URL User Request GET HTTP/1.1IP154.12.231.18:443
CertificateIssuer Subjectlocalhost FingerprintB0:23:8C:54:7A:90:5B:FA:11:9C:4E:8B:AC:CA:EA:CF:36:49:1F:F6 ValidityTue, 10 Nov 2009 23:48:47 GMT - Fri, 08 Nov 2019 23:48:47 GMT
File typeASCII text, with CRLF line terminators Hash393ff0dedb8fd607737a7033f81b6c6a 6be77cc278df922aeca32e19880153baf0d499a4 8a8b68e34b038ffa6fe09b387ea804f23021a1aa2286ef48380c3e712cbf1032
Analyzer | Verdict | Alert | Public Nextron YARA rules | malware | Detects obfuscated PowerShell hacktools | Public Nextron YARA rules | malware | Detects PowerShell invocation with suspicious parameters | Quad9 DNS | malicious | Sinkholed |
GET /s.txt HTTP/1.1
Host: 154.12.231.18
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 08:20:43 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Sun, 21 Apr 2024 19:12:01 GMT
ETag: "daf-616a0187d12fe"
Accept-Ranges: bytes
Content-Length: 3503
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain
|
| 154.12.231.18/favicon.ico | 154.12.231.18 | 404 Not Found | 300 B |
URL GET HTTP/1.1154.12.231.18/favicon.ico IP154.12.231.18:443
Requested byhttps://154.12.231.18/s.txt CertificateIssuer Subjectlocalhost FingerprintB0:23:8C:54:7A:90:5B:FA:11:9C:4E:8B:AC:CA:EA:CF:36:49:1F:F6 ValidityTue, 10 Nov 2009 23:48:47 GMT - Fri, 08 Nov 2019 23:48:47 GMT
File typeHTML document, ASCII text Hashf3556285b3c5f019750d4e3970a32329 1b6b59453295de0f4a0cf1e0fde03c28567d34dd dc0d6a7db2a8eecc71b00a0d36fdc1dfefd133f342499ba936113e0fc07de4c3
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 154.12.231.18
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://154.12.231.18/s.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 08:20:44 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 300
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|