| www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ |  142.250.74.136 | 200 OK | 61 kB |
URL GET HTTP/3www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ IP142.250.74.136:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com Fingerprint1E:33:2E:4B:C3:51:05:B7:73:DC:21:BF:3E:02:B3:16:D8:0B:AB:BB ValidityMon, 18 Mar 2024 19:37:14 GMT - Mon, 10 Jun 2024 19:37:13 GMT
File typeJavaScript source, ASCII text, with very long lines (3707) Hash0d7343494fd009928bec8197ead00dab 1cc00629c215cf1198ceb496b9a4b5255c844d22 968c11c1323d6862167167a9eca1461f7153d333e3f863ef9c14669a7e3acb05
GET /gtm.js?id=GTM-N2FTFQ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 25 Apr 2024 04:08:00 GMT
expires: Thu, 25 Apr 2024 04:08:00 GMT
cache-control: private, max-age=900
last-modified: Thu, 25 Apr 2024 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 61309
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 172.210.44.157/ruxitagentjs_ICA2Vfghjqru_10235220309135426.js | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/ruxitagentjs_ICA2Vfghjqru_10235220309135426.js IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ruxitagentjs_ICA2Vfghjqru_10235220309135426.js HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/renner/js/3.bundle-d6a6baaa0dc3faae26db.js | 172.210.44.157 | 200 OK | 38 kB |
URL GET HTTP/1.1172.210.44.157/renner/js/3.bundle-d6a6baaa0dc3faae26db.js IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (37515), with no line terminators Hash39e850b2f21e44f7c83c5bfbf71a1a23 3610d538fb093eec2940764418eff51e72fe8f8f 4ab4958c63bd706e031161717896c8fbe22f133a4c9ff285cc053e75ceb13d06
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/js/3.bundle-d6a6baaa0dc3faae26db.js HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:09:38 GMT
ETag: "93a0-5dae925b10137"
Accept-Ranges: bytes
Content-Length: 37792
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/javascript
|
|
| www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ | 142.250.74.136 | 200 OK | 61 kB |
URL GET HTTP/3www.googletagmanager.com/gtm.js?id=GTM-N2FTFQ IP142.250.74.136:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com Fingerprint1E:33:2E:4B:C3:51:05:B7:73:DC:21:BF:3E:02:B3:16:D8:0B:AB:BB ValidityMon, 18 Mar 2024 19:37:14 GMT - Mon, 10 Jun 2024 19:37:13 GMT
File typeJavaScript source, ASCII text, with very long lines (3707) Hash0ccea5b201db8599513d57e55e9fab81 01afdf4f8062886c9d2a613920040bf51916443e 972dcd049e3302fe94df70f16b996fd22dfd736312ae38a12b012301166b2912
GET /gtm.js?id=GTM-N2FTFQ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 25 Apr 2024 04:08:00 GMT
expires: Thu, 25 Apr 2024 04:08:00 GMT
cache-control: private, max-age=900
last-modified: Thu, 25 Apr 2024 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 61315
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| 172.210.44.157/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/js/2.bundle-d410ea60e5b46c298cdd.js HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| | 172.210.44.157 | 200 OK | 751 kB |
URL User Request GET HTTP/1.1IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (1242), with CRLF line terminators Size751 kB (751230 bytes) Hash263b5ba9baa9cef8e244ffdfe5b21950 3b6c1a19ecbd8352289c51ffeaa766679a6e5140 99c8f6021b6ba7c6fb35cce9df0b19026daee7e81802daa9062ebe5870196c4a
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | Lojas Renner | | Quad9 DNS | malicious | Sinkholed |
GET /renner/ HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:07:59 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
X-Powered-By: PHP/8.0.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
|
|
| ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js | 142.250.74.170 | 200 OK | 30 kB |
URL GET HTTP/2ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js IP142.250.74.170:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2 ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT
File typeJavaScript source, ASCII text, with very long lines (65451) Hasha09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
GET /ajax/libs/jquery/3.3.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30399
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 11:06:16 GMT
expires: Fri, 18 Apr 2025 11:06:16 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 579704
