IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hashe49ce6a2ffd1afe9fdb15fd32491f4c5 7def7bdba49613d39e69a640fbe216a4ffee38cb 6ddbcc3388c5458c7be8c867cbff8d6ae16d588349605db0c7b5996ea32de452
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "6DDBCC3388C5458C7BE8C867CBFF8D6AE16D588349605DB0C7B5996EA32DE452"
Last-Modified: Wed, 25 Sep 2024 19:04:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14696
Expires: Thu, 26 Sep 2024 01:19:17 GMT
Date: Wed, 25 Sep 2024 21:14:21 GMT
Connection: keep-alive
|
IP 194.59.31.46:0
ASN#207279 Markahost Telekomunikasyon Ve Ticaret Limited Sirketi
File typeHTML document, ASCII text Hash021dbf94725f36b454b0bbbfaed7fbd1 d1a108440cec459f008c8c27a2a6c81a32e1d918 16c9e250a46cb8e3c7ff99aa8ce1960d8f0da86295c9d7b9271787bd9d5cf0b4
GET / HTTP/1.1
Host: supportnowus.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: https://supportnowus.top
Server: Microsoft-IIS/10.0
Date: Wed, 25 Sep 2024 21:14:25 GMT
Content-Length: 147
|
| supportnowus.top/Bin/ScreenConnect.ClientService.exe | 194.59.31.46 | | 96 kB |
URL supportnowus.top/Bin/ScreenConnect.ClientService.exe IP194.59.31.46:0 ASN#207279 Markahost Telekomunikasyon Ve Ticaret Limited Sirketi
File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections Hash200a917996f0fc74879076354454473a 15886a7d4385d7ec4f7c8837d7218d46e5b3dd9c 0b2824097abe3211aac5feda8dc4d300ba51801d9fbed9eb8330b433a66ac001
| Analyzer | Verdict | Alert |
|---|
| VirusTotal | suspicious | |
GET /Bin/ScreenConnect.ClientService.exe HTTP/1.1
Host: supportnowus.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: private
content-length: 95520
content-type: text/html
server: ScreenConnect/24.2.3.8936-2537422459 Microsoft-HTTPAPI/2.0
date: Wed, 25 Sep 2024 21:14:26 GMT
X-Firefox-Spdy: h2
|
IP194.59.31.46:0 ASN#207279 Markahost Telekomunikasyon Ve Ticaret Limited Sirketi
File typeJavaScript source, ASCII text, with very long lines (647), with CRLF line terminators Hashabaaf47599f79a7ba79efc42e1730059 839b0f1391d13134d566b7961fba17a35213c6e9 51c099724a9dcf72b036af6c1b69efa676e5221a881e52758e54a4e4cbc90534
GET / HTTP/1.1
Host: supportnowus.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: private
content-length: 11035
content-type: text/html; charset=utf-8
content-encoding: gzip
server: ScreenConnect/24.2.3.8936-2537422459 Microsoft-HTTPAPI/2.0
p3p: CP="NON CUR OUR STP STA PRE"
date: Wed, 25 Sep 2024 21:14:26 GMT
X-Firefox-Spdy: h2
|
| GET supportnowus.top/favicon.ico | 194.59.31.46 | 404 Not Found | 1.9 kB |
URL GET HTTP/2supportnowus.top/favicon.ico IP194.59.31.46:443 ASN#207279 Markahost Telekomunikasyon Ve Ticaret Limited Sirketi
Requested byhttps://supportnowus.top/Bin/ScreenConnect.ClientService.exe CertificateIssuerZeroSSL Subjectsupportnowus.top FingerprintB1:AB:A6:90:7F:A4:42:67:7C:3F:E3:D6:AB:1C:6A:C0:8F:B9:25:0A ValidityTue, 24 Sep 2024 00:00:00 GMT - Mon, 23 Dec 2024 23:59:59 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hashfe13e7946b45b0110de267c1f85bd38c b4d864661a98607f5751dcb81bf87df80ea80822 cb659eae953d8a427ea235c2df88ede9e4258a932594362364e857c8d8078ed9
GET /favicon.ico HTTP/1.1
Host: supportnowus.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://supportnowus.top/Bin/ScreenConnect.ClientService.exe
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
cache-control: private
content-length: 1922
content-type: text/html; charset=utf-8
server: ScreenConnect/24.2.3.8936-2537422459 Microsoft-HTTPAPI/2.0
date: Wed, 25 Sep 2024 21:14:26 GMT
X-Firefox-Spdy: h2
|