Report - live-khl.ru/sp

Report Overview

Submitted URL
live-khl.ru/sp
IP
104.21.31.167
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-16 16:49:46
Access
public
Website Title
Telegram
Final URL
live-khl.ru/sp
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
22

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
live-khl.ru	unknown	2024-02-13	2024-02-13	2024-04-15	5.0 kB	679 kB	104.21.31.167

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	live-khl.ru/sp	Telegram

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed
2024-04-16	medium	live-khl.ru	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	live-khl.ru/assets/tme/js/tgwallpaper.min.js?3	3.0 kB	2023-03-07	2024-04-29
Pretty URL live-khl.ru/assets/tme/js/tgwallpaper.min.js?3 IP 104.21.31.167 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:31:07 Last Seen2024-04-29 20:21:38 Times Seen5134 Hash 2b89d34702716a8ad2cc3977718f53a3 04406ebd6a9e2ce79dbac5e5048cfe1384e4574a 2031e418ee10af8110729b3f327b968462fc0a9d8d1da095387bb472ccd0dee6 Loading...

	live-khl.ru/sp	193 B	2023-03-07	2024-04-29
Pretty URL live-khl.ru/sp IP 104.21.31.167 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:31:07 Last Seen2024-04-29 20:21:38 Times Seen3334 Hash 9c629a0c52a2afad699d260f673481fd a4fd0ed3e5daa31480eb6de0faa5d442f015cbf6 ea0d804370930ee958af535ce56cddf1dda419bdc676315ae8af0fbb4c733471 Loading...

	live-khl.ru/sp	0 B	2023-03-07	2024-04-29
Pretty URL live-khl.ru/sp IP 104.21.31.167 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-29 21:34:10 Times Seen37190145 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (10)

URL IP Response Size

live-khl.ru/assets/tme/css/bootstrap.min.css?3

104.21.31.167

200 OK

102 kB

URL GET HTTP/3
live-khl.ru/assets/tme/css/bootstrap.min.css?3
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
ASCII text, with very long lines (42164)
Size
102 kB (101767 bytes)
Hash
c2656e265ef58a9cc9f4b70b15da5fb9
85c5ebdb89d4574d72688c2650d4b84b9b09770a
f1d083ffaa644c708f11db29707aa57c19246e6d32643b03fee3f82c17b224b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/css/bootstrap.min.css?3 HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/sp
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:20 GMT
content-type: text/css
last-modified: Sun, 23 Jul 2023 11:42:19 GMT
etag: W/"a61b-60125fd87c51c-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fWUqgD1mR8bUxOpHoU2UHcY9etFfxHq0%2BYXumEEHFQLz8dDKPzykV4C7tx6b68Xp1UOTjmY%2FvS5xy7%2F4ncCTE7PuRrTRYcJxaE9fAMuDuCMe3raaQdU6Zx9jjeTXpg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8755ab094a04b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/css/telegram.css?233

104.21.31.167

200 OK

117 kB

URL GET HTTP/3
live-khl.ru/assets/tme/css/telegram.css?233
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
ASCII text, with very long lines (1267)
Size
117 kB (117125 bytes)
Hash
9e8636f3ccf45c0bd7f8aac6b5977ac5
830a674f56175031ede5fef36984c22c404c0b00
1f974d1b95486f1453a47b57d6a2764b48294579bc475d57234232a51700ab9e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/css/telegram.css?233 HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/sp
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:20 GMT
content-type: text/css
last-modified: Sun, 23 Jul 2023 11:42:22 GMT
etag: W/"1c093-60125fdb2bccd-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=37Rf31Ai%2Bovd%2B2AhIFqvIVx%2Fqcy%2B1J%2FlwSWCMcqwHDVUxHKMPOBbju4Cw4ZgFT9o4vcD%2BWzjnYYQK8vCuyNE9cOKuABNAcr5fo5Wm7%2F0wsVIeZ%2F%2BS9WQaLeDd7AruA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8755ab094a0ab521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/img/apple-touch-icon.png