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 172.210.44.157/renner/vectors/app-store-badge.svg | 172.210.44.157 | 200 OK | 14 kB |
URL GET HTTP/1.1172.210.44.157/renner/vectors/app-store-badge.svg IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeSVG Scalable Vector Graphics image Hash34683b771a7e7e258b2aaa2e1d7b37f1 cbd7c1053fe89019d386d1676ffa086ddbf0a8b5 3dd08d21a5c010294a50355af3565a50d08ea4aef83e822114be29171209f109
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/vectors/app-store-badge.svg HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:21:50 GMT
ETag: "37b6-5dae951579e0e"
Accept-Ranges: bytes
Content-Length: 14262
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml
|
|
| 172.210.44.157/renner/vectors/google-play-badge.svg | 172.210.44.157 | 200 OK | 11 kB |
URL GET HTTP/1.1172.210.44.157/renner/vectors/google-play-badge.svg IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeSVG Scalable Vector Graphics image Hashf1a5450f21493625afbc619436ad14e0 e641815fd9bd38b5827c9e65821ed5a8fa05b0fb 8827f96ace2afe4aeff4c33db4ac86193f38a62cb30d9fbba949e0b72c2a55ff
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/vectors/google-play-badge.svg HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:21:29 GMT
ETag: "2a22-5dae9501c4b83"
Accept-Ranges: bytes
Content-Length: 10786
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/svg+xml
|
|
| 172.210.44.157/renner/images/celular-login.png | 172.210.44.157 | 200 OK | 155 kB |
URL GET HTTP/1.1172.210.44.157/renner/images/celular-login.png IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typePNG image data, 379 x 485, 8-bit/color RGBA, non-interlaced Size155 kB (155176 bytes) Hashe624d089f9b2fff768b6b592285a4f12 bef94cbbf3c93e3cc8cc45975065216efc046336 7db4ada57262fbacd47bef4e96e3cedda276b9267e6ca4d20adeeb1c24d870b6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/images/celular-login.png HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:20:16 GMT
ETag: "25e28-5dae94bbad437"
Accept-Ranges: bytes
Content-Length: 155176
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/png
|
|
| 172.210.44.157/renner/fonts/Roboto-Regular.woff2 | 172.210.44.157 | 200 OK | 15 kB |
URL GET HTTP/1.1172.210.44.157/renner/fonts/Roboto-Regular.woff2 IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeWeb Open Font Format (Version 2), TrueType, length 14600, version 1.0 Hasha2647ffe169bbbd94a3238020354c732 0a59a3b17c93c1093c2514b3a9d51c91395aabd0 db44c6b7985f942465865cfe688770803ab464ec35fb9aefaeccc052e9b74b2a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/fonts/Roboto-Regular.woff2 HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:15:40 GMT
ETag: "3908-5dae93b4b0a6e"
Accept-Ranges: bytes
Content-Length: 14600
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff2
|
|
| 172.210.44.157/renner/fonts/Roboto-Bold.woff2 | 172.210.44.157 | 200 OK | 15 kB |
URL GET HTTP/1.1172.210.44.157/renner/fonts/Roboto-Bold.woff2 IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeWeb Open Font Format (Version 2), TrueType, length 14680, version 1.0 Hashaa3e87117db2b3c27801cbb8dfe40c6c a1118c5362e2dd34ac5cf34e135042c3ad827b58 36eea693231e39de5efd21718fea8fc98005b580b264522ffbef360939b8d75c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/fonts/Roboto-Bold.woff2 HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:17:00 GMT
ETag: "3958-5dae9400a908c"
Accept-Ranges: bytes
Content-Length: 14680
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff2
|
|
| 172.210.44.157/renner/vectors/google-play-badge-reverse.svg | 172.210.44.157 | 200 OK | 11 kB |
URL GET HTTP/1.1172.210.44.157/renner/vectors/google-play-badge-reverse.svg IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeSVG Scalable Vector Graphics image Hashdd500e2468aecaccb46e64859f38ed87 6922b1027cf980cf19ed84c94732c3b704798cc8 e946d863a136a09089fd275d574ff3346bad8327d4ef378c06af35872d9fe56d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/vectors/google-play-badge-reverse.svg HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:19:26 GMT
ETag: "2a25-5dae948c4dbd2"
Accept-Ranges: bytes
Content-Length: 10789
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/svg+xml
|
|
| 172.210.44.157/renner/fonts/Roboto-Black.woff2 | 172.210.44.157 | 200 OK | 15 kB |
