766da70b5b17abba88 276efa49de7de0d998d8dce76d2b5e8f26861af395194142498876e51646be65
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /info/id/1090082.html HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 16 Jun 2024 23:17:56 GMT
content-type: text/html;charset=UTF-8
vary: Accept-Encoding
content-language: en-US
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJCAzkQfZTA%2FvksST%2FqPiZqUH6IszZJ50DR4iDXprO7gJjK5xrG%2B7YrG3Gl5Q6wIyiROghMLZh2Rm0OfRyBap06kjAPg4ymm1O01b22OxWed%2BXO8cHfFmt%2FU5n%2BHRnTyr6BUoyHtPA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8422c9ba56ba-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| akhwbjyshezaxck.buzz/static/template/011/css/stui_default.css | 188.114.96.1 | 200 OK | 8.3 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/template/011/css/stui_default.css IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typegzip compressed data, from Unix Hash9948e20c387460628b54ae1358914d88 ab57934e55d0c6673bbf67380fbce43d8095bd06 d0c901dcf1df145d6014ab14fa7ac496c9c30acd4de45437b0dd249ab1a08464
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/template/011/css/stui_default.css HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: text/css
last-modified: Fri, 02 Sep 2022 08:55:11 GMT
vary: Accept-Encoding
etag: W/"6311c4ef-21df"
access-control-allow-origin: *
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: HIT
age: 624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xiJgv1foUT2DrLk9dVqKHj1SRdn1XvZ4ogwYJ4Hp7Gt0IKqYrWIqzw0Bx%2BPL1cBpXENcbSeYqLu3R6i7BV7brcJypU9iyTOozUOHAep%2FFJ3x%2F7XaMMHyQJu67np9MZCKLeYNaP0luQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8429180656a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/static/template/011/css/stui_block.css | 188.114.96.1 | 200 OK | 18 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/template/011/css/stui_block.css IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typegzip compressed data, from Unix Hash0200764ace805e0feec4df5b3c6f4fa9 f7d58be072fa75b6b362d8a120c03115b656185c e87025168d9fe582c3d452cf6d2354f84a4bac654c2bb7e9d0791378d507ee88
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/template/011/css/stui_block.css HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: text/css
last-modified: Fri, 02 Sep 2022 08:55:11 GMT
vary: Accept-Encoding
etag: W/"6311c4ef-8293"
access-control-allow-origin: *
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: HIT
age: 625
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0RXjfHOy7%2BR9fvmqPCamkvYLOafRzWfRCMqXrPncJHB%2FUZYXQPPLkO4ljAvOntd7zBbqkal%2BlJdRCQcRyxmnT%2B5aILPttIl6G7Wn%2FriH%2FDkHAtMCbWNWTsswmYiaUj0bezcoh0Q8zA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8429180156a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| ssd.zmneysz.com:7891/stats/8043/5942?ukey=d261fd4807489b7626510669355afe19&host=akhwbjyshezaxck.buzz |  45.117.11.97 | 200 OK | 0 B |
URL POST HTTP/1.1ssd.zmneysz.com:7891/stats/8043/5942?ukey=d261fd4807489b7626510669355afe19&host=akhwbjyshezaxck.buzz IP45.117.11.97:7891 ASN#137697 CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerSectigo Limited Subjectssd.zmneysz.com FingerprintAE:A0:1B:52:51:6D:13:18:DC:06:C4:2F:7F:8C:BB:B8:9A:00:3B:1C ValidityMon, 04 Dec 2023 00:00:00 GMT - Fri, 03 Jan 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /stats/8043/5942?ukey=d261fd4807489b7626510669355afe19&host=akhwbjyshezaxck.buzz HTTP/1.1
Host: ssd.zmneysz.com:7891
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://akhwbjyshezaxck.buzz
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 16 Jun 2024 23:17:58 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=0, no-cache
Pragma: no-cache
Set-Cookie: ukey=d261fd4807489b7626510669355afe19; Path=/; Domain=ssd.zmneysz.com; Max-Age=5184000; HttpOnly; Secure; SameSite=None
|
|
| ssd.zmneysz.com:7891/stats/8043/5944?ukey=d261fd4807489b7626510669355afe19&host=akhwbjyshezaxck.buzz | 45.117.11.97 | 200 OK | 0 B |
URL POST HTTP/1.1ssd.zmneysz.com:7891/stats/8043/5944?ukey=d261fd4807489b7626510669355afe19&host=akhwbjyshezaxck.buzz IP45.117.11.97:7891 ASN#137697 CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerSectigo Limited Subjectssd.zmneysz.com FingerprintAE:A0:1B:52:51:6D:13:18:DC:06:C4:2F:7F:8C:BB:B8:9A:00:3B:1C ValidityMon, 04 Dec 2023 00:00:00 GMT - Fri, 03 Jan 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /stats/8043/5944?ukey=d261fd4807489b7626510669355afe19&host=akhwbjyshezaxck.buzz HTTP/1.1
Host: ssd.zmneysz.com:7891
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://akhwbjyshezaxck.buzz
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 16 Jun 2024 23:17:58 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=0, no-cache
Pragma: no-cache
Set-Cookie: ukey=d261fd4807489b7626510669355afe19; Path=/; Domain=ssd.zmneysz.com; Max-Age=5184000; HttpOnly; Secure; SameSite=None
|
|
| ocsp.trust-provider.cn/ | 112.50.95.196 | | 599 B |
IP112.50.95.196:0 ASN#9808 China Mobile Communications Group Co., Ltd.
