| 37.1.213.100/ycWbNp?host=2eu3.obiettivo-comune.it/&mark=30052023_7r3_500kHtml_1shab17it_9_serv1&keyword=holyunblocker&template=&se_referrer= | 37.1.213.100 | 302 Found | 0 B |
URL User Request GET HTTP/1.137.1.213.100/ycWbNp?host=2eu3.obiettivo-comune.it/&mark=30052023_7r3_500kHtml_1shab17it_9_serv1&keyword=holyunblocker&template=&se_referrer= IP37.1.213.100:80
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | quad9 | Sinkholed | |
NIDS | Severity | Alert | suricata | high | ETPRO EXPLOIT_KIT Evil Keitaro Set-Cookie Inbound (9fb19) |
GET /ycWbNp?host=2eu3.obiettivo-comune.it/&mark=30052023_7r3_500kHtml_1shab17it_9_serv1&keyword=holyunblocker&template=&se_referrer= HTTP/1.1
Host: 37.1.213.100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Thu, 01 Jun 2023 18:40:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Location: https://tabloidquantitycosts.com/t4qfwb6nr2?key=1dfed94920e8b3396c72bd0fece8015b
Pragma: no-cache
Set-Cookie: _subid=1sisi1a998789; expires=Sun, 02 Jul 2023 18:40:00 GMT; path=/
9fb19=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjdcIjoxNjg1NjQ0ODAwfSxcImNhbXBhaWduc1wiOntcIjFcIjoxNjg1NjQ0ODAwfSxcInRpbWVcIjoxNjg1NjQ0ODAwfSJ9.s62I-dlwtEXtiDelAghOPhYBN1kccb26UTd9tEvB8gk; expires=Sat, 31 Oct 2076 13:20:00 GMT; path=/
_token=uuid_1sisi1a998789_1sisi1a9987896478e6007a1592.94484620; expires=Sun, 02 Jul 2023 18:40:00 GMT; path=/
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
|
| tabloidquantitycosts.com/t4qfwb6nr2?key=1dfed94920e8b3396c72bd0fece8015b | 173.233.137.60 | 200 OK | 115 B |
URL User Request GET HTTP/1.1tabloidquantitycosts.com/t4qfwb6nr2?key=1dfed94920e8b3396c72bd0fece8015b IP173.233.137.60:443
CertificateIssuerLet's Encrypt Subjecttabloidquantitycosts.com FingerprintC7:FF:19:66:60:06:7F:3B:B7:A3:AC:4A:13:A9:25:05:86:36:2D:B6 ValidityWed, 19 Apr 2023 06:29:32 GMT - Tue, 18 Jul 2023 06:29:31 GMT
File typeASCII text, with no line terminators Hash16579cc322e9e105427ecfa57890ef69 8bb47ec30cf894ab49032d7271a45f0c778baa05 f28ce5befe08ed90a2e12b6b2a5e9fdafaa6ad173503079155260aa480c66590
GET /t4qfwb6nr2?key=1dfed94920e8b3396c72bd0fece8015b HTTP/1.1
Host: tabloidquantitycosts.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 01 Jun 2023 18:40:01 GMT
Content-Type: text/html
Content-Length: 115
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=15107320; expires=Fri, 02 Jun 2023 18:40:01 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 87bb23232f2137ff004fb77f5d307a10
Strict-Transport-Security: max-age=0; includeSubdomains
|
| tabloidquantitycosts.com/favicon.ico | 173.233.137.60 | 200 OK | 0 B |
URL GET HTTP/1.1tabloidquantitycosts.com/favicon.ico IP173.233.137.60:443
Requested byhttps://tabloidquantitycosts.com/t4qfwb6nr2?key=1dfed94920e8b3396c72bd0fece8015b CertificateIssuerLet's Encrypt Subjecttabloidquantitycosts.com FingerprintC7:FF:19:66:60:06:7F:3B:B7:A3:AC:4A:13:A9:25:05:86:36:2D:B6 ValidityWed, 19 Apr 2023 06:29:32 GMT - Tue, 18 Jul 2023 06:29:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: tabloidquantitycosts.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tabloidquantitycosts.com/t4qfwb6nr2?key=1dfed94920e8b3396c72bd0fece8015b
Cookie: u_pl=15107320
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Thu, 01 Jun 2023 18:40:01 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0665f0af1881f103d5368a089f26e1fa
Strict-Transport-Security: max-age=0; includeSubdomains
|
| 2eu3.obiettivo-comune.it/ | 188.114.96.1 | 302 Found | 115 B |
URL User Request GET HTTP/22eu3.obiettivo-comune.it/ IP188.114.96.1:443
CertificateIssuerLet's Encrypt Subjectobiettivo-comune.it FingerprintAC:3B:3D:07:42:9B:0F:BE:BF:BB:69:F1:18:EC:3E:E9:E0:37:A2:D2 ValidityMon, 29 May 2023 11:11:53 GMT - Sun, 27 Aug 2023 11:11:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: 2eu3.obiettivo-comune.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 01 Jun 2023 18:40:00 GMT
content-type: text/html; charset=UTF-8
location: http://37.1.213.100/ycWbNp?host=2eu3.obiettivo-comune.it/&mark=30052023_7r3_500kHtml_1shab17it_9_serv1&keyword=holyunblocker&template=&se_referrer=
x-powered-by: PHP/5.4.16
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qgo7yqwv6bZOKBx0e01aZvJz%2BkOjCKuL2TT26CZndrFSPTpRTWbgbwYZYZNvnhkgHvnMsSL2Nr%2FPEFsxfDrsPnVxia1y91JNYKoJzflvvvFipm8RuC8bvnWE9mmamue14uytLklwNq%2Fup3w%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d099520ed1eb509-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|