| |  94.156.65.137 | 200 OK | 3.1 kB |
URL User Request GET HTTP/1.1IP94.156.65.137:80
File typeHTML document, ASCII text, with very long lines (7834), with no line terminators Hashfe7aa387f83f051644a597d1834b80ec 9946e4f1eb92ab5917187cc47f68d0978a1fb3ba a86c624710da8b35a7fa9e130476f161f8a36afe631fbdea4dbd0a957eaafe39
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/html
Last-Modified: Wed, 08 May 2024 05:45:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1195-1e9a"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fonts/icons/style.css | 94.156.65.137 | 200 OK | 875 B |
URL GET HTTP/1.194.156.65.137/assets/fonts/icons/style.css IP94.156.65.137:80
File typeASCII text, with CRLF line terminators Hashcf10c1b8b9348fc2752bd628143e6769 da766143af460e3863f789fc1db9b281766cb4bb 002a20bb327c239893a00b908f0ed4cebb527a2957e61aa49528b71a6a450490
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fonts/icons/style.css HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/css
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1032-db0"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fontawesome/css/fontawesome.min.css | 94.156.65.137 | 200 OK | 18 kB |
URL GET HTTP/1.194.156.65.137/assets/fontawesome/css/fontawesome.min.css IP94.156.65.137:80
File typeASCII text, with very long lines (65317) Hashd318f674308800c356f650173502cf6d f2c5219fb9f58c2baee6dbd965741975cbc8ae71 863ab50a39fc203ca8f614cef14c6cc700ee64bfeacd41426dce9ef8cbd98509
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fontawesome/css/fontawesome.min.css HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/css
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1032-13b0b"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fonts/icons/permissions/style.css | 94.156.65.137 | 200 OK | 515 B |
URL GET HTTP/1.194.156.65.137/assets/fonts/icons/permissions/style.css IP94.156.65.137:80
Hashe7a2f49096e4eec6fb152bd3bbd3a79d 7edb77dfac88b03ae84579f7df14d7970dbf8e48 192a731c7357c9cc21c2ed31feb497561738fbb7353e047d3eb30bf06075c7f5
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fonts/icons/permissions/style.css HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/css
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1032-569"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fonts/mulish/style.css | 94.156.65.137 | 200 OK | 480 B |
URL GET HTTP/1.194.156.65.137/assets/fonts/mulish/style.css IP94.156.65.137:80
File typeASCII text, with CRLF line terminators Hash52a70196f93d6cbde026b45ed2be798a 77f415c3dd48043669df473d94a9200f867fcab8 e09bb0962eaf03380ebd592134c4cbccd9a9dbe0cad5d8c886c42e50c078e728
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fonts/mulish/style.css HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/css
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1032-672"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fontawesome/css/all.min.css | 94.156.65.137 | 200 OK | 23 kB |
URL GET HTTP/1.194.156.65.137/assets/fontawesome/css/all.min.css IP94.156.65.137:80
File typeASCII text, with very long lines (65317) Hash6cb5a85b30082e3d59d7e371e002ce8d 0c639634f474b4601a7937f440096185f3a9d8d3 01b035efb5dfa529c512f82962ed633328222da6f33c224244806d4798c67349
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fontawesome/css/all.min.css HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/css
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1032-18d98"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2 | 94.156.65.137 | 200 OK | 11 kB |
URL GET HTTP/1.194.156.65.137/assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2 IP94.156.65.137:80
File typeWeb Open Font Format (Version 2), TrueType, length 11232, version 1.0 Hashf4429b00adf61350183e1037f446fd40 a23ad1c7b309f8da507b96efad46313f72d3a351 ad234f0985f2142bb1fa3a281ddf2511d320f84f73422df2b2384f115b4b9131