Hash30d95169843d6ca6c8d92fd997cdbb6a b0894116847cab28f63a44ccfeb092f82df5ebfd c6e6054a6153b81b1d78534aa350e817ce9fad212af1a93f96e04f75289f9d6c
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
cf-ray: 893fb263de3085cd-HKG
last-modified: Sat, 15 Jun 2024 02:43:00 GMT
ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca58, HIT from cq-yuzhong1-ca34
cache-control: max-age=3600
date: Sun, 16 Jun 2024 23:17:59 GMT
vary: Accept-Encoding
cf-cache-status: HIT
expires: Sat, 22 Jun 2024 02:42:59 GMT
age: 3192
request-id: 3b3e666f72a7ca629a7d1858ef1db358
x-ccacdn-proxy-id: scdpinlb6
x-frame-options: SAMEORIGIN
etag: "b0894116847cab28f63a44ccfeb092f82df5ebfd"
accept-ranges: bytes
via: n172-013-216.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17185798798c8b12093fd806ae0d64ad36ab6f9f42
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=34, edge;dur=0
|
|
| ocsp.trust-provider.cn/ | 112.50.95.196 | | 599 B |
IP112.50.95.196:0 ASN#9808 China Mobile Communications Group Co., Ltd.
Hash30d95169843d6ca6c8d92fd997cdbb6a b0894116847cab28f63a44ccfeb092f82df5ebfd c6e6054a6153b81b1d78534aa350e817ce9fad212af1a93f96e04f75289f9d6c
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
x-ccacdn-proxy-id: scdpinlb6
cf-ray: 893faf006d7c5de9-HKG
request-id: 98e1666f72a73da0bc2666660b9fabc6
age: 734
vary: Accept-Encoding
cf-cache-status: EXPIRED
etag: "b0894116847cab28f63a44ccfeb092f82df5ebfd"
date: Sun, 16 Jun 2024 23:17:59 GMT
expires: Sat, 22 Jun 2024 02:42:59 GMT
x-frame-options: SAMEORIGIN
cache-control: max-age=3600
accept-ranges: bytes
last-modified: Sat, 15 Jun 2024 02:43:00 GMT
ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca58, HIT from js-nanjing1-ca35
via: n172-013-213.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 1718579879a317d90fd96dbbc653cbc0f5879a56a2
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=33, edge;dur=0
|
|
| ocsp.trust-provider.cn/ | 112.50.95.196 | | 599 B |
IP112.50.95.196:0 ASN#9808 China Mobile Communications Group Co., Ltd.
Hash30d95169843d6ca6c8d92fd997cdbb6a b0894116847cab28f63a44ccfeb092f82df5ebfd c6e6054a6153b81b1d78534aa350e817ce9fad212af1a93f96e04f75289f9d6c
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
Date: Sun, 16 Jun 2024 23:17:59 GMT
Last-Modified: Sat, 15 Jun 2024 02:43:00 GMT
Expires: Sat, 22 Jun 2024 02:42:59 GMT
Etag: "b0894116847cab28f63a44ccfeb092f82df5ebfd"
Cache-Control: max-age=3600
X-CCACDN-Proxy-ID: scdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
CF-RAY: 894e8433cec10449-HKG
Age: 2
Ctl-Cache-Status: MISS from hk-xianggang4-ca01, MISS from fj-quanzhou7-ca52, MISS from he-baoding2-ca04
Request-Id: a945666f72a6dede21d7124721bc0e4a
via: n172-013-215.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 1718579878d146c5771d25ba0d1f15c646c09ccf16
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=359, edge;dur=0
|
|
| ocsp.trust-provider.cn/ | 112.50.95.196 | | 599 B |
IP112.50.95.196:0 ASN#9808 China Mobile Communications Group Co., Ltd.
