ocsp.globalsign.com/alphasslcasha256g4
104.18.20.226 1.4 kB URL ocsp.globalsign.com/alphasslcasha256g4
IP 104.18.20.226:0
Hash 81a46d55c336e98b6bbd2baf3fe3fea1
39fce3ff161df8930b678d47fc9e1f4537f60c51
9a5825dae69bcf75affb661f2d8f70140fd8585d57214f0a6adb2a0f3f7636ce
POST /alphasslcasha256g4 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 03:24:43 GMT
Content-Type: application/ocsp-response
Content-Length: 1437
Connection: keep-alive
Expires: Mon, 05 Jun 2023 00:53:43 GMT
ETag: "39fce3ff161df8930b678d47fc9e1f4537f60c51"
Last-Modified: Thu, 01 Jun 2023 00:53:44 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 1701
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7d0458663ac3b511-OSL
kashtoyou.ru/gn28/*
31.31.205.163 1.5 kB IP 31.31.205.163:0
ASN #197695 Domain names registrar REG.RU, Ltd
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 31ea07ece6797183a76efee6e3332890
a4e38be7f448bb104b69f65de0103f816b95bd1a
becef1e47dc3d1400b27483810e02dd61ed20691f408a44062e753f203ff6003
GET /gn28/* HTTP/1.1
Host: kashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 1468
Date: Thu, 01 Jun 2023 03:24:44 GMT
Server: lighttpd/1.4.45
kashtoyou.ru/js/check.php?url=
31.31.205.163 1.5 kB URL kashtoyou.ru/js/check.php?url=
IP 31.31.205.163:0
ASN #197695 Domain names registrar REG.RU, Ltd
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text
Hash 31ea07ece6797183a76efee6e3332890
a4e38be7f448bb104b69f65de0103f816b95bd1a
becef1e47dc3d1400b27483810e02dd61ed20691f408a44062e753f203ff6003
GET /js/check.php?url= HTTP/1.1
Host: kashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kashtoyou.ru/gn28/*
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 1468
Date: Thu, 01 Jun 2023 03:24:44 GMT
Server: lighttpd/1.4.45
kashtoyou.ru/favicon.ico
31.31.205.163 1.2 kB IP 31.31.205.163:0
ASN #197695 Domain names registrar REG.RU, Ltd
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash b5d84a27335eab79eb47a4a3612778a9
b03112211a61784537820bd2498cca66f82483d6
dbf94094c3c1c1c197e8e418df2268c34387e92e931b14c1f7f9c0b3f6ffb998
GET /favicon.ico HTTP/1.1
Host: kashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kashtoyou.ru/gn28/*
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
Accept-Ranges: bytes
ETag: "3209418383"
Last-Modified: Mon, 08 Aug 2022 12:00:00 GMT
Expires: Sun, 26 May 2024 03:24:44 GMT
Cache-Control: max-age=31104000
Content-Length: 1150
Date: Thu, 01 Jun 2023 03:24:44 GMT
Server: lighttpd/1.4.45
kashtoyou.ru/
31.31.205.163 0 B IP 31.31.205.163:0
ASN #197695 Domain names registrar REG.RU, Ltd
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata high ETPRO HUNTING Suspicious Redirect Attempting to Hide Referer
GET / HTTP/1.1
Host: kashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://kashtoyou.ru/gn28/*
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Expires: Thu, 01 Jun 2023 03:24:45 GMT
Last-Modified: Thu, 01 Jun 2023 03:24:45 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: https://href.li/?http://mastertarget.ru/scripts/click.php?a_aid=stroypro78&a_bid=e537cdf9&data1=kd
Content-type: text/html; charset=UTF-8
Content-Length: 0
Date: Thu, 01 Jun 2023 03:24:45 GMT
Server: lighttpd/1.4.45
mastertarget.ru/scripts/click.php?a_aid=stroypro78&a_bid=e537cdf9&data1=kd
172.67.131.85 1.4 kB URL mastertarget.ru/scripts/click.php?a_aid=stroypro78&a_bid=e537cdf9&data1=kd
IP 172.67.131.85:0
Hash 4004665b5f7e48878738a1c36a2436aa
7d822380348e82ead5264cd9686ff7a5432b65e3
8748841ea1a9951ad75358f8d35a9d4bc61ececdf848e653707701c9fe51868b
GET /scripts/click.php?a_aid=stroypro78&a_bid=e537cdf9&data1=kd HTTP/1.1