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fonts/mulish/1Ptyg83HX_SGhgqO0yLcmjzUAuWexZNR8aevGw.woff2 HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/assets/fonts/mulish/style.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: font/woff2
Content-Length: 11232
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Connection: keep-alive
ETag: "663b1032-2be0"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
|
|
| 94.156.65.137/static/css/main.397ec292.css | 94.156.65.137 | 200 OK | 98 kB |
URL GET HTTP/1.194.156.65.137/static/css/main.397ec292.css IP94.156.65.137:80
File typeASCII text, with very long lines (50737) Hash1cf163c0c0b1696a7220c3e951629262 f8205a4d5419c99c4de59b1de3ea66abaa56cf73 5bf31c83371902b8a44eeaadddcc1dad52b39d074bc3c0613df9ead6850a6a6c
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /static/css/main.397ec292.css HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:13 GMT
Content-Type: text/css
Last-Modified: Wed, 08 May 2024 05:45:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1195-a4dac"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/fav/apple-touch-icon.png | 94.156.65.137 | 200 OK | 6.6 kB |
URL GET HTTP/1.194.156.65.137/assets/fav/apple-touch-icon.png IP94.156.65.137:80
File typePNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced Hash90a61dcc76d704b2e861a0465ced2f87 27b6cebdd96c0434c2fe10db0d58b2c3135c9728 73ce3b381a9a2c555f88fbfc873a53137b120d0e0398894d130408431a7799af
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fav/apple-touch-icon.png HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:14 GMT
Content-Type: image/png
Content-Length: 6573
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Connection: keep-alive
ETag: "663b1032-19ad"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
|
|
| 94.156.65.137/assets/fav/favicon-16x16.png | 94.156.65.137 | 200 OK | 1.0 kB |
URL GET HTTP/1.194.156.65.137/assets/fav/favicon-16x16.png IP94.156.65.137:80
File typePNG image data, 16 x 16, 8-bit colormap, non-interlaced Hash20483239adc0dc66bbabbbe2cc33f6fe c30dd2f134cab3d4d620b34a3ed736a0ee0e0658 b13b77f0b3d95c1146394ea855d915f189d3ea374179755cfb2ac47bfc8f306c
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/fav/favicon-16x16.png HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:14 GMT
Content-Type: image/png
Content-Length: 1035
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Connection: keep-alive
ETag: "663b1032-40b"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
|
|
| 94.156.65.137/static/js/main.185b6dbb.js | 94.156.65.137 | 200 OK | 930 kB |
URL GET HTTP/1.194.156.65.137/static/js/main.185b6dbb.js IP94.156.65.137:80
File typeJavaScript source, ASCII text, with very long lines (65465) Size930 kB (930033 bytes) Hash13a3280822dab95818467ba658ffed2f 9e6bca2556b6a585879730542b76c8e3ed4032b8 02b47650062909419396e0815e0e5b56b342f496011262d563676d4fcc9e6ac2
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /static/js/main.185b6dbb.js HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:14 GMT
Content-Type: application/javascript
Last-Modified: Wed, 08 May 2024 05:45:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1195-3a4496"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/images/hook.svg | 94.156.65.137 | 200 OK | 3.1 kB |
URL GET HTTP/1.194.156.65.137/images/hook.svg IP94.156.65.137:80
File typeHTML document, ASCII text, with very long lines (7834), with no line terminators Hashfe7aa387f83f051644a597d1834b80ec 9946e4f1eb92ab5917187cc47f68d0978a1fb3ba a86c624710da8b35a7fa9e130476f161f8a36afe631fbdea4dbd0a957eaafe39
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /images/hook.svg HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Type: text/html
Last-Modified: Wed, 08 May 2024 05:45:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1195-1e9a"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPc7NX | 94.156.65.137 | 200 OK | 83 B |
URL GET HTTP/1.194.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPc7NX IP94.156.65.137:3434
