IP 23.33.119.57:0
ASN#20940 Akamai International B.V.
Hash050718ab9dc2838d2e9024055cb41483 6e55983a400fc690d87e12582f4fa8553e7b95c6 d86c86521d6dffa0ae29cccbe08a53af825337b4d0e308884bf33122ee11e415
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "D86C86521D6DFFA0AE29CCCBE08A53AF825337B4D0E308884BF33122EE11E415"
Last-Modified: Sun, 15 Sep 2024 02:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2608
Expires: Tue, 17 Sep 2024 18:00:38 GMT
Date: Tue, 17 Sep 2024 17:17:10 GMT
Connection: keep-alive
|
| pdfwordexcel.byethost4.com/temp.txt |  185.27.134.92 | | 31 kB |
URL User Request GET pdfwordexcel.byethost4.com/temp.txt IP185.27.134.92:0 ASN#34119 Wildcard UK Limited
File typeASCII text, with very long lines (31108), with no line terminators Hash9641f2352933a697358676f3118abb37 5e692857eb713ed4bb275abd9a93dfe5797661d2 6555b790851200f26b71a966d4d8fe248bd4e338804a0f18ba520da4272f4e75
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /temp.txt HTTP/1.1
Host: pdfwordexcel.byethost4.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 17 Sep 2024 17:17:11 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 31108
Connection: keep-alive
Last-Modified: Thu, 05 Sep 2024 02:14:31 GMT
ETag: "7984-62155d9d97a2d"
Cache-Control: max-age=2592000, public, public, proxy-revalidate, must-revalidate
Expires: Thu, 17 Oct 2024 17:17:11 GMT
Accept-Ranges: bytes
|
| pdfwordexcel.byethost4.com/favicon.ico | 185.27.134.92 | 404 Not Found | 12 kB |
URL GET HTTP/1.1pdfwordexcel.byethost4.com/favicon.ico IP185.27.134.92:80 ASN#34119 Wildcard UK Limited
Requested byhttp://pdfwordexcel.byethost4.com/temp.txt
File typeHTML document, ASCII text, with very long lines (2228) Hash6baf6e5cb8ffa13768f8c590afeaa118 ebbbfe7b01356b03dc1d0921e53b1054f528036c 051fe0603378b7efb7fe29a6950c1b4b4749a5d2a079d2d092aa2b7be4a69687
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: pdfwordexcel.byethost4.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://pdfwordexcel.byethost4.com/temp.txt
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 17 Sep 2024 17:17:11 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 11909
Connection: keep-alive
Last-Modified: Tue, 03 Oct 2023 23:39:26 GMT
ETag: "2e85-606d866b65580"
Cache-Control: max-age=5, public, proxy-revalidate
|