URL GET HTTP/1.1172.210.44.157/renner/fonts/Roboto-Black.woff2 IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeWeb Open Font Format (Version 2), TrueType, length 14592, version 1.0 Hashfa058128ab6fcaa61257208d085b4d57 71c4e4b88c8049ef87ab6ede1ed4c9934eff778e 6e85391e451421ec1d47481273c0b97555ee880504b0fe96c5cec1edd4b0c57f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/fonts/Roboto-Black.woff2 HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:17:20 GMT
ETag: "3900-5dae9413d4259"
Accept-Ranges: bytes
Content-Length: 14592
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff2
|
|
| js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js | 54.230.111.72 | 200 OK | 124 kB |
URL GET HTTP/2js-cdn.dynatrace.com/jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js IP54.230.111.72:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subjectjs-cdn.dynatrace.com Fingerprint00:C2:9D:E0:2F:49:B9:A1:59:46:9D:82:34:00:08:3E:8C:37:9C:84 ValidityWed, 03 Jan 2024 00:00:00 GMT - Fri, 31 Jan 2025 23:59:59 GMT
File typegzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT) Size124 kB (123873 bytes) Hash99f12eaa43bcd326f5ac9ff22a4d3ce9 de86442d36b9abf9e8b64e63243953661472b2b2 0beb779b235a7119a82236487809be0bcab1595dc51bcc12fc9e71eb154a0e54
GET /jstag/157944990f8/bf73995led/189e25234ffe70ce_complete.js HTTP/1.1
Host: js-cdn.dynatrace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript;charset=utf-8
date: Thu, 25 Apr 2024 03:39:49 GMT
timing-allow-origin: *
x-oneagent-js-injection: true
traffic-source: UNKNOWN
dynatrace-response-source: Cluster
dynatrace-response-id: AVTPOGQ0SXPI
expires: Thu, 25 Apr 2024 04:39:49 GMT
cache-control: public, max-age=3600
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: LkLYq-NQsyLuz6YgqOv1fhItB-yXBsgXNUNUmtp_kvBc3BTPb7bNqg==
age: 1691
X-Firefox-Spdy: h2
|
|
| 172.210.44.157/cartoes-renner/vectors/whatsapp.svg | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/vectors/whatsapp.svg IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/vectors/whatsapp.svg HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Regular.woff | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Regular.woff IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Regular.woff HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Bold.woff | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Bold.woff IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Bold.woff HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/renner/fonts/Roboto-Light.woff2 | 172.210.44.157 | 200 OK | 15 kB |
URL GET HTTP/1.1172.210.44.157/renner/fonts/Roboto-Light.woff2 IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeWeb Open Font Format (Version 2), TrueType, length 14696, version 1.0 Hash68b24b48f11ff8e947976b529c6f5941 87d74c6bad63ee41c1bdc4382b05974e03c393e0 4e89ebb893667ecee54ecb976930e4b7172bb8f64c062fdc869863a72fa0fb21
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/fonts/Roboto-Light.woff2 HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:14:17 GMT
ETag: "3968-5dae93652fc3d"
Accept-Ranges: bytes
Content-Length: 14696
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: font/woff2
|
|
| cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ |  54.207.117.59 | 200 OK | 9.2 kB |
URL GET HTTP/1.1cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ IP54.207.117.59:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.pmweb.com.br FingerprintD3:8E:AA:6A:63:3C:C9:26:32:3B:08:0A:3C:1B:CA:80:CF:45:EF:C3 ValidityThu, 20 Jul 2023 00:00:00 GMT - Fri, 16 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (22651), with no line terminators Hash901b9ac2e48f558fcbb4df2bd0216e70 8af18bbefb6da1cc3cad31d2a598c09bab0d78a2 94c081e2ae2f0618d1661bb9267a2ae65addb921bef6464fb1dd7169bd5f55c6
GET /df/tag.js?id=PM-N2FTFQ HTTP/1.1
Host: cdn.pmweb.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 25 Apr 2024 04:08:00 GMT
ETag: W/"66105c3a-587b"
Expires: Thu, 25 Apr 2024 04:13:00 GMT
Last-Modified: Fri, 05 Apr 2024 20:16:58 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Vary: Accept-Encoding
Content-Length: 9197
Connection: keep-alive
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Black.woff | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Black.woff IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Black.woff HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/renner/js/vendors.bundle-859d26788acf215a201a.js | 172.210.44.157 | 200 OK | 686 kB |