Hash9ed37a59bc2d0d2add5523112ebe0f84 5e910e8120135ed2fde20925c8b59fe577449149 5191320f59f9fdf1c5ee904c9f0207f6ffece9b0c2c437d9b28b5cbd694494e5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /socket.io/?EIO=3&transport=polling&t=OzPc7NX HTTP/1.1
Host: 94.156.65.137:3434
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://94.156.65.137
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
Access-Control-Allow-Origin: http://94.156.65.137
Content-Type: application/octet-stream
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Length: 83
|
|
| 94.156.65.137/images/hook.svg | 94.156.65.137 | 200 OK | 3.1 kB |
URL GET HTTP/1.194.156.65.137/images/hook.svg IP94.156.65.137:80
File typeHTML document, ASCII text, with very long lines (7834), with no line terminators Hashfe7aa387f83f051644a597d1834b80ec 9946e4f1eb92ab5917187cc47f68d0978a1fb3ba a86c624710da8b35a7fa9e130476f161f8a36afe631fbdea4dbd0a957eaafe39
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /images/hook.svg HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Type: text/html
Last-Modified: Wed, 08 May 2024 05:45:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"663b1195-1e9a"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
|
|
| 94.156.65.137/assets/images/login_poster.jpg | 94.156.65.137 | 200 OK | 18 kB |
URL GET HTTP/1.194.156.65.137/assets/images/login_poster.jpg IP94.156.65.137:80
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x720, components 3 Hash719cd51d0daa19e7fb86d1f7ae8fdf82 c47adb5699df36a8942698a3a5202a8d3da0e4d7 82b5025eca7e248ab6a54077b939835ddb259853fcc94b258cd1a39abece9fd0
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/images/login_poster.jpg HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Type: image/jpeg
Content-Length: 18418
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Connection: keep-alive
ETag: "663b1032-47f2"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Accept-Ranges: bytes
|
|
| purecatamphetamine.github.io/country-flag-icons/3x2/US.svg |  185.199.108.153 | 200 OK | 480 B |
URL GET HTTP/2purecatamphetamine.github.io/country-flag-icons/3x2/US.svg IP185.199.108.153:443
CertificateIssuerDigiCert Inc Subject*.github.io Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28 ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
File typeSVG Scalable Vector Graphics image Hash447e2bf0533bec7a411b9a970b74f0ed bff8541efa1cff6e3a9613616682d0cba8bdbe45 0368f33db1cc70ef5eee2a5de99571b65d394d8964f4824ce3919d45998775c0
GET /country-flag-icons/3x2/US.svg HTTP/1.1
Host: purecatamphetamine.github.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: GitHub.com
content-type: image/svg+xml
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Fri, 05 Apr 2024 01:02:36 GMT
access-control-allow-origin: *
strict-transport-security: max-age=31556952
etag: W/"660f4dac-548"
expires: Thu, 18 Apr 2024 02:03:31 GMT
cache-control: max-age=600
content-encoding: gzip
x-proxy-cache: HIT
x-github-request-id: CFEE:285FD6:2E4C7FF:2F4B833:66207D71
accept-ranges: bytes
date: Wed, 08 May 2024 19:05:15 GMT
via: 1.1 varnish
age: 32
x-served-by: cache-hel1410027-HEL
x-cache: HIT
x-cache-hits: 1
x-timer: S1715195115.131008,VS0,VE7
vary: Accept-Encoding
x-fastly-request-id: f271cc6f8ef7f62d999397bd4d12fedb3bd0ab7d
content-length: 480
X-Firefox-Spdy: h2
|
|
| 94.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPc7Pk&sid=q | 94.156.65.137 | 200 OK | 5 B |
URL GET HTTP/1.194.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPc7Pk&sid=q IP94.156.65.137:3434
Hash7af80a3ef50f8ab70677275473b1b1b8 bbddc27df3428bce641ace40dbd9afc0cd9ad583 25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /socket.io/?EIO=3&transport=polling&t=OzPc7Pk&sid=q HTTP/1.1
Host: 94.156.65.137:3434
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://94.156.65.137
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
Access-Control-Allow-Origin: http://94.156.65.137
Content-Type: application/octet-stream
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Length: 5
|
|
| 94.156.65.137/assets/images/login_sd.mp4 | 94.156.65.137 | 206 Partial Content | 7.1 kB |
URL GET HTTP/1.194.156.65.137/assets/images/login_sd.mp4 IP94.156.65.137:80
Hash7431929e733d56475c0a709a8d7dfbc0 b518863a41936651f45d97e94cf3a321e9586c7f 28ad3b47e8d1f7c4006d8e8e9e7e4d866a6d7595f7bb78e736c9987ce76b33be
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/images/login_sd.mp4 HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=6258688-
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Type: video/mp4
Content-Length: 7070
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Connection: keep-alive
ETag: "663b1032-5f9b9e"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Range: bytes 6258688-6265757/6265758
|
|
| 94.156.65.137/assets/images/login_sd.mp4 | 94.156.65.137 | 206 Partial Content | 1.8 MB |
URL GET HTTP/1.194.156.65.137/assets/images/login_sd.mp4 IP94.156.65.137:80
File typeISO Media, MP4 Base Media v1 [ISO 14496-12:2003] Size1.8 MB (1776878 bytes) Hash12e0e0b7db25f67d45edf2d29b0dcd97 29129b3837d71cc4e7f99eda35c7851439b01590 ab8174c141afed168d3ed748b6d3720f770fe73dbacb8f935ab9233a499f5703
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | urlquery | malware | Malware - Hook botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /assets/images/login_sd.mp4 HTTP/1.1
Host: 94.156.65.137
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Server: nginx/1.25.5
Date: Wed, 08 May 2024 19:05:15 GMT
Content-Type: video/mp4
Content-Length: 6265758
Last-Modified: Wed, 08 May 2024 05:40:02 GMT
Connection: keep-alive
ETag: "663b1032-5f9b9e"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X-Token-Auth,Cache-Control,Content-Type,Authorization
Content-Range: bytes 0-6265757/6265758
|
|
| 94.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPc7SE&sid=q | 94.156.65.137 | 200 OK | 4 B |
URL GET HTTP/1.194.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPc7SE&sid=q IP94.156.65.137:3434
Hashc94b90fc9bdacb4b8efa79f71455723a 7b92da47b53515e492370f44792fbd37c1b948ce 74fbe32512a92081a0445ce13a43edc90a409379af828b6d233ae25da4af12c5
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /socket.io/?EIO=3&transport=polling&t=OzPc7SE&sid=q HTTP/1.1
Host: 94.156.65.137:3434
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://94.156.65.137
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
Access-Control-Allow-Origin: http://94.156.65.137
Content-Type: application/octet-stream
Date: Wed, 08 May 2024 19:05:35 GMT
Content-Length: 4
|
|
| 94.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPcCIF&sid=q | 94.156.65.137 | 200 OK | 2 B |
URL POST HTTP/1.194.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPcCIF&sid=q IP94.156.65.137:3434
File typeASCII text, with no line terminators Hash444bcb3a3fcf8389296c49467f27e1d6 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
POST /socket.io/?EIO=3&transport=polling&t=OzPcCIF&sid=q HTTP/1.1
Host: 94.156.65.137:3434
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: text/plain;charset=UTF-8
Content-Length: 3
Origin: http://94.156.65.137
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Content-Length, X-CSRF-Token, Token, session, Origin, Host, Connection, Accept-Encoding, Accept-Language, X-Requested-With
Access-Control-Allow-Methods: POST, OPTIONS, GET, PUT, DELETE
Access-Control-Allow-Origin: http://94.156.65.137
Date: Wed, 08 May 2024 19:05:35 GMT
Content-Length: 2
Content-Type: text/plain; charset=utf-8
|
|
| 94.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPcCJ2&sid=q |  0.0.0.0 | | 0 B |
URL GET 94.156.65.137:3434/socket.io/?EIO=3&transport=polling&t=OzPcCJ2&sid=q IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /socket.io/?EIO=3&transport=polling&t=OzPcCJ2&sid=q HTTP/1.1
Host: 94.156.65.137:3434
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://94.156.65.137
DNT: 1
Connection: keep-alive
Referer: http://94.156.65.137/
Pragma: no-cache
Cache-Control: no-cache
|
|
0.0.0.0