Report - 51.137.3.145/

Report Overview

Visitedpublic

2024-08-17 01:03:40

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Sent	Received	IP
r11.o.lencr.org	unknown	1.3 kB	3.5 kB	23.33.119.57
r10.o.lencr.org	unknown	981 B	2.7 kB	23.33.119.57
51.137.3.145	unknown	1.3 kB	1.1 kB	51.137.3.145

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-08-17	medium	51.137.3.145	Sinkholed
2024-08-17	medium	51.137.3.145	Sinkholed
2024-08-17	medium	51.137.3.145	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r11.o.lencr.org/

23.33.119.57

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-14

Last Seen2024-08-19

Times Seen48873

Size504 B (504 bytes)

MD5686480d25645ac2aca7a99974693a82f

SHA155ca9d53bd758d2afc75e8a9b59c656ff26a3f70

SHA2568902058e383c2f43751417e1af1d582f7a16ce0b6fc180ab20cbc76c4b00f914

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8902058E383C2F43751417E1AF1D582F7A16CE0B6FC180AB20CBC76C4B00F914"
Last-Modified: Wed, 14 Aug 2024 12:55:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6136
Expires: Sat, 17 Aug 2024 02:45:30 GMT
Date: Sat, 17 Aug 2024 01:03:14 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-16

Last Seen2024-08-19

Times Seen24530

Size504 B (504 bytes)

MD59fca859eba50e585d7c1550a61d33bc3

SHA1a33940f9c83807660f212e5ff511fe28e0413c0d

SHA25608afcf8f1ad63cfd72b781cf4c69900e3fd266ee46389de3918570cf5d682f30

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "08AFCF8F1AD63CFD72B781CF4C69900E3FD266EE46389DE3918570CF5D682F30"
Last-Modified: Fri, 16 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10141
Expires: Sat, 17 Aug 2024 03:52:15 GMT
Date: Sat, 17 Aug 2024 01:03:14 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-15

Last Seen2024-08-19

Times Seen49254

Size504 B (504 bytes)

MD54d209e16679910b467c26590a0073236

SHA1ddd59fa6902b498e9c0cfb22e342757f954789d0

SHA2569ef3dab56215a67804db0e12d33772a1902f5914b788530717712902a294bcb5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9EF3DAB56215A67804DB0E12D33772A1902F5914B788530717712902A294BCB5"
Last-Modified: Wed, 14 Aug 2024 21:59:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7104
Expires: Sat, 17 Aug 2024 03:01:39 GMT
Date: Sat, 17 Aug 2024 01:03:15 GMT
Connection: keep-alive

GET 51.137.3.145/

51.137.3.145

502 Bad Gateway

195 B

URL

51.137.3.145/

IP / ASN

51.137.3.145

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-04-06

Last Seen2025-03-01

Times Seen667

Size195 B (195 bytes)

MD5e0d1a4a70b7864dd9ba22ff15341cfa0

SHA132346cf022d83679b2f437eb9b02092168bafa8c

SHA256a76004959bdd8402fe10509e667dd20ad3e7390f6e8097cc44ef935c908e0e36

Certificate Info

IssuerMicrosoft Corporation

Subjectsmartscreen.microsoft.com

Fingerprint79:D1:EE:2C:CA:1F:B3:D0:C4:18:49:6C:F0:72:60:E0:FE:41:6F:B6

ValiditySat, 27 Jul 2024 03:54:35 GMT - Tue, 22 Jul 2025 03:54:35 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 51.137.3.145
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: Microsoft-Azure-Application-Gateway/v2
Date: Sat, 17 Aug 2024 01:03:15 GMT
Content-Type: text/html
Content-Length: 195
Connection: keep-alive
Location: https://51.137.3.145/

r10.o.lencr.org/

23.33.119.57

504 B

URL

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-16

Last Seen2024-08-19

Times Seen26129

Size504 B (504 bytes)

MD575f615f839dbf8cd2f4a3d58e44455f2

SHA1362b7a7d5cbe41d8a42cecec4ee755af0e07ddaf

SHA2562c4833330979b96ed12b3480367f00be397e9f9ccb35a088e7c79e92eb26cae4

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "2C4833330979B96ED12B3480367F00BE397E9F9CCB35A088E7C79E92EB26CAE4"
Last-Modified: Fri, 16 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7163
Expires: Sat, 17 Aug 2024 03:02:38 GMT
Date: Sat, 17 Aug 2024 01:03:15 GMT
Connection: keep-alive

