URL User Request GET HTTP/1.1 IP
File type gzip compressed data, from Unix\012- data
Hash 41db553d2263f39184ed1105aa76c2be
5cdd41c6d304c66b8b8bfa475cdf8aa91ff9e5ab
536602cd002a3c436c4031ec0ce03be5340e0cd845320d7d2afaeffd7b768922
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata high ThreatFox botnet C2 traffic (url - confidence level: 100%)
suricata low ET INFO HTTP Request to a *.pw domain
GET /apif HTTP/1.1
Host: dayzilons.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sun, 26 Nov 2023 15:54:52 GMT
location: http://dayzilons.pw/apif
cache-control: max-age=3600
expires: Sun, 26 Nov 2023 16:54:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xUi65OwgKMt2tVSunmNn12XOHhNn1yFYJcOSqYf4ezlGzy0nWV2JOb1OQthsZSw2QKI9XWxpPdgwZkf9QxZlTu4PTAi2%2F0Cb4pntemMqBm0Qbhac0nktnWJgUhZAv3c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82c350013824712a-OSL
X-Firefox-Spdy: h2
dayzilons.pw/cdn-cgi/styles/challenges.css
200 OK 2.6 kB URL GET HTTP/1.1 dayzilons.pw/cdn-cgi/styles/challenges.css
IP
File type ASCII text, with very long lines (6600), with no line terminators
Hash 2c78b7f8fa496092bf41d5edd51611e7
8b0b1b276e8194b0a5497db478ec2ea9b4f83c42
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata low ET INFO HTTP Request to a *.pw domain
GET /cdn-cgi/styles/challenges.css HTTP/1.1
Host: dayzilons.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://dayzilons.pw/apif
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 26 Nov 2023 15:54:53 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 16 Nov 2023 21:55:48 GMT
ETag: W/"65568fe4-19c8"
Server: cloudflare
CF-RAY: 82c350046cd2712d-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Sun, 26 Nov 2023 17:54:53 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip
dayzilons.pw/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82c350015a9356bf
200 OK 1.9 kB URL GET HTTP/1.1 dayzilons.pw/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82c350015a9356bf
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (394)
Hash 57cd223387307fbd8c822c58470839d9
2d439a7443cb8b47f59406e863826dc180d40661
36101986bb8af4dff3576710b98c70e10940bdfbdb750f729a414c5d0c4d6604
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata low ET INFO HTTP Request to a *.pw domain
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82c350015a9356bf HTTP/1.1
Host: dayzilons.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://dayzilons.pw/apif?__cf_chl_rt_tk=jP4KCSvNoq1RZ9dzsNryq5pczdHvzcZnhkCdb6jZYNQ-1701014093-0-gaNycGzNBeU
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 26 Nov 2023 15:54:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vsy1A6J%2B3hdwk%2F%2BP0%2BJMcmS%2F4qAaMoCI4lHOO9TPhibSIvolA3FxoiRluhLw6ed4SrYu%2Bm%2FBlGNXeQowa4TkfNgfEHsP%2FM2GmFt3guqnNIGoz7h4NWzvq0jX5PfcnGI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82c35004ed67712d-OSL
Content-Encoding: gzip
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4724), with no line terminators
Hash 473e7ef0f959e6ad3756897368f90830
dff5688fc22067998dfc47810446051931955a5c
2f2c7157a668bec1eac6585c12850e72c76bc62003cd0881d6e72965cc9a45aa
Analyzer Verdict Alert ThreatFox malicious Lumma Stealer
mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
NIDS Severity Alert suricata low ET INFO HTTP Request to a *.pw domain
GET /favicon.ico HTTP/1.1
Host: dayzilons.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://dayzilons.pw/apif
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 26 Nov 2023 15:54:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2DR20EqDVio3OTBGCh723J0e32MKh06sZWOpMn3gAPqbTjrP0UCH%2FDiRY7REFrslwK9sJk3FW9sg%2FOLjGuKtEez%2FNjM56kf4yJiGDmJ8U0Aus09FBVVS038bdM4afrI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 82c350053dbb712d-OSL
Content-Encoding: gzip
104.21.4.133
172.67.132.29