188.114.97.1403 Forbidden 2.2 kB URL User Request GET HTTP/1.1 IP 188.114.97.1:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1098)
Hash 4380a29d521c2ea94d67c43823fd6d2a
04fba774f1943827a97df58d7c3f3939ff2058c2
413c857e09f57a30fd1e6ef6001a9fbbd75b1fa59da28a0b486049121459e542
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET / HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Mon, 25 Sep 2023 07:15:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: max-age=15
Expires: Mon, 25 Sep 2023 07:15:48 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yEcmzl31gNBurlD0RA0zXE5OyN7duhdxSiofgFvA2vOydh%2BkrYF2RzL8jLzHKHkmrapEc3WXxxkcSyiuIzA0Hy8Q5%2FQ9wDIqJn50d%2BXvMjmMOgPPyAiiJECGvp%2BN"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 80c17a07fc421c16-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
amnqf.buzz/cdn-cgi/styles/cf.errors.css
188.114.97.1200 OK 4.5 kB URL GET HTTP/1.1 amnqf.buzz/cdn-cgi/styles/cf.errors.css
IP 188.114.97.1:80
File type ASCII text, with very long lines (24131)
Hash a1cedc21f16b5a97114857154fab35e9
95e9890a15a4f7f94f7f19d2c297e4b07503c526
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
Analyzer Verdict Alert urlquery suspicious Suspicious - Sinkholed / Blocked
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://amnqf.buzz/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 25 Sep 2023 07:15:34 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 20 Sep 2023 08:17:07 GMT
ETag: W/"650aaa83-5e44"
Server: cloudflare
CF-RAY: 80c17a0a6e561c16-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Mon, 25 Sep 2023 09:15:34 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip
188.114.96.1403 Forbidden 5.2 kB URL User Request GET HTTP/1.1 IP 188.114.96.1:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1098)
Hash 3b225c64cdb6673600fad1e202126f04
2d0106be13ef2c839d5ced4a810f3bc0c095b929
62da53abac439864121a089786656e133eaeb8566193b3ab1f3cc12cc42fa606
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET / HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Mon, 25 Sep 2023 07:15:33 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: max-age=15
expires: Mon, 25 Sep 2023 07:15:48 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BSXnquStiQ5BfxCKn6z91jIHfnzM1GUCkck%2FD6dD5oxa2gQoHWDy4bRt9paFNMzLp%2FSHVqqRg9asSwpOwSPiemCyuxS5wlnpraGoW8zXnafHax4TdxflPYz%2FcJMG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80c17a063879b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
amnqf.buzz/cdn-cgi/challenge-platform/scripts/jsd/main.js
188.114.97.1302 Found 0 B URL GET HTTP/2 amnqf.buzz/cdn-cgi/challenge-platform/scripts/jsd/main.js
IP 188.114.97.1:443
Certificate IssuerGoogle Trust Services LLC
Subjectamnqf.buzz
Fingerprint75:C8:AF:02:FD:AB:FA:20:61:EC:3F:B8:62:D1:CA:07:BC:AB:B6:8A
ValiditySun, 24 Sep 2023 10:42:34 GMT - Sat, 23 Dec 2023 10:42:33 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Mon, 25 Sep 2023 07:15:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://amnqf.buzz/cdn-cgi/challenge-platform/scripts/jsd/main.js
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=up9GpM9I8TvBiszG6ZjFZ4cwVjhJWlSsHqpcZbmREPbFpbvsPXXYAFt73XSoYLe5uoebollHe7uNgxkgxrxWRWfTMaJnNtuhSGSbfCLhUZOPEkzwYf2sDEgkTOqZ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 80c17a0b2a74b51d-OSL
alt-svc: h2=":443"; ma=60
amnqf.buzz/cdn-cgi/images/browser-bar.png?1376755637
188.114.97.1200 OK 715 B URL GET HTTP/1.1 amnqf.buzz/cdn-cgi/images/browser-bar.png?1376755637
IP 188.114.97.1:80
File type PNG image data, 960 x 53, 8-bit colormap, non-interlaced\012- data
Hash 226dcb8f6144bdaafdfbd8f2f354be64
3785cc5b3bf52f8e398177b0ff1020b24aa86b8c
8c873472f4925d5d47521db4d52532d2983e9cb1bde8b43143a6cc6db56c35db
Analyzer Verdict Alert urlquery suspicious Suspicious - Sinkholed / Blocked
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://amnqf.buzz/cdn-cgi/styles/cf.errors.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 25 Sep 2023 07:15:34 GMT
Content-Type: image/png
Content-Length: 715
Connection: keep-alive
Last-Modified: Wed, 20 Sep 2023 08:17:07 GMT
ETag: "650aaa83-2cb"
Server: cloudflare
