IP 100.24.35.225:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET / HTTP/1.1
Host: 100.24.35.225
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sat, 10 Jun 2023 14:47:09 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
X-Powered-By: PHP/8.2.4
Location: http://100.24.35.225/dashboard/
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
IP 100.24.35.225:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (350)
Hash 7085950dd76e2c9a0bf5af1e3490658e
e19a4177d51e542322c88b9c3dbed3eee9e7c542
c624ee2a5e7fe9f25029b40773181f6a81f8aee4b1221a16ad6a1f848a0cec8f
Analyzer Verdict Alert quad9 Sinkholed
GET /dashboard/ HTTP/1.1
Host: 100.24.35.225
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 14:47:09 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
Last-Modified: Thu, 06 Apr 2023 08:22:44 GMT
ETag: "1442-5f8a69ce3fd00"
Accept-Ranges: bytes
Content-Length: 5186
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html
100.24.35.225/WRUYWHALQTWDRNENJGYIFC/GLZIICQOWZCJFYOQQFJQRR.txt
100.24.35.225200 OK 18 kB URL User Request GET HTTP/1.1 100.24.35.225/WRUYWHALQTWDRNENJGYIFC/GLZIICQOWZCJFYOQQFJQRR.txt
IP 100.24.35.225:80
File type HTML document, ASCII text, with very long lines (17966), with CRLF line terminators
Hash 266f2345d445502f36532da879fe4343
44a8fdf93549b528c58de3568d1722170335d4b5
a7b0b133f98936c95807f6ccfda1174cb03517a8e136379fe7354893ade73336
Analyzer Verdict Alert quad9 Sinkholed
NIDS Severity Alert suricata medium ET WEB_CLIENT Hex Obfuscation of Script Tag % Encoding
suricata medium ET WEB_CLIENT Obfuscated Javascript // ptth (escaped)
GET /WRUYWHALQTWDRNENJGYIFC/GLZIICQOWZCJFYOQQFJQRR.txt HTTP/1.1
Host: 100.24.35.225
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 14:47:10 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
Last-Modified: Wed, 17 May 2023 17:53:12 GMT
ETag: "4630-5fbe75c88e665"
Accept-Ranges: bytes
Content-Length: 17968
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain
100.24.35.225/favicon.ico
100.24.35.225200 OK 31 kB URL GET HTTP/1.1 100.24.35.225/favicon.ico
IP 100.24.35.225:80
Requested by http://100.24.35.225/WRUYWHALQTWDRNENJGYIFC/GLZIICQOWZCJFYOQQFJQRR.txt
File type MS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 48x48, 32 bits/pixel\012- data
Hash 6eb4a43cb64c97f76562af703893c8fd
c50c4273b9d2433c6069454f971ed6653e07c126
1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9
Analyzer Verdict Alert quad9 Sinkholed
GET /favicon.ico HTTP/1.1
Host: 100.24.35.225
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://100.24.35.225/WRUYWHALQTWDRNENJGYIFC/GLZIICQOWZCJFYOQQFJQRR.txt
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 10 Jun 2023 14:47:10 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
Last-Modified: Thu, 16 Jul 2015 15:32:32 GMT
ETag: "78ae-51affc7a4c400"
Accept-Ranges: bytes
Content-Length: 30894
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/x-icon