URL GET HTTP/1.1172.210.44.157/renner/js/vendors.bundle-859d26788acf215a201a.js IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65518), with no line terminators Size686 kB (686470 bytes) Hashba8db3e4745ef4402e6c1011c9227191 e155466c79dd3823ff0ce99802093d80e40ebd1f 40d596025119e99448ba247d9ad58248525a484a971dabdd366e0724453e3e36
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/js/vendors.bundle-859d26788acf215a201a.js HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:22:58 GMT
ETag: "a7986-5dae955635fe5"
Accept-Ranges: bytes
Content-Length: 686470
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/javascript
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Regular.ttf | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Regular.ttf IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Regular.ttf HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Bold.ttf | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Bold.ttf IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Bold.ttf HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Light.woff | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Light.woff IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Light.woff HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Black.ttf | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Black.ttf IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Black.ttf HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-; _pm_id=828121714018081145; _pm_sid=889561714018081145
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css | 142.250.74.35 | 404 Not Found | 1.6 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css IP142.250.74.35:443
Requested byhttps://www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1136) Hash617f87016391056cbfa3087f986bd536 57c63621d5e3657f9add4229143eb54909902bd0 a38edb7c355cb03d028c7aebd49d71de4b673368cbf77dec0c95088930a90c73
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Thu, 25 Apr 2024 04:08:01 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1620
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 172.210.44.157/cartoes-renner/fonts/Roboto-Light.ttf | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/fonts/Roboto-Light.ttf IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/fonts/Roboto-Light.ttf HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-; _pm_id=828121714018081145; _pm_sid=889561714018081145
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ | 54.207.117.59 | 200 OK | 9.2 kB |
URL GET HTTP/1.1cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ IP54.207.117.59:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.pmweb.com.br FingerprintD3:8E:AA:6A:63:3C:C9:26:32:3B:08:0A:3C:1B:CA:80:CF:45:EF:C3 ValidityThu, 20 Jul 2023 00:00:00 GMT - Fri, 16 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (22651), with no line terminators Hash901b9ac2e48f558fcbb4df2bd0216e70 8af18bbefb6da1cc3cad31d2a598c09bab0d78a2 94c081e2ae2f0618d1661bb9267a2ae65addb921bef6464fb1dd7169bd5f55c6
GET /df/tag.js?id=PM-N2FTFQ HTTP/1.1
Host: cdn.pmweb.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 25 Apr 2024 04:08:01 GMT
ETag: W/"66105c3a-587b"
Expires: Thu, 25 Apr 2024 04:13:01 GMT
Last-Modified: Fri, 05 Apr 2024 20:16:58 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Vary: Accept-Encoding
Content-Length: 9197
Connection: keep-alive
|
|
| cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ | 54.207.117.59 | 200 OK | 9.2 kB |
URL GET HTTP/1.1cdn.pmweb.com.br/df/tag.js?id=PM-N2FTFQ IP54.207.117.59:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.pmweb.com.br FingerprintD3:8E:AA:6A:63:3C:C9:26:32:3B:08:0A:3C:1B:CA:80:CF:45:EF:C3 ValidityThu, 20 Jul 2023 00:00:00 GMT - Fri, 16 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (22651), with no line terminators Hash901b9ac2e48f558fcbb4df2bd0216e70 8af18bbefb6da1cc3cad31d2a598c09bab0d78a2 94c081e2ae2f0618d1661bb9267a2ae65addb921bef6464fb1dd7169bd5f55c6
GET /df/tag.js?id=PM-N2FTFQ HTTP/1.1
Host: cdn.pmweb.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=300
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 25 Apr 2024 04:08:01 GMT
ETag: W/"66105c3a-587b"
Expires: Thu, 25 Apr 2024 04:13:01 GMT