Host: mastertarget.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Thu, 01 Jun 2023 03:24:47 GMT
content-type: text/html; charset=UTF-8
location: https://cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
x-powered-by: PHP/7.2.34
cache-control: private, no-cache, no-store, max-age=0
expires: Sat, 26 Jul 1997 05:00:00 GMT
set-cookie: PAPVisitorId=99df91891ccb7f72fa092dH6oqGmdlI8; Expires=Fri, 31 May 2024 03:24:47 GMT; path=/; domain=.mastertarget.ru; Secure; SameSite=None
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CHp4pEVVcqRo3swXGqSCZJryPJkXYm8Qo%2F3HC5wuZ2%2BlmF89gIg7emGt9JgQtUfQOqaiytY47rr6IrX3EH%2FNZili0iwkK8JXBjR%2FnLH8GO%2BkFlWQUA70qLK3%2B87f3UaMN1s%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d0458762bccb509-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
91.215.42.54301 Moved Permanently 6.2 kB URL User Request GET HTTP/1.1 cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
IP 91.215.42.54:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6189), with no line terminators
Hash d2c4ab73644d3a02caced711f594da24
e301b5e63e9bbb58ea0697c5cf3a01a66889e04c
24a63f34b76f48539fa07292c8e9bf6a01be13d3fb3a6481ad54536c05a12277
GET /?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8 HTTP/1.1
Host: cashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
server: ddos-guard
date: Thu, 01 Jun 2023 03:24:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
content-length: 6189
X-Firefox-Spdy: h2
cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
91.215.42.54301 Moved Permanently 568 B URL User Request GET HTTP/1.1 cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
IP 91.215.42.54:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (564), with no line terminators
Hash 2761b98db33884ab29711096ab315edb
8cea6e53464aea178b72e06a906205d040f14ca5
9f7a07f69d9b9a5af186a79159ccea18935ab4103128ca967e3f3f8ae45fb3ee
GET /?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8 HTTP/1.1
Host: cashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: ddos-guard
Date: Thu, 01 Jun 2023 03:24:47 GMT
Connection: keep-alive
Keep-Alive: timeout=60
Location: https://cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
Content-Type: text/html; charset=utf8
Content-Length: 568
cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
91.215.42.54301 Moved Permanently 6.2 kB URL User Request GET HTTP/1.1 cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
IP 91.215.42.54:80
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6189), with no line terminators
Hash d2c4ab73644d3a02caced711f594da24
e301b5e63e9bbb58ea0697c5cf3a01a66889e04c
24a63f34b76f48539fa07292c8e9bf6a01be13d3fb3a6481ad54536c05a12277
GET /?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8 HTTP/1.1
Host: cashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 403 Forbidden
server: ddos-guard
date: Thu, 01 Jun 2023 03:24:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
content-length: 6189
X-Firefox-Spdy: h2
cashtoyou.ru/favicon.ico
91.215.42.54 6.2 kB IP 91.215.42.54:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6189), with no line terminators
Hash d2c4ab73644d3a02caced711f594da24
e301b5e63e9bbb58ea0697c5cf3a01a66889e04c
24a63f34b76f48539fa07292c8e9bf6a01be13d3fb3a6481ad54536c05a12277
GET /favicon.ico HTTP/1.1
Host: cashtoyou.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cashtoyou.ru/?utm_source=cash_mastertarg?uid=stroypro78&click_hash=99df91891ccb7f72fa092dH6oqGmdlI8
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 403 Forbidden
server: ddos-guard
date: Thu, 01 Jun 2023 03:24:47 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
content-length: 6189
X-Firefox-Spdy: h2