104.21.31.167

200 OK

5.6 kB

URL GET HTTP/3
live-khl.ru/assets/tme/img/apple-touch-icon.png
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced
Size
5.6 kB (5644 bytes)
Hash
295ccdb03006b8dfef45090dafbd46ac
491ab660270e47cbac6a5731c51cca71c1c1b2b1
a51d667d4262047c23e3a2a8aac3b46dc8a58c686cc013f2354011c07bf22cf3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/img/apple-touch-icon.png HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/sp
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:21 GMT
content-type: image/png
content-length: 5644
last-modified: Sun, 23 Jul 2023 11:42:29 GMT
etag: "160c-60125fe27308d"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TVrLefwurr%2BrarxtSJvxAty3wUGBWDEkr78ypkSDd5rc%2B7CyT%2FkkuPl1qb9NzCZS6mv3ZmLo91tNnekzrPaG%2F2ELqA0QuSZA8T9nCjc4koGZUtt4R44HXbNq2tEb5g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8755ab0b0f97b521-OSL
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/img/website_icon.svg?4

104.21.31.167

200 OK

15 kB

URL GET HTTP/3
live-khl.ru/assets/tme/img/website_icon.svg?4
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
SVG Scalable Vector Graphics image
Size
15 kB (14958 bytes)
Hash
02f7553e1ac3129cd1c4d0442b5a0f81
0dd8634450681fe1a2d0c1e5b02d6d0954e2772d
0019255c610cb0843c524d7995905fa5201651fcc393846bee8414f0610097f5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/img/website_icon.svg?4 HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/sp
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:21 GMT
content-type: image/svg+xml
last-modified: Sun, 23 Jul 2023 11:42:29 GMT
etag: W/"768-60125fe2897eb"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zEH2ktgomIeFJlR6nQET1ZcpP7t9YvHG62%2BbgV0LUZ5jZ2AynMcV73KBeSUq0aLGSpiRoMAaFn1s%2BwPGjhoARcEjscJEheWUsGAyn0ZfUa91YGyXew6m1eJvq%2FBOtw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8755ab0b0f9cb521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/css/Roboto-Regular.woff

104.21.31.167

200 OK

93 kB

URL GET HTTP/3
live-khl.ru/assets/tme/css/Roboto-Regular.woff
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
Web Open Font Format, TrueType, length 93388, version 0.0
Size
93 kB (93388 bytes)
Hash
94dac78eee406a8c8f0406b69b85ac2b
e9e77fc073e302b714e30698276fad6adaf179cd
18ab5ae448dcec1f31abbbaa7dce8dcb1d890479f1bc4670a89c95f10063cf3e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/css/Roboto-Regular.woff HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/assets/tme/css/font-roboto.css?1
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:21 GMT
content-type: font/woff
content-length: 93388
last-modified: Sun, 23 Jul 2023 11:42:20 GMT
etag: "16ccc-60125fd94a5e3"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BGlSmZCJQpmZy2O2%2FCMYYDgfT11AE62YPeSaYRsXWY73et%2B0TeMDvyDDy02pl66bCnUj6RKbw1t9urJ74KTrkrl%2Fg%2BcCm0g1LVaNscvusVco6EJkrEoF%2FGxl1jNIwA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8755ab0a3ce3b521-OSL
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/js/tgwallpaper.min.js?3

104.21.31.167

200 OK

3.0 kB

URL GET HTTP/3
live-khl.ru/assets/tme/js/tgwallpaper.min.js?3
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
ASCII text, with very long lines (2998), with no line terminators
Size
3.0 kB (2979 bytes)
Hash
f03422dc797fd26a3834b1ec041128ed
a6e88f4fe48b749c2b7360e8e004f64b6cfffb1a
046ec6b7909d0ca5cc6ef271a1b57b2f2be0bd88e3495fd8c496f1524e8ffaac

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/js/tgwallpaper.min.js?3 HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/sp
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:20 GMT
content-type: text/javascript
last-modified: Sun, 23 Jul 2023 11:42:29 GMT
etag: W/"ba3-60125fe234893-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S9248NfCeVPrH7F0HoqWbLN6a9zh2omemreYOHgYYAUXUoLHGiRrtof8INZVo98bWYhjyWR3a5P%2FRP3X14IyMZQjPIkPQlkFvkayxx08OaQBHTCaCoD6QRWPMo6j5w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8755ab094a18b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/img/pattern.svg

104.21.31.167

200 OK

231 kB

URL GET HTTP/3
live-khl.ru/assets/tme/img/pattern.svg
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
SVG Scalable Vector Graphics image
Size
231 kB (230871 bytes)
Hash
7410ea0072f4df1e149a15a2bd924738
8878c8b4987cdb3c467fb5f14becedf9202e576f
daa086b24cbd2610eb3261446100ff513a4526c5b2bce41e758629f5cd8a6a20