CF-RAY: 80c17a0afec21c16-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Mon, 25 Sep 2023 09:15:34 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes
amnqf.buzz/favicon.ico
188.114.97.1403 Forbidden 1.7 kB IP 188.114.97.1:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (394)
Hash f077ba1dbcd981659f8bbe2712bb4e17
f4394fcd5150f94072de6f58903eff19fcd7664e
5759ea292c17f291d90434920381f5de357903a396fbcf59f9f7e516f671723c
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET /favicon.ico HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://amnqf.buzz/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Mon, 25 Sep 2023 07:15:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: max-age=15
Expires: Mon, 25 Sep 2023 07:15:49 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8JNg%2BOl1Ik5H5kCiLsjXyjF3JYSgz0S2NjB7Z6TV8rffIzuI2Vd9mRprKQ3hGYhF0tUQ4YT56OeUR33CE3ixWtsY%2B9y2mkXuMCP5lQNC3B70SRz9yGGKfkgC5IDZ"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 80c17a0beb4bb51d-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
amnqf.buzz/cdn-cgi/challenge-platform/h/g/jsd/r/80c17a07fc421c16
188.114.97.1302 Moved Temporarily 0 B URL POST HTTP/1.1 amnqf.buzz/cdn-cgi/challenge-platform/h/g/jsd/r/80c17a07fc421c16
IP 188.114.97.1:80
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/challenge-platform/h/g/jsd/r/80c17a07fc421c16 HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 11589
Origin: http://amnqf.buzz
DNT: 1
Connection: keep-alive
Referer: http://amnqf.buzz/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Mon, 25 Sep 2023 07:15:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://amnqf.buzz/cdn-cgi/challenge-platform/h/g/jsd/r/80c17a07fc421c16
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YW9udAUuNRkjz0JHApTkKBC83a0CoQsobjS0FglE2fQd8putNg%2FydL2SAh13hF3X7c7339d6ApuuTinVJC0UCENwnZvY3YC7BSKVLOLnPb4H%2FRbyySOTfHzXokYu"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 80c17a0e5dcbb51d-OSL
alt-svc: h2=":443"; ma=60
amnqf.buzz/cdn-cgi/images/cf-no-screenshot-error.png
188.114.97.1200 OK 3.2 kB URL GET HTTP/1.1 amnqf.buzz/cdn-cgi/images/cf-no-screenshot-error.png
IP 188.114.97.1:80
File type PNG image data, 178 x 175, 8-bit colormap, non-interlaced\012- data
Hash 0d768cbc261841d3affc933b9ac3130e
aff136a4c761e1df1ada7e5d9a6ed0ebea74a4b7
1c53772285052e52bb7c12ad46a85a55747ed7bf66963fe1993fcef91ff5b0d0
Analyzer Verdict Alert urlquery suspicious Suspicious - Sinkholed / Blocked
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.buzz domain
GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://amnqf.buzz/cdn-cgi/styles/cf.errors.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 25 Sep 2023 07:15:34 GMT
Content-Type: image/png
Content-Length: 3213
Connection: keep-alive
Last-Modified: Wed, 20 Sep 2023 08:17:07 GMT
ETag: "650aaa83-c8d"
Server: cloudflare
CF-RAY: 80c17a0b0a47b51d-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Mon, 25 Sep 2023 09:15:34 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes
amnqf.buzz/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js
188.114.97.1200 OK 7.3 kB URL GET HTTP/3 amnqf.buzz/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js
IP 188.114.97.1:443
Certificate IssuerGoogle Trust Services LLC
Subjectamnqf.buzz
Fingerprint75:C8:AF:02:FD:AB:FA:20:61:EC:3F:B8:62:D1:CA:07:BC:AB:B6:8A
ValiditySun, 24 Sep 2023 10:42:34 GMT - Sat, 23 Dec 2023 10:42:33 GMT
File type ASCII text, with very long lines (7317), with no line terminators
Hash 99820f3f891a6c36d53ebfb7a1b9e37e
0f840cb4f1e84958ffd16b6704c69742193b6ca4
e0b82164e314269ff4db8e1e2ad38fdff00997bff74925f6ab8316db3ad6354b
GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js HTTP/1.1
Host: amnqf.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 25 Sep 2023 07:15:34 GMT
content-type: application/javascript; charset=UTF-8
vary: accept-encoding
cache-control: max-age=14400, public
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0gPm3b7N08owe1Vfm7ku0Os3ts5Xboq1ELER3vgikaPSh0qgpoWg3d773Cd0W4gcRwrzws9sCXGCMVkv%2FDgPmIFZea%2BxV7nNVFxecPQKI%2FtDUxeWBV3pxKbJMo8a"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80c17a0cdb9e569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400