Hash30d95169843d6ca6c8d92fd997cdbb6a b0894116847cab28f63a44ccfeb092f82df5ebfd c6e6054a6153b81b1d78534aa350e817ce9fad212af1a93f96e04f75289f9d6c
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca58, HIT from cq-yuzhong1-ca34
cache-control: max-age=3600
date: Sun, 16 Jun 2024 23:17:59 GMT
request-id: 3b3e666f72a7ca624db1c3ae38c56e9d
last-modified: Sat, 15 Jun 2024 02:43:00 GMT
x-ccacdn-proxy-id: scdpinlb6
cf-ray: 893fb263de3085cd-HKG
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
etag: "b0894116847cab28f63a44ccfeb092f82df5ebfd"
cf-cache-status: HIT
accept-ranges: bytes
age: 3192
expires: Sat, 22 Jun 2024 02:42:59 GMT
via: n172-013-214.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17185798793abb73fab323a19770f80f77a598c94f
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=40, edge;dur=0
|
|
| kou.qingaizaiyuan.cn:8891/vj3/5942 | 45.117.11.97 | 403 Forbidden | 146 B |
URL GET HTTP/1.1kou.qingaizaiyuan.cn:8891/vj3/5942 IP45.117.11.97:8891 ASN#137697 CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerTrustAsia Technologies, Inc. Subjectkou.qingaizaiyuan.cn Fingerprint25:50:AA:F0:61:AB:D9:0D:4D:92:12:44:0F:8F:CC:43:1E:68:16:04 ValidityThu, 13 Jun 2024 00:00:00 GMT - Wed, 11 Sep 2024 23:59:59 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash9fe3cb2b7313dc79bb477bc8fde184a7 4d7b3cb41e90618358d0ee066c45c76227a13747 32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
GET /vj3/5942 HTTP/1.1
Host: kou.qingaizaiyuan.cn:8891
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: nginx
Date: Sun, 16 Jun 2024 23:17:58 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
|
|
| 555bbb666www.com/e0a0b73242f44dbf80d69876cd199de9.gif | 104.160.179.195 | 200 OK | 276 kB |
URL GET HTTP/2555bbb666www.com/e0a0b73242f44dbf80d69876cd199de9.gif IP104.160.179.195:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subject333bbb666www.com Fingerprint73:17:30:3F:E3:60:08:6A:F8:EC:02:AC:79:B9:8D:93:75:E1:9E:58 ValidityTue, 04 Jun 2024 11:19:13 GMT - Mon, 02 Sep 2024 11:19:12 GMT
File typeGIF image data, version 89a, 960 x 120 Size276 kB (275557 bytes) Hash11860f404faba7f60bb234c85667399a 4fe02c13af45dd4cabbb1a382ad822b0552cbf02 da719a94a6242190011b6b84f65cb5ddd9a7c378a3769a0fa1579816f806656d
GET /e0a0b73242f44dbf80d69876cd199de9.gif HTTP/1.1
Host: 555bbb666www.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 16 Jun 2024 23:17:58 GMT
content-type: image/gif
content-length: 275557
last-modified: Tue, 30 Apr 2024 08:55:04 GMT
etag: "6630b1e8-43465"
platform: polestarcloud.com
cl-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| kou.qingaizaiyuan.cn:8891/vj3/5944 | 45.117.11.97 | 403 Forbidden | 146 B |
URL GET HTTP/1.1kou.qingaizaiyuan.cn:8891/vj3/5944 IP45.117.11.97:8891 ASN#137697 CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerTrustAsia Technologies, Inc. Subjectkou.qingaizaiyuan.cn Fingerprint25:50:AA:F0:61:AB:D9:0D:4D:92:12:44:0F:8F:CC:43:1E:68:16:04 ValidityThu, 13 Jun 2024 00:00:00 GMT - Wed, 11 Sep 2024 23:59:59 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash9fe3cb2b7313dc79bb477bc8fde184a7 4d7b3cb41e90618358d0ee066c45c76227a13747 32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
GET /vj3/5944 HTTP/1.1
Host: kou.qingaizaiyuan.cn:8891
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: nginx
Date: Sun, 16 Jun 2024 23:17:58 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
|
|
| akhwbjyshezaxck.buzz/static/template/011/favicon.ico | 188.114.96.1 | 404 Not Found | 95 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/template/011/favicon.ico IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/template/011/favicon.ico HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Sun, 16 Jun 2024 23:17:59 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xU0ZO1YEAfZp6QIw4mr0IkNpdrOxmgyrFzbbsFM5RtZULMEpew3qkoPPeGHgNXB32b4%2B845p63UUqc5qBfpjQipEKnhqw7Xursf6Cwl61hk1DnT7KWqj2oKMeiRf0QN3KGvSNmDiaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e84316d9056a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/ping?p=0.9045598331080741 | 188.114.96.1 | 200 OK | 0 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/ping?p=0.9045598331080741 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ping?p=0.9045598331080741 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:18:02 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