GET 51.137.3.145/

51.137.3.145

502 Bad Gateway

183 B

URL

51.137.3.145/

IP / ASN

51.137.3.145

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-05-25

Last Seen2025-08-01

Times Seen189

Size183 B (183 bytes)

MD5c3da608da09706b361dcd3a3023b2474

SHA185a06e1683a9dd5fd47efa7f249bdd7d51e65dc1

SHA25640c2149635ede9666f001c9d9135b0b4bf649986459e1c4c52e2c65e79f29d7d

Certificate Info

IssuerMicrosoft Corporation

Subjectsmartscreen.microsoft.com

Fingerprint79:D1:EE:2C:CA:1F:B3:D0:C4:18:49:6C:F0:72:60:E0:FE:41:6F:B6

ValiditySat, 27 Jul 2024 03:54:35 GMT - Tue, 22 Jul 2025 03:54:35 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 51.137.3.145
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 502 Bad Gateway
server: Microsoft-Azure-Application-Gateway/v2
date: Sat, 17 Aug 2024 01:03:17 GMT
content-type: text/html
content-length: 183
X-Firefox-Spdy: h2

GET 51.137.3.145/favicon.ico

51.137.3.145

502 Bad Gateway

183 B

URL

51.137.3.145/favicon.ico

IP / ASN

51.137.3.145

#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested byhttps://51.137.3.145/

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-05-25

Last Seen2025-08-01

Times Seen189

Size183 B (183 bytes)

MD5c3da608da09706b361dcd3a3023b2474

SHA185a06e1683a9dd5fd47efa7f249bdd7d51e65dc1

SHA25640c2149635ede9666f001c9d9135b0b4bf649986459e1c4c52e2c65e79f29d7d

Certificate Info

IssuerMicrosoft Corporation

Subjectsmartscreen.microsoft.com

Fingerprint79:D1:EE:2C:CA:1F:B3:D0:C4:18:49:6C:F0:72:60:E0:FE:41:6F:B6

ValiditySat, 27 Jul 2024 03:54:35 GMT - Tue, 22 Jul 2025 03:54:35 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 51.137.3.145
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://51.137.3.145/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 502 Bad Gateway
server: Microsoft-Azure-Application-Gateway/v2
date: Sat, 17 Aug 2024 01:03:17 GMT
content-type: text/html
content-length: 183
X-Firefox-Spdy: h2

r11.o.lencr.org/

23.33.119.27

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-15

Last Seen2024-08-19

Times Seen45417

Size504 B (504 bytes)

MD53c14cfb85dc9ceb923d7d3c3648719d2

SHA110ea83f83398870f50ca771216ad77bd95aa66cc

SHA256bc868b2a34fe0c66d7a2dc1754676cc4031891c797fdd23e82d135559bd82c1b

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BC868B2A34FE0C66D7A2DC1754676CC4031891C797FDD23E82D135559BD82C1B"
Last-Modified: Thu, 15 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6637
Expires: Sat, 17 Aug 2024 02:53:54 GMT
Date: Sat, 17 Aug 2024 01:03:17 GMT
Connection: keep-alive

r11.o.lencr.org/

23.33.119.27

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-15

Last Seen2024-08-19

Times Seen45417

Size504 B (504 bytes)

MD53c14cfb85dc9ceb923d7d3c3648719d2

SHA110ea83f83398870f50ca771216ad77bd95aa66cc

SHA256bc868b2a34fe0c66d7a2dc1754676cc4031891c797fdd23e82d135559bd82c1b

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BC868B2A34FE0C66D7A2DC1754676CC4031891C797FDD23E82D135559BD82C1B"
Last-Modified: Thu, 15 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6637
Expires: Sat, 17 Aug 2024 02:53:54 GMT
Date: Sat, 17 Aug 2024 01:03:17 GMT
Connection: keep-alive

r11.o.lencr.org/

23.33.119.27

504 B

URL

r11.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-15

Last Seen2024-08-19

Times Seen45417

Size504 B (504 bytes)

MD53c14cfb85dc9ceb923d7d3c3648719d2

SHA110ea83f83398870f50ca771216ad77bd95aa66cc

SHA256bc868b2a34fe0c66d7a2dc1754676cc4031891c797fdd23e82d135559bd82c1b

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BC868B2A34FE0C66D7A2DC1754676CC4031891C797FDD23E82D135559BD82C1B"
Last-Modified: Thu, 15 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6637
Expires: Sat, 17 Aug 2024 02:53:54 GMT
Date: Sat, 17 Aug 2024 01:03:17 GMT
Connection: keep-alive