| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP 23.33.119.27:0
ASN#20940 Akamai International B.V.
Hash559312780d7c69aabb31f612abe74b95 0d0356dc28789b5b2b0164783f2c79b6b7b82f6a 20293009653baaf415bde5c2223feb0a6562281a1dfbcc6af42d844341da6d26
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "20293009653BAAF415BDE5C2223FEB0A6562281A1DFBCC6AF42D844341DA6D26"
Last-Modified: Wed, 24 Jul 2024 18:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16719
Expires: Sat, 27 Jul 2024 06:46:49 GMT
Date: Sat, 27 Jul 2024 02:08:10 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP 23.33.119.27:0
ASN#20940 Akamai International B.V.
Hash577f20b1ad1240dc12215f4d93e53b8f 4fb6d79b9c4adb8f712073e9662ceae41a4f097c 523bc00bcd3cc12a640ebce3df80c0aed9fc552c4be5bae1831c00b9027ce0c0
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "523BC00BCD3CC12A640EBCE3DF80C0AED9FC552C4BE5BAE1831C00B9027CE0C0"
Last-Modified: Wed, 24 Jul 2024 18:56:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7001
Expires: Sat, 27 Jul 2024 04:04:51 GMT
Date: Sat, 27 Jul 2024 02:08:10 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP 23.33.119.27:0
ASN#20940 Akamai International B.V.
Hash8f4e7b75de1ed909fa79bbcdafccceac 274c1ea75520a0ea06e19a7e692c034baae2cdc1 62cc974e51b62480f576b53853f8f24bfc873687c02bc23c1713956d4b96c0b1
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "62CC974E51B62480F576B53853F8F24BFC873687C02BC23C1713956D4B96C0B1"
Last-Modified: Wed, 24 Jul 2024 18:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7448
Expires: Sat, 27 Jul 2024 04:12:19 GMT
Date: Sat, 27 Jul 2024 02:08:11 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.27 | | 504 B |
IP 23.33.119.27:0
ASN#20940 Akamai International B.V.
Hash0b6f864b0a3d0cf483b0830bdb98cded 12564f2826ce74a640c3b65ef52d12f21c8e6f3c d32892cb09f33f4057712b1c1b511af5ea5528cd0f23ba90858d659ec4fcd190
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "D32892CB09F33F4057712B1C1B511AF5EA5528CD0F23BA90858D659EC4FCD190"
Last-Modified: Wed, 24 Jul 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2841
Expires: Sat, 27 Jul 2024 02:55:32 GMT
Date: Sat, 27 Jul 2024 02:08:11 GMT
Connection: keep-alive
|
|
| 142.202.188.209/remotework/JWrapper-Windows64JRE-version.txt?time=4063023031 | 142.202.188.209 | 200 OK | 11 B |
URL User Request GET HTTP/1.1142.202.188.209/remotework/JWrapper-Windows64JRE-version.txt?time=4063023031 IP 142.202.188.209:80
File typeASCII text, with no line terminators Hash271563b96fbbff5dc3e04656f3f18923 7f6800a9d6112bf5c360d56f3b0c5c616260fee8 b482d2aace7286c78a565879c3ac49b772e9bd9d003bed856542c2cee1049b22
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
NIDS | Severity | Alert | suricata | low | ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response |
GET /remotework/JWrapper-Windows64JRE-version.txt?time=4063023031 HTTP/1.1
Host: 142.202.188.209
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 11
Last-Modified: Tue, 10 Oct 2023 13:35:04 GMT
Cache-Control: private, must-revalidate
Pragma: private
Server: SimpleHelp/SSuite-5-4-20231010-143523
|
|
| 142.202.188.209/favicon.ico | 142.202.188.209 | 200 OK | 15 kB |
URL GET HTTP/1.1142.202.188.209/favicon.ico IP 142.202.188.209:80
Requested byhttp://142.202.188.209/remotework/JWrapper-Windows64JRE-version.txt?time=4063023031
File typeMS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel Hash39a349a4171759407f1aa76f9937b35f 82e61919f09521f53cf34b21e4301be4cd8b67b9 c88bccf1b1aa959f96e87d320a10550d9885f5ef5c71b8a9da039ca35d0d4501
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 142.202.188.209
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://142.202.188.209/remotework/JWrapper-Windows64JRE-version.txt?time=4063023031
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
Content-Length: 15406
Last-Modified: Tue, 10 Oct 2023 13:31:00 GMT
Cache-Control: private, must-revalidate
Pragma: private
Server: SimpleHelp/SSuite-5-4-20231010-143523
|
|
| r10.o.lencr.org/ | 23.33.119.57 | | 504 B |
IP 23.33.119.57:0
ASN#20940 Akamai International B.V.
Hash91392416ed946eb8b26810ff46d7e57e 8ce21a441df1ac09da4ebf098eaf47e2d74bbff0 5d153b40d51555b8f2717f7e56bfbe3be25b1b38a18b31715eea4ddff345f98a
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D153B40D51555B8F2717F7E56BFBE3BE25B1B38A18B31715EEA4DDFF345F98A"
Last-Modified: Wed, 24 Jul 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7504
Expires: Sat, 27 Jul 2024 04:13:17 GMT
Date: Sat, 27 Jul 2024 02:08:13 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.33.119.57 | | 504 B |
IP 23.33.119.57:0
ASN#20940 Akamai International B.V.
Hash91392416ed946eb8b26810ff46d7e57e 8ce21a441df1ac09da4ebf098eaf47e2d74bbff0 5d153b40d51555b8f2717f7e56bfbe3be25b1b38a18b31715eea4ddff345f98a
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D153B40D51555B8F2717F7E56BFBE3BE25B1B38A18B31715EEA4DDFF345F98A"
Last-Modified: Wed, 24 Jul 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7504
Expires: Sat, 27 Jul 2024 04:13:17 GMT
Date: Sat, 27 Jul 2024 02:08:13 GMT
Connection: keep-alive
|
|