accept-charset: big5, big5-hkscs, cesu-8, euc-jp, euc-kr, gb18030, gb2312, gbk, ibm-thai, ibm00858, ibm01140, ibm01141, ibm01142, ibm01143, ibm01144, ibm01145, ibm01146, ibm01147, ibm01148, ibm01149, ibm037, ibm1026, ibm1047, ibm273, ibm277, ibm278, ibm280, ibm284, ibm285, ibm290, ibm297, ibm420, ibm424, ibm437, ibm500, ibm775, ibm850, ibm852, ibm855, ibm857, ibm860, ibm861, ibm862, ibm863, ibm864, ibm865, ibm866, ibm868, ibm869, ibm870, ibm871, ibm918, iso-2022-cn, iso-2022-jp, iso-2022-jp-2, iso-2022-kr, iso-8859-1, iso-8859-13, iso-8859-15, iso-8859-2, iso-8859-3, iso-8859-4, iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8, iso-8859-9, jis_x0201, jis_x0212-1990, koi8-r, koi8-u, shift_jis, tis-620, us-ascii, utf-16, utf-16be, utf-16le, utf-32, utf-32be, utf-32le, utf-8, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258, windows-31j, x-big5-hkscs-2001, x-big5-solaris, x-compound_text, x-euc-jp-linux, x-euc-tw, x-eucjp-open, x-ibm1006, x-ibm1025, x-ibm1046, x-ibm1097, x-ibm1098, x-ibm1112, x-ibm1122, x-ibm1123, x-ibm1124, x-ibm1166, x-ibm1364, x-ibm1381, x-ibm1383, x-ibm300, x-ibm33722, x-ibm737, x-ibm833, x-ibm834, x-ibm856, x-ibm874, x-ibm875, x-ibm921, x-ibm922, x-ibm930, x-ibm933, x-ibm935, x-ibm937, x-ibm939, x-ibm942, x-ibm942c, x-ibm943, x-ibm943c, x-ibm948, x-ibm949, x-ibm949c, x-ibm950, x-ibm964, x-ibm970, x-iscii91, x-iso-2022-cn-cns, x-iso-2022-cn-gb, x-iso-8859-11, x-jis0208, x-jisautodetect, x-johab, x-macarabic, x-maccentraleurope, x-maccroatian, x-maccyrillic, x-macdingbat, x-macgreek, x-machebrew, x-maciceland, x-macroman, x-macromania, x-macsymbol, x-macthai, x-macturkish, x-macukraine, x-ms932_0213, x-ms950-hkscs, x-ms950-hkscs-xp, x-mswin-936, x-pck, x-sjis_0213, x-utf-16le-bom, x-utf-32be-bom, x-utf-32le-bom, x-windows-50220, x-windows-50221, x-windows-874, x-windows-949, x-windows-950, x-windows-iso2022jp
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9VLFMVvwoawwI%2BTM9lu22Fjhg%2BrHum63YZeraqyd7aDV0FYDP%2Bfav6wrjJ%2FCr5AQmZfHjGVMiQ1dD73W7US23mA4ozL2gmvHzUkAnSf5Wjtug%2B8%2FiMK0%2F3ytRQGGAVLhvmyy2l6ukw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e84465b8256a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/ping?p=0.45491492291527846 | 188.114.96.1 | 200 OK | 0 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/ping?p=0.45491492291527846 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ping?p=0.45491492291527846 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:18:05 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
accept-charset: big5, big5-hkscs, cesu-8, euc-jp, euc-kr, gb18030, gb2312, gbk, ibm-thai, ibm00858, ibm01140, ibm01141, ibm01142, ibm01143, ibm01144, ibm01145, ibm01146, ibm01147, ibm01148, ibm01149, ibm037, ibm1026, ibm1047, ibm273, ibm277, ibm278, ibm280, ibm284, ibm285, ibm290, ibm297, ibm420, ibm424, ibm437, ibm500, ibm775, ibm850, ibm852, ibm855, ibm857, ibm860, ibm861, ibm862, ibm863, ibm864, ibm865, ibm866, ibm868, ibm869, ibm870, ibm871, ibm918, iso-2022-cn, iso-2022-jp, iso-2022-jp-2, iso-2022-kr, iso-8859-1, iso-8859-13, iso-8859-15, iso-8859-2, iso-8859-3, iso-8859-4, iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8, iso-8859-9, jis_x0201, jis_x0212-1990, koi8-r, koi8-u, shift_jis, tis-620, us-ascii, utf-16, utf-16be, utf-16le, utf-32, utf-32be, utf-32le, utf-8, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258, windows-31j, x-big5-hkscs-2001, x-big5-solaris, x-compound_text, x-euc-jp-linux, x-euc-tw, x-eucjp-open, x-ibm1006, x-ibm1025, x-ibm1046, x-ibm1097, x-ibm1098, x-ibm1112, x-ibm1122, x-ibm1123, x-ibm1124, x-ibm1166, x-ibm1364, x-ibm1381, x-ibm1383, x-ibm300, x-ibm33722, x-ibm737, x-ibm833, x-ibm834, x-ibm856, x-ibm874, x-ibm875, x-ibm921, x-ibm922, x-ibm930, x-ibm933, x-ibm935, x-ibm937, x-ibm939, x-ibm942, x-ibm942c, x-ibm943, x-ibm943c, x-ibm948, x-ibm949, x-ibm949c, x-ibm950, x-ibm964, x-ibm970, x-iscii91, x-iso-2022-cn-cns, x-iso-2022-cn-gb, x-iso-8859-11, x-jis0208, x-jisautodetect, x-johab, x-macarabic, x-maccentraleurope, x-maccroatian, x-maccyrillic, x-macdingbat, x-macgreek, x-machebrew, x-maciceland, x-macroman, x-macromania, x-macsymbol, x-macthai, x-macturkish, x-macukraine, x-ms932_0213, x-ms950-hkscs, x-ms950-hkscs-xp, x-mswin-936, x-pck, x-sjis_0213, x-utf-16le-bom, x-utf-32be-bom, x-utf-32le-bom, x-windows-50220, x-windows-50221, x-windows-874, x-windows-949, x-windows-950, x-windows-iso2022jp
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oqkasRTTw04isX%2BVjjB1dtBUOsQS32vE%2FO8%2FbHieWzoxXtHPyGsa%2FBDEA4y3LxMe8HLvV8%2BGVaoBgFZBlYYXrT10J0mTezxVylNrWOAAmnTiHxjC9TOgl79VM8xmgotPU8TWDvSoWg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e845ae88756a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/ping?p=0.21056200290415328 | 188.114.96.1 | 200 OK | 0 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/ping?p=0.21056200290415328 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ping?p=0.21056200290415328 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:18:08 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
accept-charset: big5, big5-hkscs, cesu-8, euc-jp, euc-kr, gb18030, gb2312, gbk, ibm-thai, ibm00858, ibm01140, ibm01141, ibm01142, ibm01143, ibm01144, ibm01145, ibm01146, ibm01147, ibm01148, ibm01149, ibm037, ibm1026, ibm1047, ibm273, ibm277, ibm278, ibm280, ibm284, ibm285, ibm290, ibm297, ibm420, ibm424, ibm437, ibm500, ibm775, ibm850, ibm852, ibm855, ibm857, ibm860, ibm861, ibm862, ibm863, ibm864, ibm865, ibm866, ibm868, ibm869, ibm870, ibm871, ibm918, iso-2022-cn, iso-2022-jp, iso-2022-jp-2, iso-2022-kr, iso-8859-1, iso-8859-13, iso-8859-15, iso-8859-2, iso-8859-3, iso-8859-4, iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8, iso-8859-9, jis_x0201, jis_x0212-1990, koi8-r, koi8-u, shift_jis, tis-620, us-ascii, utf-16, utf-16be, utf-16le, utf-32, utf-32be, utf-32le, utf-8, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258, windows-31j, x-big5-hkscs-2001, x-big5-solaris, x-compound_text, x-euc-jp-linux, x-euc-tw, x-eucjp-open, x-ibm1006, x-ibm1025, x-ibm1046, x-ibm1097, x-ibm1098, x-ibm1112, x-ibm1122, x-ibm1123, x-ibm1124, x-ibm1166, x-ibm1364, x-ibm1381, x-ibm1383, x-ibm300, x-ibm33722, x-ibm737, x-ibm833, x-ibm834, x-ibm856, x-ibm874, x-ibm875, x-ibm921, x-ibm922, x-ibm930, x-ibm933, x-ibm935, x-ibm937, x-ibm939, x-ibm942, x-ibm942c, x-ibm943, x-ibm943c, x-ibm948, x-ibm949, x-ibm949c, x-ibm950, x-ibm964, x-ibm970, x-iscii91, x-iso-2022-cn-cns, x-iso-2022-cn-gb, x-iso-8859-11, x-jis0208, x-jisautodetect, x-johab, x-macarabic, x-maccentraleurope, x-maccroatian, x-maccyrillic, x-macdingbat, x-macgreek, x-machebrew, x-maciceland, x-macroman, x-macromania, x-macsymbol, x-macthai, x-macturkish, x-macukraine, x-ms932_0213, x-ms950-hkscs, x-ms950-hkscs-xp, x-mswin-936, x-pck, x-sjis_0213, x-utf-16le-bom, x-utf-32be-bom, x-utf-32le-bom, x-windows-50220, x-windows-50221, x-windows-874, x-windows-949, x-windows-950, x-windows-iso2022jp
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MyFYf9IpUFAzOeqfVJpA3Y4ZmjkntdDeyXvyRfO9RUrWqzbobdzmhj7c8l0oyfxL8MAifmJQ6%2Bkw9AbhiX6y7iQ5sIaLc0hH5XpQt%2FpmqNxmQW7S5%2Bt4iXKCohRktZacE2jAWcP7mA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e84702fb556a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/ping?p=0.6502815253318386 | 188.114.96.1 | 200 OK | 0 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/ping?p=0.6502815253318386 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ping?p=0.6502815253318386 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:18:12 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
accept-charset: big5, big5-hkscs, cesu-8, euc-jp, euc-kr, gb18030, gb2312, gbk, ibm-thai, ibm00858, ibm01140, ibm01141, ibm01142, ibm01143, ibm01144, ibm01145, ibm01146, ibm01147, ibm01148, ibm01149, ibm037, ibm1026, ibm1047, ibm273, ibm277, ibm278, ibm280, ibm284, ibm285, ibm290, ibm297, ibm420, ibm424, ibm437, ibm500, ibm775, ibm850, ibm852, ibm855, ibm857, ibm860, ibm861, ibm862, ibm863, ibm864, ibm865, ibm866, ibm868, ibm869, ibm870, ibm871, ibm918, iso-2022-cn, iso-2022-jp, iso-2022-jp-2, iso-2022-kr, iso-8859-1, iso-8859-13, iso-8859-15, iso-8859-2, iso-8859-3, iso-8859-4, iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8, iso-8859-9, jis_x0201, jis_x0212-1990, koi8-r, koi8-u, shift_jis, tis-620, us-ascii, utf-16, utf-16be, utf-16le, utf-32, utf-32be, utf-32le, utf-8, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258, windows-31j, x-big5-hkscs-2001, x-big5-solaris, x-compound_text, x-euc-jp-linux, x-euc-tw, x-eucjp-open, x-ibm1006, x-ibm1025, x-ibm1046, x-ibm1097, x-ibm1098, x-ibm1112, x-ibm1122, x-ibm1123, x-ibm1124, x-ibm1166, x-ibm1364, x-ibm1381, x-ibm1383, x-ibm300, x-ibm33722, x-ibm737, x-ibm833, x-ibm834, x-ibm856, x-ibm874, x-ibm875, x-ibm921, x-ibm922, x-ibm930, x-ibm933, x-ibm935, x-ibm937, x-ibm939, x-ibm942, x-ibm942c, x-ibm943, x-ibm943c, x-ibm948, x-ibm949, x-ibm949c, x-ibm950, x-ibm964, x-ibm970, x-iscii91, x-iso-2022-cn-cns, x-iso-2022-cn-gb, x-iso-8859-11, x-jis0208, x-jisautodetect, x-johab, x-macarabic, x-maccentraleurope, x-maccroatian, x-maccyrillic, x-macdingbat, x-macgreek, x-machebrew, x-maciceland, x-macroman, x-macromania, x-macsymbol, x-macthai, x-macturkish, x-macukraine, x-ms932_0213, x-ms950-hkscs, x-ms950-hkscs-xp, x-mswin-936, x-pck, x-sjis_0213, x-utf-16le-bom, x-utf-32be-bom, x-utf-32le-bom, x-windows-50220, x-windows-50221, x-windows-874, x-windows-949, x-windows-950, x-windows-iso2022jp
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CFZ%2FitMspej4W3GuLpDnithGegofMIurg%2F4K6Ivm%2B%2Bo8tRfsCDTjkaTZa%2B9UB0JycwW1Ys6lsMCjJB%2FcnTtzqvwzILi%2Bj81SYeeWpmtv4RR7J0F3WDyORk0FerE9tawbI%2BzF8zrXJg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e84889f1356a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/ping?p=0.16863796943848108 | 188.114.96.1 | 200 OK | 0 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/ping?p=0.16863796943848108 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ping?p=0.16863796943848108 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:18:15 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
accept-charset: big5, big5-hkscs, cesu-8, euc-jp, euc-kr, gb18030, gb2312, gbk, ibm-thai, ibm00858, ibm01140, ibm01141, ibm01142, ibm01143, ibm01144, ibm01145, ibm01146, ibm01147, ibm01148, ibm01149, ibm037, ibm1026, ibm1047, ibm273, ibm277, ibm278, ibm280, ibm284, ibm285, ibm290, ibm297, ibm420, ibm424, ibm437, ibm500, ibm775, ibm850, ibm852, ibm855, ibm857, ibm860, ibm861, ibm862, ibm863, ibm864, ibm865, ibm866, ibm868, ibm869, ibm870, ibm871, ibm918, iso-2022-cn, iso-2022-jp, iso-2022-jp-2, iso-2022-kr, iso-8859-1, iso-8859-13, iso-8859-15, iso-8859-2, iso-8859-3, iso-8859-4, iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8, iso-8859-9, jis_x0201, jis_x0212-1990, koi8-r, koi8-u, shift_jis, tis-620, us-ascii, utf-16, utf-16be, utf-16le, utf-32, utf-32be, utf-32le, utf-8, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258, windows-31j, x-big5-hkscs-2001, x-big5-solaris, x-compound_text, x-euc-jp-linux, x-euc-tw, x-eucjp-open, x-ibm1006, x-ibm1025, x-ibm1046, x-ibm1097, x-ibm1098, x-ibm1112, x-ibm1122, x-ibm1123, x-ibm1124, x-ibm1166, x-ibm1364, x-ibm1381, x-ibm1383, x-ibm300, x-ibm33722, x-ibm737, x-ibm833, x-ibm834, x-ibm856, x-ibm874, x-ibm875, x-ibm921, x-ibm922, x-ibm930, x-ibm933, x-ibm935, x-ibm937, x-ibm939, x-ibm942, x-ibm942c, x-ibm943, x-ibm943c, x-ibm948, x-ibm949, x-ibm949c, x-ibm950, x-ibm964, x-ibm970, x-iscii91, x-iso-2022-cn-cns, x-iso-2022-cn-gb, x-iso-8859-11, x-jis0208, x-jisautodetect, x-johab, x-macarabic, x-maccentraleurope, x-maccroatian, x-maccyrillic, x-macdingbat, x-macgreek, x-machebrew, x-maciceland, x-macroman, x-macromania, x-macsymbol, x-macthai, x-macturkish, x-macukraine, x-ms932_0213, x-ms950-hkscs, x-ms950-hkscs-xp, x-mswin-936, x-pck, x-sjis_0213, x-utf-16le-bom, x-utf-32be-bom, x-utf-32le-bom, x-windows-50220, x-windows-50221, x-windows-874, x-windows-949, x-windows-950, x-windows-iso2022jp
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ThUXCXVMYFwQLR3JraSkz8zgpoiB4HY544XLFGHbfRXWz32wqKQdxFaokKExvYRC6M9KSONqGoSeeSf2ThptBChAgopw3jENahGuDhqPLYRknNtwCK%2BhQy7XKoMKbdLo9fR3nTqSmA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8496af5656a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/static/template/011/css/iconfont.css | 188.114.96.1 | 200 OK | 3.3 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/template/011/css/iconfont.css IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typeASCII text, with very long lines (3667), with no line terminators Hash3c7d882d421fac31867e61afdeb2cba6 38ef3ca905f331b9437712f4c17ee4c6f36574b4 1aedf13ff79f82c2fcb980e915d296b7149f75b4792174f988cc77d2cee783f4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/template/011/css/iconfont.css HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: text/css
last-modified: Fri, 02 Sep 2022 08:55:11 GMT
vary: Accept-Encoding
etag: W/"6311c4ef-cfe"
access-control-allow-origin: *
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: HIT
age: 625
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FIp0oMZiyi1YLpfo4nk4XBGETDqW0ZBLu5AfdKxJwuMkLbKRvchnzPxTQ%2BrI9ogQc%2Bwr6bQbvPp14vgZLyEdOhCdZHAPrdF6343v0FRWyzFbE5WdxhlZWRhIdqLDWwJPVjaka4HWmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e84291fff56a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/ping?p=0.5441928134223611 | 188.114.96.1 | 200 OK | 0 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/ping?p=0.5441928134223611 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ping?p=0.5441928134223611 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:18:00 GMT
content-type: text/plain;charset=UTF-8
content-length: 0
accept-charset: big5, big5-hkscs, cesu-8, euc-jp, euc-kr, gb18030, gb2312, gbk, ibm-thai, ibm00858, ibm01140, ibm01141, ibm01142, ibm01143, ibm01144, ibm01145, ibm01146, ibm01147, ibm01148, ibm01149, ibm037, ibm1026, ibm1047, ibm273, ibm277, ibm278, ibm280, ibm284, ibm285, ibm290, ibm297, ibm420, ibm424, ibm437, ibm500, ibm775, ibm850, ibm852, ibm855, ibm857, ibm860, ibm861, ibm862, ibm863, ibm864, ibm865, ibm866, ibm868, ibm869, ibm870, ibm871, ibm918, iso-2022-cn, iso-2022-jp, iso-2022-jp-2, iso-2022-kr, iso-8859-1, iso-8859-13, iso-8859-15, iso-8859-2, iso-8859-3, iso-8859-4, iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8, iso-8859-9, jis_x0201, jis_x0212-1990, koi8-r, koi8-u, shift_jis, tis-620, us-ascii, utf-16, utf-16be, utf-16le, utf-32, utf-32be, utf-32le, utf-8, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258, windows-31j, x-big5-hkscs-2001, x-big5-solaris, x-compound_text, x-euc-jp-linux, x-euc-tw, x-eucjp-open, x-ibm1006, x-ibm1025, x-ibm1046, x-ibm1097, x-ibm1098, x-ibm1112, x-ibm1122, x-ibm1123, x-ibm1124, x-ibm1166, x-ibm1364, x-ibm1381, x-ibm1383, x-ibm300, x-ibm33722, x-ibm737, x-ibm833, x-ibm834, x-ibm856, x-ibm874, x-ibm875, x-ibm921, x-ibm922, x-ibm930, x-ibm933, x-ibm935, x-ibm937, x-ibm939, x-ibm942, x-ibm942c, x-ibm943, x-ibm943c, x-ibm948, x-ibm949, x-ibm949c, x-ibm950, x-ibm964, x-ibm970, x-iscii91, x-iso-2022-cn-cns, x-iso-2022-cn-gb, x-iso-8859-11, x-jis0208, x-jisautodetect, x-johab, x-macarabic, x-maccentraleurope, x-maccroatian, x-maccyrillic, x-macdingbat, x-macgreek, x-machebrew, x-maciceland, x-macroman, x-macromania, x-macsymbol, x-macthai, x-macturkish, x-macukraine, x-ms932_0213, x-ms950-hkscs, x-ms950-hkscs-xp, x-mswin-936, x-pck, x-sjis_0213, x-utf-16le-bom, x-utf-32be-bom, x-utf-32le-bom, x-windows-50220, x-windows-50221, x-windows-874, x-windows-949, x-windows-950, x-windows-iso2022jp
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j1WxjSGdfiE%2FAlNl%2BeveMW%2FMlCGGatUNnqzpbQ8vn170FO565aNTAWvI7l3p8sl1GXkZU89A0BOWgQyA%2BD6W0G%2F1CmMHaNGWhWPpch3%2BCuU72y2RhNacwfr%2ByTGPAGQ5sU2lc%2FUsUg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8438292e56a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/static/template/011/css/stui_block_color.css | 188.114.96.1 | 200 OK | 6.0 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/template/011/css/stui_block_color.css IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typeASCII text, with very long lines (6266), with no line terminators Hash8745f13031d306c158a377f3cddfea25 3e5dd8f08e53990974ccd8524da2f0021a03d7f3 9477118583a318448a284d9fe8997a431144015ade885d372d58a66004391b8f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/template/011/css/stui_block_color.css HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: text/css
last-modified: Fri, 02 Sep 2022 08:55:11 GMT
vary: Accept-Encoding
etag: W/"6311c4ef-176c"
access-control-allow-origin: *
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: HIT
age: 625
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G4ae87T6GArmm0OV6b%2BhSORVriU6LES3Pnk05R2AU14lXeTvH2Zo%2FufYALHf136QG1LaPegKwW18%2F1Sq97ekDBEXf%2Fm2uHDEB1A5fg6k0bgPbOMCrD%2F7r1BFttpzdtWoITg%2FWRylcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8429180256a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/static/js/foundation-1.5.5.min.js?v=2 | 188.114.96.1 | 200 OK | 437 B |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/js/foundation-1.5.5.min.js?v=2 IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typeASCII text, with very long lines (453), with no line terminators Hashca46ea013af8eba0e86f15467bbf302e f09afdf35321e3de45044ca819d22039a35bd44a a809beac43eeb69deeaf3cf8835a1335f398560d579dd642f0ef83c8bed28e66
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/foundation-1.5.5.min.js?v=2 HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: application/javascript
last-modified: Fri, 15 Mar 2024 02:30:21 GMT
etag: W/"65f3b2bd-1b5"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UfaqdOFIvkOoCwoQDx00oDeeK%2FkCNWpyQiNrmXYlvzHFjsfUUkQGBn6%2FaorPowgbM1FN6Wp%2BMc9RaUhZ0XdQziH8Mo0hoUdDgZWv%2FzXLGccuugLPE%2FMLgCrEGGloxrTeL61bYuSRQA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e8429280b56a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| alxqq.xyz/js/adlm.js |  104.21.87.141 | 200 OK | 16 kB |
IP104.21.87.141:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerGoogle Trust Services LLC Subjectalxqq.xyz FingerprintEE:1B:0D:85:D6:6E:2F:53:6A:C1:F6:04:D2:E7:37:AC:31:E6:28:BB ValiditySat, 11 May 2024 14:25:56 GMT - Fri, 09 Aug 2024 14:25:55 GMT
