| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash69ac381587cbcd344562e8ce27b2c1c0 17667de0de8b6f16b857c46d3fdeda988995cb6c 0a5438f945682c1186d43ee5af17d4f7ae4e5198d4da12c537f7a94ced0ee6c3
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0A5438F945682C1186D43EE5AF17D4F7AE4E5198D4DA12C537F7A94CED0EE6C3"
Last-Modified: Mon, 07 Oct 2024 04:57:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5000
Expires: Mon, 07 Oct 2024 21:54:31 GMT
Date: Mon, 07 Oct 2024 20:31:11 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash296729715878c00210e10a63fd1c5cc3 0aaf5f4ac54e7676e7eaa8c5a8e716dea722e4f4 ca5641c89cebe1a6c17ad1f559e24740cb781364ef8a7c67cf43b912e6572dee
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "CA5641C89CEBE1A6C17AD1F559E24740CB781364EF8A7C67CF43B912E6572DEE"
Last-Modified: Sat, 05 Oct 2024 16:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4681
Expires: Mon, 07 Oct 2024 21:49:12 GMT
Date: Mon, 07 Oct 2024 20:31:11 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hasha3efcda1a9e998d5544071b0c97e2bce 95295765d8bb2b090d2daac1e33901c3d882486f 692b8ab76640fa1991a613de0d236d9f805d432d1807574d3e434aa197f261fc
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "692B8AB76640FA1991A613DE0D236D9F805D432D1807574D3E434AA197F261FC"
Last-Modified: Sat, 05 Oct 2024 16:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12874
Expires: Tue, 08 Oct 2024 00:05:45 GMT
Date: Mon, 07 Oct 2024 20:31:11 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash1c6ec54110f6660628ae2b384e9db497 60ea2745eec8480cb26cc9f830ce11a59b1fd0a6 947763a82d6d4a247a00032dab950c3911e201ce626fe9c87d8c6254635fdd3d
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "947763A82D6D4A247A00032DAB950C3911E201CE626FE9C87D8C6254635FDD3D"
Last-Modified: Mon, 07 Oct 2024 18:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16758
Expires: Tue, 08 Oct 2024 01:10:30 GMT
Date: Mon, 07 Oct 2024 20:31:12 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash5cfa8968322109d1671efc97fd0317cc 90820c0c1011197a063c2e59a03bc298b3345a8c 681e7a9712bd9806436c58ad3ab7757431f674653ddcf638710196630233af3c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "681E7A9712BD9806436C58AD3AB7757431F674653DDCF638710196630233AF3C"
Last-Modified: Mon, 07 Oct 2024 16:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7637
Expires: Mon, 07 Oct 2024 22:38:29 GMT
Date: Mon, 07 Oct 2024 20:31:12 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash88ecdc02305027df6cfdfa0c11d82495 a20362c18215191edb00ab3af696274cf7226b3b 76818500a72e8beaed804b25543379dbbbb07d7d2c8502ab3ad923765bc11b8b
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "76818500A72E8BEAED804B25543379DBBBB07D7D2C8502AB3AD923765BC11B8B"
Last-Modified: Sat, 05 Oct 2024 16:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11298
Expires: Mon, 07 Oct 2024 23:39:30 GMT
Date: Mon, 07 Oct 2024 20:31:12 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash3f01b22c214fa0b2794a9745a018498a 59d7309c87c42a80521532cc94b7941b556873ec 82d5d86c1461ef88df95852e067bbdaae1788a0d12ce2e388c1edae0f29cc34d
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "82D5D86C1461EF88DF95852E067BBDAAE1788A0D12CE2E388C1EDAE0F29CC34D"
Last-Modified: Sat, 05 Oct 2024 16:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5750
Expires: Mon, 07 Oct 2024 22:07:03 GMT
Date: Mon, 07 Oct 2024 20:31:13 GMT
Connection: keep-alive
|
|
| 107.175.242.80/430/ec/salluireallymissyousallutrulyiloveyousalluialwaysloveyoualotithallmyheartyouaremyheartbeatyouaremysweetbabygirl_______sheismygirlforever.doc | 107.175.242.80 | 200 OK | 102 kB |