Last-Modified: Fri, 05 Apr 2024 20:16:58 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Vary: Accept-Encoding
Content-Length: 9197
Connection: keep-alive
|
|
| s3-sa-east-1.amazonaws.com/frame-image-br/bg.png?x-id=real&x-r= | 16.12.2.24 | 200 OK | 0 B |
URL GET HTTP/1.1s3-sa-east-1.amazonaws.com/frame-image-br/bg.png?x-id=real&x-r= IP16.12.2.24:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.s3-sa-east-1.amazonaws.com FingerprintA4:96:28:BF:99:1D:CD:5C:DA:DB:06:60:06:B7:EE:EA:FD:25:51:1B ValidityFri, 12 Apr 2024 00:00:00 GMT - Sun, 30 Mar 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /frame-image-br/bg.png?x-id=real&x-r= HTTP/1.1
Host: s3-sa-east-1.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 2OT+XUPcGjBrCDp/jl4/JQtfUB819aFoOER1Mq5Fv5i+5qf8FvmuabwWTznylfkWiBN0H7bxh4M=
x-amz-request-id: MX1R4E8E2AGCEA37
Date: Thu, 25 Apr 2024 04:08:02 GMT
Last-Modified: Thu, 04 May 2017 08:21:21 GMT
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-meta-s3cmd-attrs: uid:502/gname:staff/uname:user/gid:20/mode:33188/mtime:1493416832/atime:1493796970/md5:d41d8cd98f00b204e9800998ecf8427e/ctime:1493416832
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 0
|
|
| www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css | 142.250.74.35 | 404 Not Found | 1.6 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css IP142.250.74.35:443
Requested byhttps://www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1136) Hash617f87016391056cbfa3087f986bd536 57c63621d5e3657f9add4229143eb54909902bd0 a38edb7c355cb03d028c7aebd49d71de4b673368cbf77dec0c95088930a90c73
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/styles__ltr.css HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Thu, 25 Apr 2024 04:08:01 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1620
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js | 142.250.74.35 | 404 Not Found | 1.6 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js IP142.250.74.35:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1136) Hash3ab3a3944f881ad31c89d08f5e8bb435 3dffffd915706b6f3a4be103ef99b293fd89d2dc a2b4316623904892860acbdf726e13f1b33e07244baaae92fb9bb0c01e70d69c
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Thu, 25 Apr 2024 04:08:01 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1624
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__pt_br.js | 142.250.74.35 | 200 OK | 207 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__pt_br.js IP142.250.74.35:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeJavaScript source, ASCII text, with very long lines (610) Size207 kB (206865 bytes) Hash7f66b19aeb71a7b5d6609e38bf63d5e7 1362c5fa182be06d50883c08b1fb802f140d167c ef33c351f278fc62df38c57fdb984fe6f726122b88908b5716c4d7f3c06f61c1
GET /recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 206865
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 16:34:45 GMT
expires: Wed, 23 Apr 2025 16:34:45 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 127996
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js | 142.250.74.35 | 404 Not Found | 1.6 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js IP142.250.74.35:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1136) Hash3ab3a3944f881ad31c89d08f5e8bb435 3dffffd915706b6f3a4be103ef99b293fd89d2dc a2b4316623904892860acbdf726e13f1b33e07244baaae92fb9bb0c01e70d69c
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.google.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Thu, 25 Apr 2024 04:08:01 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1624
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| 172.210.44.157/cartoes-renner/images/lojas-renner.png | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/images/lojas-renner.png IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/images/lojas-renner.png HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-; _pm_id=828121714018081145; _pm_sid=889561714018081145
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 172.210.44.157/cartoes-renner/images/favicon.ico | 172.210.44.157 | 404 Not Found | 300 B |