File typeJavaScript source, ASCII text, with very long lines (1956) Hashee595298cdf7d616351b6fc099a5c9c6 d4e10c0dff53b87fc64e763ef3dc0ae5243edeaf 9c9f1be1d2bb13c3e42361de8f203dccbf1979e6b4184602af54d788ac9c9ecf
GET /js/adlm.js HTTP/1.1
Host: alxqq.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: application/javascript
last-modified: Fri, 14 Jun 2024 01:41:42 GMT
vary: Accept-Encoding
etag: W/"666b9fd6-3f4e"
expires: Mon, 17 Jun 2024 03:39:55 GMT
cache-control: max-age=43200
content-encoding: gzip
cf-cache-status: HIT
age: 27482
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BKG5JEOVlfwX3Y7EfwivpS2vnpcDY7FxzgQVSWuDL6rUn8RMws5QHGMsqOBIfAVWLKbc%2FBG9eDuOPXteRR6gCOpUnGLqtXm7At3IOARJ%2FYVKM%2Bh8A0sDrXudm2A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8429bfe656c9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| akhwbjyshezaxck.buzz/static/js/jquery-2.2.4.min.js | 188.114.96.1 | 200 OK | 86 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/js/jquery-2.2.4.min.js IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typeJavaScript source, ASCII text, with very long lines (32065) Hash2f6b11a7e914718e0290410e85366fe9 69bb69e25ca7d5ef0935317584e6153f3fd9a88c 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/jquery-2.2.4.min.js HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://akhwbjyshezaxck.buzz/info/id/1090082.html
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: application/javascript
last-modified: Tue, 15 Nov 2022 10:20:06 GMT
vary: Accept-Encoding
etag: W/"637367d6-14e4a"
access-control-allow-origin: *
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: HIT
age: 624
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9TfBguE4p%2BXa%2FPIgdf%2F5k4l2rEHax60sgGPqZoyxtyOcya0AoTOWtNMGa69EIXEP7hjNlA%2BeASM674zZRAqAxWsn%2FDSyiP3EEByJSm4K94ik2TPbmF1kloWHcD6mkCPP%2BOLDDKyIw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e8429180956a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| akhwbjyshezaxck.buzz/static/template/011/images/play.png | 188.114.96.1 | 200 OK | 2.5 kB |
URL GET HTTP/3akhwbjyshezaxck.buzz/static/template/011/images/play.png IP188.114.96.1:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerLet's Encrypt Subjectakhwbjyshezaxck.buzz FingerprintCB:89:B8:4B:EB:CA:ED:73:FF:F8:0D:17:52:E4:FB:8C:DB:DD:0C:32 ValidityThu, 16 May 2024 14:28:06 GMT - Wed, 14 Aug 2024 14:28:05 GMT
File typePNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced Hash10a11cc31a1fe5126ae5f1e359679cbb 7d30dcc97bb4aed52948a5b040b4fa63149a405e 82b4aac50bdda11a5069442a4a6f593f4f3debbc2a4499b919d61691301c5537
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/template/011/images/play.png HTTP/1.1
Host: akhwbjyshezaxck.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/static/template/011/css/stui_block.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: image/png
content-length: 2457
last-modified: Fri, 02 Sep 2022 08:55:11 GMT
etag: "6311c4ef-999"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 623
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lm2TkJRdjQm409JHH0F9B2FA26VPtN%2FKBdxVSWEZMac%2Fei49fmuLMiNs6HcwTDGiQua7toQHpbQqx%2B%2BCAoGqhRY%2BdHRBoy5DLQLAz1vG0ydKPd%2FNh8OQHIW9%2BPRbmnqrlbVR3m6m9w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 894e8429c88256a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| bjqug.xyz/js/ad_jyshe.js | 172.67.160.237 | 200 OK | 2.9 kB |
IP172.67.160.237:443
Requested byhttps://akhwbjyshezaxck.buzz/info/id/1090082.html CertificateIssuerCloudflare, Inc. Subjectbjqug.xyz Fingerprint07:6D:66:4C:E1:35:70:F0:99:9B:37:6F:66:14:B7:47:3C:8C:BA:AD ValidityWed, 21 Feb 2024 00:00:00 GMT - Tue, 31 Dec 2024 23:59:59 GMT
File typeASCII text, with very long lines (3162), with no line terminators Hashfd05b8e60059e48c26e36261e6ddb9f3 456f401d2aaf68022cd559fb8309fc6890a62415 05135da98e2fa56032ac5161b757feac981f65be34caff0cd4809c50139b4bdb
GET /js/ad_jyshe.js HTTP/1.1
Host: bjqug.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://akhwbjyshezaxck.buzz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 16 Jun 2024 23:17:57 GMT
content-type: application/javascript
last-modified: Tue, 04 Jun 2024 01:22:12 GMT
vary: Accept-Encoding
etag: W/"665e6c44-b3d"
expires: Mon, 17 Jun 2024 00:58:22 GMT
cache-control: max-age=43200
content-encoding: gzip
cf-cache-status: HIT
age: 37174
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKMo531ADzFuYgJlPvptldoNqELj95aQc5Qzq5vu2OSfVsW5dt7%2BzP842kkhHUCLRL2b9QDiixdShBauN3CdSpDHdpFDClN%2Fyt73KRUFLIP%2FQKzKNZ1IOhcb4aQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 894e842a4c900b41-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|