URL User Request GET HTTP/1.1107.175.242.80/430/ec/salluireallymissyousallutrulyiloveyousalluialwaysloveyoualotithallmyheartyouaremyheartbeatyouaremysweetbabygirl_______sheismygirlforever.doc IP107.175.242.80:80 ASN#36352 AS-COLOCROSSING
File typeRich Text Format data, version 1 Size102 kB (101678 bytes) Hash72dd90d54b9dcfe691ff308a9cacb72f 79997f6339815718fdd17e5e4c47a6ea08a5549f 7a8ccad40f6f34469ac64889b09cf44c53d2bb58dbb5e900abcc9703fa62ccb4
Analyzer | Verdict | Alert | Public Nextron YARA rules | malware | Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents. | Quad9 DNS | malicious | Sinkholed |
GET /430/ec/salluireallymissyousallutrulyiloveyousalluialwaysloveyoualotithallmyheartyouaremyheartbeatyouaremysweetbabygirl_______sheismygirlforever.doc HTTP/1.1
Host: 107.175.242.80
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 07 Oct 2024 20:31:13 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
Last-Modified: Wed, 18 Sep 2024 17:01:31 GMT
ETag: "18d2e-62267c1f491a0"
Accept-Ranges: bytes
Content-Length: 101678
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/msword
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashad058234ca3eee365c5dc4f20427d742 5df45ed837ade1be00d2325fabd33ff786dd66a1 b5d886a9bb731872d38a96b9d475097cc3bd53633efe2c48669eb16ff5e4ec56
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B5D886A9BB731872D38A96B9D475097CC3BD53633EFE2C48669EB16FF5E4EC56"
Last-Modified: Mon, 07 Oct 2024 13:13:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6729
Expires: Mon, 07 Oct 2024 22:23:23 GMT
Date: Mon, 07 Oct 2024 20:31:14 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashad058234ca3eee365c5dc4f20427d742 5df45ed837ade1be00d2325fabd33ff786dd66a1 b5d886a9bb731872d38a96b9d475097cc3bd53633efe2c48669eb16ff5e4ec56
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B5D886A9BB731872D38A96B9D475097CC3BD53633EFE2C48669EB16FF5E4EC56"
Last-Modified: Mon, 07 Oct 2024 13:13:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6729
Expires: Mon, 07 Oct 2024 22:23:23 GMT
Date: Mon, 07 Oct 2024 20:31:14 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashad058234ca3eee365c5dc4f20427d742 5df45ed837ade1be00d2325fabd33ff786dd66a1 b5d886a9bb731872d38a96b9d475097cc3bd53633efe2c48669eb16ff5e4ec56
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B5D886A9BB731872D38A96B9D475097CC3BD53633EFE2C48669EB16FF5E4EC56"
Last-Modified: Mon, 07 Oct 2024 13:13:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6729
Expires: Mon, 07 Oct 2024 22:23:23 GMT
Date: Mon, 07 Oct 2024 20:31:14 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashad058234ca3eee365c5dc4f20427d742 5df45ed837ade1be00d2325fabd33ff786dd66a1 b5d886a9bb731872d38a96b9d475097cc3bd53633efe2c48669eb16ff5e4ec56
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B5D886A9BB731872D38A96B9D475097CC3BD53633EFE2C48669EB16FF5E4EC56"
Last-Modified: Mon, 07 Oct 2024 13:13:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6818
Expires: Mon, 07 Oct 2024 22:24:52 GMT
Date: Mon, 07 Oct 2024 20:31:14 GMT
Connection: keep-alive
|
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml | 35.244.181.201 | | 5.8 kB |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP35.244.181.201:0 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typegzip compressed data, max speed, from Unix Hashf0f7c1c9492ac05cfcbf7f43fd710e04 76dee75267998453a878cfd46a5cac025dd7b816 a7f5fdc0ad2b47081e8752adac799751a10d0f50a2c418c683e8bc82d61a5e05
GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 07 Oct 2024 20:31:31 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2024-11-22-13-24-38.chain; p384ecdsa=cVTW9J-h4Xzqu8jINC71Q27a6jM11wIW4CLo2_j3M4tNupruLPz27p37XKSjygnGbuHXyGYfWUKG6p1oJTzYW_1YDIkvUBGS3-4cTAqXLL3mCnmiRY9pVwCc5_EaJzkf
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|
|