URL GET HTTP/1.1172.210.44.157/cartoes-renner/images/favicon.ico IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeHTML document, ASCII text Hasha3b2f179c14a24d4ce2071b8c380b892 c0336be20ca3de2a7cc25261724c47bb249ec5bd 027234dc2d1b3a9465d1e8620282b651d2f7674584e3cc6aa1c631bd13f05af5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cartoes-renner/images/favicon.ico HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-; _pm_id=828121714018081145; _pm_sid=889561714018081145
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 04:08:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js | 142.250.74.35 | 404 Not Found | 1.6 kB |
URL GET HTTP/3www.gstatic.com/recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js IP142.250.74.35:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1136) Hash3ab3a3944f881ad31c89d08f5e8bb435 3dffffd915706b6f3a4be103ef99b293fd89d2dc a2b4316623904892860acbdf726e13f1b33e07244baaae92fb9bb0c01e70d69c
GET /recaptcha/releases/2uoiJ4hP3NUoP9v_eBNfU6CR/recaptcha__pt_br.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
date: Thu, 25 Apr 2024 04:08:01 GMT
content-type: text/html; charset=UTF-8
server: sffe
content-length: 1624
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| df.pmweb.com.br/push/?aid=PM-N2FTFQ&cid=828121714018081145&sid=889561714018081145&pvw=13705978-6886-463d-a6c5-85baa71d5d98&v=1.19.0&rs=1280x1024&tt=Cart%C3%B5es%20Renner&ws=1280x1024&os=Linux%20x86_64&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&url=http%3A%2F%2F172.210.44.157%2Frenner%2F&add=%7B%22err%22%3A%5B%22unable%20to%20decode%20object%22%5D%7D | 177.71.136.10 | 200 OK | 2 B |
URL GET HTTP/1.1df.pmweb.com.br/push/?aid=PM-N2FTFQ&cid=828121714018081145&sid=889561714018081145&pvw=13705978-6886-463d-a6c5-85baa71d5d98&v=1.19.0&rs=1280x1024&tt=Cart%C3%B5es%20Renner&ws=1280x1024&os=Linux%20x86_64&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&url=http%3A%2F%2F172.210.44.157%2Frenner%2F&add=%7B%22err%22%3A%5B%22unable%20to%20decode%20object%22%5D%7D IP177.71.136.10:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.pmweb.com.br FingerprintD3:8E:AA:6A:63:3C:C9:26:32:3B:08:0A:3C:1B:CA:80:CF:45:EF:C3 ValidityThu, 20 Jul 2023 00:00:00 GMT - Fri, 16 Aug 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hash50585be4e3159a71c874c590d2ba12ec fb17882585bbfe9c55733a6e46a265ddaea6957a 54d626e08c1c802b305dad30b7e54a82f102390cc92c7d4db112048935236e9c
GET /push/?aid=PM-N2FTFQ&cid=828121714018081145&sid=889561714018081145&pvw=13705978-6886-463d-a6c5-85baa71d5d98&v=1.19.0&rs=1280x1024&tt=Cart%C3%B5es%20Renner&ws=1280x1024&os=Linux%20x86_64&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&url=http%3A%2F%2F172.210.44.157%2Frenner%2F&add=%7B%22err%22%3A%5B%22unable%20to%20decode%20object%22%5D%7D HTTP/1.1
Host: df.pmweb.com.br
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://172.210.44.157
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/plain
Date: Thu, 25 Apr 2024 04:08:02 GMT
Expires: 0
Pragma: no-cache
Server: nginx
Set-Cookie: _pm_uid=828121714018081145; path=/; domain=pmweb.com.br; secure; Expires=Sat, 25-Apr-2026 04:08:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Content-Length: 2
Connection: keep-alive
|
|
| bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H&svrid=-36&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1647975459642&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=2336403876&en=ovxxhecl&end=1 | 52.71.103.222 | 200 OK | 900 B |
URL POST HTTP/2bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H&svrid=-36&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1647975459642&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=2336403876&en=ovxxhecl&end=1 IP52.71.103.222:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.bf.dynatrace.com Fingerprint9F:32:92:3C:DC:65:2F:BC:0C:E6:C3:5F:F2:BF:B2:39:10:65:42:E1 ValidityWed, 20 Dec 2023 00:00:00 GMT - Thu, 16 Jan 2025 23:59:59 GMT
File typeASCII text, with very long lines (900), with no line terminators Hash3c12811f900b8a58153bfd17085a5fb9 0059d8a0a1ae2bbc41e99ed48f11ced542401efa 9bc7366970fe6f4466cc02d5dab576f3c3c9f541a3e5fb52b79c5d098b5d7e15
POST /bf?type=js3&sn=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H&svrid=-36&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1647975459642&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=2336403876&en=ovxxhecl&end=1 HTTP/1.1
Host: bf73995led.bf.dynatrace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 521
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 25 Apr 2024 04:08:02 GMT
content-type: text/plain;charset=utf-8
content-length: 900
set-cookie: dtCookie=v_4_srv_15_sn_C13E8A5E9431D743BB19F0490F073016_perc_100000_ol_0_mul_1_app-3Aea7c4b59f27d43eb_1_rcs-3Acss_0; Path=/; Domain=.dynatrace.com
x-oneagent-js-injection: true
access-control-allow-origin: http://172.210.44.157
cache-control: no-cache
X-Firefox-Spdy: h2
|
|
| bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_4_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1_rcs-3Acss_0&svrid=4&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1714014001455&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=2208964213&en=ovxxhecl&end=1 | 52.71.103.222 | 200 OK | 221 B |
URL POST HTTP/2bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_4_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1_rcs-3Acss_0&svrid=4&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1714014001455&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=2208964213&en=ovxxhecl&end=1 IP52.71.103.222:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.bf.dynatrace.com Fingerprint9F:32:92:3C:DC:65:2F:BC:0C:E6:C3:5F:F2:BF:B2:39:10:65:42:E1 ValidityWed, 20 Dec 2023 00:00:00 GMT - Thu, 16 Jan 2025 23:59:59 GMT
File typeASCII text, with no line terminators Hash57bc2fa86f02d9d7d025502257e8bc98 bf4f46ec216a410a0d1f255f95ed4f25215462ed 49d7a51ffc86333e03dde9cacf5160886a66762a45853d86474da43434882f80
POST /bf?type=js3&sn=v_4_srv_4_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1_rcs-3Acss_0&svrid=4&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1714014001455&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=2208964213&en=ovxxhecl&end=1 HTTP/1.1
Host: bf73995led.bf.dynatrace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1167
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 25 Apr 2024 04:08:03 GMT
content-type: text/plain;charset=utf-8
content-length: 221
set-cookie: dtCookie=v_4_srv_12_sn_1717D39FF3A721DB1FB1CB85F2912C45_perc_100000_ol_0_mul_1_app-3Aea7c4b59f27d43eb_1_rcs-3Acss_0; Path=/; Domain=.dynatrace.com
x-oneagent-js-injection: true
access-control-allow-origin: http://172.210.44.157
cache-control: no-cache
X-Firefox-Spdy: h2
|
|
| bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_4_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1_rcs-3Acss_0&svrid=4&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1714014001455&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=1004863624&en=ovxxhecl&end=1 | 52.71.103.222 | 200 OK | 221 B |
URL POST HTTP/2bf73995led.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_4_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1_rcs-3Acss_0&svrid=4&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1714014001455&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=1004863624&en=ovxxhecl&end=1 IP52.71.103.222:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerAmazon Subject*.bf.dynatrace.com Fingerprint9F:32:92:3C:DC:65:2F:BC:0C:E6:C3:5F:F2:BF:B2:39:10:65:42:E1 ValidityWed, 20 Dec 2023 00:00:00 GMT - Thu, 16 Jan 2025 23:59:59 GMT
File typeASCII text, with no line terminators Hash57bc2fa86f02d9d7d025502257e8bc98 bf4f46ec216a410a0d1f255f95ed4f25215462ed 49d7a51ffc86333e03dde9cacf5160886a66762a45853d86474da43434882f80
POST /bf?type=js3&sn=v_4_srv_4_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H_app-3A189e25234ffe70ce_1_ol_0_perc_100000_mul_1_rcs-3Acss_0&svrid=4&flavor=cors&vi=HAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0&modifiedSince=1714014001455&rf=http%3A%2F%2F172.210.44.157%2Frenner%2F&bp=3&app=189e25234ffe70ce&crc=1004863624&en=ovxxhecl&end=1 HTTP/1.1
Host: bf73995led.bf.dynatrace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 4855
Origin: http://172.210.44.157
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 25 Apr 2024 04:08:05 GMT
content-type: text/plain;charset=utf-8
content-length: 221
set-cookie: dtCookie=v_4_srv_3_sn_CCEAB886E72DFDF8BC8665B11DEF0833_perc_100000_ol_0_mul_1_app-3Aea7c4b59f27d43eb_1_rcs-3Acss_0; Path=/; Domain=.dynatrace.com
x-oneagent-js-injection: true
access-control-allow-origin: http://172.210.44.157
cache-control: no-cache
X-Firefox-Spdy: h2
|
|
| 172.210.44.157/renner/vectors/bg-login.svg | 172.210.44.157 | 200 OK | 664 B |
URL GET HTTP/1.1172.210.44.157/renner/vectors/bg-login.svg IP172.210.44.157:80 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttp://172.210.44.157/renner/
File typeSVG Scalable Vector Graphics image Hashb6eb799754d3fd9d6ca16ffe0341bf6c 03e2c6def0aaf269bd3f6cbf523df870873a8084 547e68650828e457052f4ecfcc1b3e8953013da307e73a3a53be723319cef08b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /renner/vectors/bg-login.svg HTTP/1.1
Host: 172.210.44.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/renner/
Cookie: dtCookie=v_4_srv_-2D36_sn_NDOOSS2OEBL2VJ2PT29E55TNVP1MDF7H; rxVisitor=1714018080453VK16KNEG052UEVQOVQQHK822JOQIRRTS; dtPC=-36$418080449_845h1vHAWMNPECLOHUKQJGLKUPUMKAFFPKMTCE-0e0; rxvt=1714019880459|1714018080454; dtSa=-
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 04:08:00 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Wed, 23 Mar 2022 21:25:11 GMT
ETag: "298-5dae95d56eb6a"
Accept-Ranges: bytes
Content-Length: 664
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/svg+xml
|
|
| www.google.com/recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR | 142.250.74.164 | 200 OK | 913 B |
URL GET HTTP/2www.google.com/recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR IP142.250.74.164:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subjectwww.google.com FingerprintCD:48:2A:0C:60:1D:37:5A:D4:D5:A9:F7:DE:A0:2B:5E:2F:29:76:73 ValidityMon, 18 Mar 2024 20:38:49 GMT - Mon, 10 Jun 2024 20:38:48 GMT
File typeJavaScript source, ASCII text, with very long lines (913), with no line terminators Hashcd987ab2dc4e34ee542f41fd87e54392 c0d5e3232017cc273455dd04cc996c70a4b5bb6a b9df6469883d7890b891aff2da772f69b20161cd2768aae4275f384693ec38f9
GET /recaptcha/api.js?onload=onLoadRecaptcha&render=explicit&hl=pt-BR HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Thu, 25 Apr 2024 04:08:00 GMT
date: Thu, 25 Apr 2024 04:08:00 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.google.com/recaptcha/api2/anchor?ar=1&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV&co=aHR0cHM6Ly93d3cucmVhbGl6ZXNvbHVjb2VzZmluYW5jZWlyYXMuY29tLmJyOjQ0Mw..&hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&size=invisible&badge=inline&cb=uii3yowxuayz | 142.250.74.164 | 200 OK | 46 kB |
URL GET HTTP/2www.google.com/recaptcha/api2/anchor?ar=1&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV&co=aHR0cHM6Ly93d3cucmVhbGl6ZXNvbHVjb2VzZmluYW5jZWlyYXMuY29tLmJyOjQ0Mw..&hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&size=invisible&badge=inline&cb=uii3yowxuayz IP142.250.74.164:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subjectwww.google.com FingerprintCD:48:2A:0C:60:1D:37:5A:D4:D5:A9:F7:DE:A0:2B:5E:2F:29:76:73 ValidityMon, 18 Mar 2024 20:38:49 GMT - Mon, 10 Jun 2024 20:38:48 GMT
File typeHTML document, ASCII text, with very long lines (36934) Hashbcfc354323f0da74f7bdccc615d55f14 dc0ec14b81f60a69b8e811141766f146e20e3d23 3e4d4c304b18d92b3cb759b5caf0c91600f1442e2d9c73d4fd232592d878e20b
GET /recaptcha/api2/anchor?ar=1&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV&co=aHR0cHM6Ly93d3cucmVhbGl6ZXNvbHVjb2VzZmluYW5jZWlyYXMuY29tLmJyOjQ0Mw..&hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&size=invisible&badge=inline&cb=uii3yowxuayz HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 25 Apr 2024 04:08:00 GMT
content-security-policy: script-src 'nonce-JgYWxgybQmh_dgBHVaixbw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV | 142.250.74.164 | 200 OK | 7.5 kB |
URL GET HTTP/3www.google.com/recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV IP142.250.74.164:443
Requested byhttp://172.210.44.157/renner/ CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint70:CC:1A:8A:58:6C:1F:6D:43:AE:66:75:89:F7:99:7B:BC:7A:74:2D ValidityMon, 18 Mar 2024 19:37:19 GMT - Mon, 10 Jun 2024 19:37:18 GMT
File typeHTML document, ASCII text, with very long lines (7681), with no line terminators Hash502c17df6070b9d6e188d734266fd648 38c546fc5f4852810a1977bca5ed2455952fd35d b1f83f5a5253b4d6f0e54442b0fdb2aead2d9f503fde9670afd9f488344efd7d
GET /recaptcha/api2/bframe?hl=pt-BR&v=2uoiJ4hP3NUoP9v_eBNfU6CR&k=6LcNwW8UAAAAAJ8eSLfer6Z8Lm28favadVWPryjV HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://172.210.44.157/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 25 Apr 2024 04:08:01 GMT
content-security-policy: script-src 'nonce-iMn6CtvKMgg12wZUXHm_Zg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
0.0.0.0