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/img/pattern.svg HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/assets/tme/css/telegram.css?233
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:21 GMT
content-type: image/svg+xml
last-modified: Sun, 23 Jul 2023 11:42:30 GMT
etag: W/"385d7-60125fe3132fe"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MPT8KJe%2BwkvwiVTKfXDsmKs94S6nWU9NMSDdFTuBTfKUawgBwkTc9BX%2FyvhBD%2Bu5xMQdAzwj4rvn4Ak9yLkkZBqFCTqg1sblOTby5mhr3p80ybA2tPRqG166YTq3Jw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8755ab0a1c8db521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

live-khl.ru/assets/tme/css/Roboto-Bold.woff

104.21.31.167

200 OK

94 kB

URL GET HTTP/3
live-khl.ru/assets/tme/css/Roboto-Bold.woff
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
Web Open Font Format, TrueType, length 93700, version 0.0
Size
94 kB (93700 bytes)
Hash
08cb8f79715774f9a6285ee7db2919a3
6fa3b472bb5a784436faa1ef5d2896d426968689
8aa340f033ddfa5e7f8bfe80638c3b137887eb30996588852ec218d2007e68b7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/css/Roboto-Bold.woff HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/assets/tme/css/font-roboto.css?1
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:21 GMT
content-type: font/woff
content-length: 93700
last-modified: Sun, 23 Jul 2023 11:42:25 GMT
etag: "16e04-60125fde7f571"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iNYoNjNixNrPMnJF5mvZrsWmujfiRdApmCacoQCwK%2B9yAbLzKDadnLwW4efWq4V0uV7e5ED%2FkFoRk9pROeqkbKXeLBYe57JOQJMXdD8IbMygSqX8yqDDb7f3rDbVzg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8755ab0a3cf8b521-OSL
alt-svc: h3=":443"; ma=86400

live-khl.ru/sp

104.21.31.167

200 OK

7.4 kB

URL User Request GET HTTP/2
live-khl.ru/sp
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (7591), with no line terminators
Size
7.4 kB (7403 bytes)
Hash
f6acdef2b17127eee678343c7a551691
98c800302ac6dd43149408173f07246e75e25c21
923892aa7869040a19d083d0d7fed0d224fa0f620d16c5cf6b883963c7813579

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Telegram
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /sp HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 16:49:20 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QqNGmiysW3a%2B1jgRVNIJ1CUKca0nuVKynD4hv511wv43TIOt7B0vyFq%2FMMIzMk4mBuvavs7%2FEFuvSpKA3dNVI%2B9HzHgiZMQBhDyvobYh88TCJEfrjLeoue6HBnq23g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8755ab0789960b51-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

live-khl.ru/assets/tme/css/font-roboto.css?1

104.21.31.167

200 OK

4.4 kB

URL GET HTTP/3
live-khl.ru/assets/tme/css/font-roboto.css?1
IP
104.21.31.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://live-khl.ru/sp
Certificate
IssuerGoogle Trust Services LLC
Subjectlive-khl.ru
Fingerprint17:D6:DD:44:98:4B:A8:AD:42:84:C1:E9:99:F4:9D:7E:67:68:71:79
ValidityFri, 12 Apr 2024 11:32:57 GMT - Thu, 11 Jul 2024 11:32:56 GMT

File type
ASCII text, with very long lines (4487), with no line terminators
Size
4.4 kB (4355 bytes)
Hash
2bdb106065114e21e05d6a4b5a898984
b69b43146c0ad9740bcdac634293a1ccb4eef3d8
c1b107cad061614a0fa4ffbed727c7c5383a73198c47efbe9d42f62ab46221e9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tme/css/font-roboto.css?1 HTTP/1.1
Host: live-khl.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://live-khl.ru/sp
Cookie: PHPSESSID=nm3njnrufrcuscc4j182flcj06
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 16:49:20 GMT
content-type: text/css
last-modified: Sun, 23 Jul 2023 11:42:24 GMT
etag: W/"1103-60125fdd392d4-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8ExiZh99DUTRCTxMKnd0oqg8i%2BiMi2lAdpWxsUQUOinTLLNtR6%2BCL5TlB573gO8x73NKY9CK6QLwxYzrTbLgvSU0yPjYuv1mCpalY55tUMzGlB8%2FpnEe7g3%2Bu5V%2Fig%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8755ab094a00b521-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (10)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP