Report - 104.26.5.130/

Report Overview

Visitedpublic

2024-07-19 09:39:59

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
performance.radar.cloudflare.com	unknown	2009-02-17	2022-06-29 12:44:51	2024-07-12 17:27:02	381 B	8.1 kB	104.18.30.78
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-18 18:12:17	2.0 kB	5.3 kB	23.36.76.226
104.26.5.130	unknown	unknown	2019-07-08 18:22:35	2024-01-20 21:51:56	1.1 kB	7.7 kB	104.26.5.130

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-07-19 09:39:28	medium	104.26.5.130	Client IP	ET INFO TLS Handshake Failure

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-07-19	medium	104.26.5.130	Sinkholed
2024-07-19	medium	104.26.5.130	Sinkholed
2024-07-19	medium	104.26.5.130	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	performance.radar.cloudflare.com/beacon.js	ScriptElement	7.4 kB	2024-08-19	2024-08-19
URL performance.radar.cloudflare.com/beacon.js IP / ASN 104.18.30.78 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded false Resource Info First Seen 2024-08-19 Last Seen 2024-08-19 Times Seen 1 Size 7.4 kB (7378 bytes) MD5 9ee81ddc2c3c4823609b5ae5d0b01d49 SHA1 59542a2c71eba99eb2c17cd3998d9a591a6ba6b5 SHA256 0ba9cf157934b4beee736c62b038111e55ad55554004892e00e2edecb6ce1322 Format Code Loading...

	104.26.5.130/	ScriptElement	0 B	0001-01-01	2025-08-02
URL 104.26.5.130/ IP / ASN 104.26.5.130 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded true Resource Info First Seen 0001-01-01 Last Seen 2025-08-02 Times Seen 5606801 Size 0 B (0 bytes) MD5 d41d8cd98f00b204e9800998ecf8427e SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Format Code Loading...

	104.26.5.130/	ScriptElement	393 B	2023-04-05	2025-03-02
URL 104.26.5.130/ IP / ASN 104.26.5.130 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded true Resource Info First Seen 2023-04-05 Last Seen 2025-03-02 Times Seen 143291 Size 393 B (393 bytes) MD5 34ad0a116707d3b794129a6720af92d7 SHA1 424de9dbb8bc774e2a2d4ade100d90f5ac0ecbf4 SHA256 d011a9449a990f2086894be870adc6fbb53595dc593b410a83e45e40bfbc7262 Format Code Loading...

	104.26.5.130/	ScriptElement	0 B	0001-01-01	2025-08-02
URL 104.26.5.130/ IP / ASN 104.26.5.130 #13335 CLOUDFLARENET Introduced by ScriptElement Embedded true Resource Info First Seen 0001-01-01 Last Seen 2025-08-02 Times Seen 5606801 Size 0 B (0 bytes) MD5 d41d8cd98f00b204e9800998ecf8427e SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Format Code Loading...

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-18

Last Seen2024-08-19

Times Seen23544

Size504 B (504 bytes)

MD591a50ba757c5ca46c896205a21d87a49

SHA10b48953a685631845a7034c8948077de0e60de80

SHA25615d10fabb92098e81e218740ae04059fe6340c321ee70325db46f6c9cb7ad817

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "15D10FABB92098E81E218740AE04059FE6340C321EE70325DB46F6C9CB7AD817"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8615
Expires: Fri, 19 Jul 2024 12:03:02 GMT
Date: Fri, 19 Jul 2024 09:39:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-18

Last Seen2024-08-19

Times Seen27719

Size504 B (504 bytes)

MD5c746d0145c03aa7156aa6a21d8cd2d41

SHA18fb7cb950f28012e8bf42cf02c7598862c66e21f

SHA256c695ccd93d9e45c8d7b4b08201a3fe45221658531fa0a54f778dadcc2479399e

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C695CCD93D9E45C8D7B4B08201A3FE45221658531FA0A54F778DADCC2479399E"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15272
Expires: Fri, 19 Jul 2024 13:53:59 GMT
Date: Fri, 19 Jul 2024 09:39:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-18

Last Seen2024-08-19

Times Seen26255

Size504 B (504 bytes)

MD5ba83fc82f22d464fbc0a613d3224fdef

SHA1b8d2b3e057c0d01c05e3891f5b5cdaf09e001d3b

SHA25617205f996d5ce1462adb970516597f51763582906181b875e45b5b7535f38b8f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "17205F996D5CE1462ADB970516597F51763582906181B875E45B5B7535F38B8F"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15280
Expires: Fri, 19 Jul 2024 13:54:07 GMT
Date: Fri, 19 Jul 2024 09:39:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-18

Last Seen2024-08-19

Times Seen11218

Size504 B (504 bytes)

MD5c1c566b13420f7d3edbf1d5ed3b27db9

SHA197de217d617fdc3b20f959d006b312b10cc0cbae

SHA256fbe357f2cc5c225f66ccd61407a0609124df4790b268fcadf2c3399579ceed4f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "FBE357F2CC5C225F66CCD61407A0609124DF4790B268FCADF2C3399579CEED4F"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9768
Expires: Fri, 19 Jul 2024 12:22:15 GMT
Date: Fri, 19 Jul 2024 09:39:27 GMT
Connection: keep-alive

GET 104.26.5.130/

104.26.5.130

403 Forbidden

2.1 kB

URL

104.26.5.130/

IP / ASN

104.26.5.130

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (501)

First Seen2024-08-19

Last Seen2024-08-19

Times Seen1

Size2.1 kB (2099 bytes)

MD5f848a5432e222de87730aba9f6e87676

SHA1fad4d2291948e07525f0d240647cceda5ff11b51

SHA256c16ace7e295b46d20304e0ec11a2ed9cccb6f20f2f36e6c9ac7bbb5019a68d65

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 104.26.5.130
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Fri, 19 Jul 2024 09:39:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8a59be94cd438d6d-HEL
Content-Encoding: gzip

GET 104.26.5.130/cdn-cgi/styles/main.css

104.26.5.130

200 OK

2.2 kB

URL

104.26.5.130/cdn-cgi/styles/main.css

IP / ASN

104.26.5.130

#13335 CLOUDFLARENET

Requested byhttp://104.26.5.130/

Resource Info

File typeASCII text, with very long lines (8012)

First Seen2023-04-05

Last Seen2025-08-02

Times Seen29402

Size2.2 kB (2176 bytes)

MD5ff26f59e28a5fe6ea4ab23586415696b

SHA14182675484d175e363cd34b43041b7b1af93d0cd

SHA256d30b4ea6f68456672f5abb35e9dcf7d54226372b66e9d60a7ee26b7a52568e74

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cdn-cgi/styles/main.css HTTP/1.1
Host: 104.26.5.130
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.26.5.130/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 19 Jul 2024 09:39:28 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 12 Jul 2024 17:10:21 GMT
ETag: W/"6691637d-1f4d"
Server: cloudflare
CF-RAY: 8a59be96899a4c8c-HEL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 19 Jul 2024 11:39:28 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip

GET 104.26.5.130/favicon.ico

104.26.5.130

403 Forbidden

2.1 kB

URL

104.26.5.130/favicon.ico

IP / ASN

104.26.5.130

#13335 CLOUDFLARENET

Requested byhttp://104.26.5.130/

Resource Info

File typeHTML document, ASCII text, with very long lines (501)

First Seen2024-08-19

Last Seen2024-08-19

Times Seen1

Size2.1 kB (2100 bytes)

MD5bc3085be4ad45ceb2568403d24407632

SHA1157749f59c3c66efe6697ee6a65fc07a697538c1

SHA256717933b797469bd01e272a1e4d0422cfe58335b9d1bc1d75688fb8976c7b73b1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 104.26.5.130
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.26.5.130/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Date: Fri, 19 Jul 2024 09:39:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8a59be981bf24c8c-HEL
Content-Encoding: gzip

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-18

Last Seen2024-08-19

Times Seen15177

Size504 B (504 bytes)

MD51543efa0b06a3c4484d059961f9cf2d0

SHA11aef10797a9524ff91b70e87f41e935a2dbf1917

SHA256a8fc1fb00fc3ee458f9a31d619be4cc4a9e7263f980deb8323a5a6ba69c03f8d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A8FC1FB00FC3EE458F9A31D619BE4CC4A9E7263F980DEB8323A5A6BA69C03F8D"
Last-Modified: Thu, 18 Jul 2024 07:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11397
Expires: Fri, 19 Jul 2024 12:49:26 GMT
Date: Fri, 19 Jul 2024 09:39:29 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-18

Last Seen2024-08-19

Times Seen15177

Size504 B (504 bytes)

MD51543efa0b06a3c4484d059961f9cf2d0

SHA11aef10797a9524ff91b70e87f41e935a2dbf1917

SHA256a8fc1fb00fc3ee458f9a31d619be4cc4a9e7263f980deb8323a5a6ba69c03f8d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A8FC1FB00FC3EE458F9A31D619BE4CC4A9E7263F980DEB8323A5A6BA69C03F8D"
Last-Modified: Thu, 18 Jul 2024 07:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11397
Expires: Fri, 19 Jul 2024 12:49:26 GMT
Date: Fri, 19 Jul 2024 09:39:29 GMT
Connection: keep-alive

GET performance.radar.cloudflare.com/beacon.js

104.18.30.78

200 OK

7.3 kB

URL

performance.radar.cloudflare.com/beacon.js

IP / ASN

104.18.30.78

#13335 CLOUDFLARENET

Requested byhttp://104.26.5.130/

Resource Info

File typeJavaScript source, ASCII text, with very long lines (7377)

First Seen2024-08-19

Last Seen2024-08-19

Times Seen1

Size7.3 kB (7340 bytes)

MD59ee81ddc2c3c4823609b5ae5d0b01d49

SHA159542a2c71eba99eb2c17cd3998d9a591a6ba6b5

SHA2560ba9cf157934b4beee736c62b038111e55ad55554004892e00e2edecb6ce1322

Certificate Info

IssuerLet's Encrypt

Subjectradar.cloudflare.com

Fingerprint69:78:C8:2A:97:13:62:D6:EF:D3:F8:B0:E4:26:B7:1A:A0:D8:74:6F

ValidityThu, 18 Jul 2024 22:29:53 GMT - Wed, 16 Oct 2024 22:29:52 GMT

HTTP Headers

GET /beacon.js HTTP/1.1
Host: performance.radar.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 19 Jul 2024 09:39:28 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, max-age=0
access-control-allow-headers: *
access-control-allow-methods: *
referrer-policy: no-referrer
timing-allow-origin: *
set-cookie: __cf_bm=WGrCdOF3yZJDbs0n2A1SoEnfen480zfPmuGsiz01EcU-1721381968-1.0.1.1-f8M5gL.Kpj1EvdAdM6qxB.TJHqgPwhC3288x9bXMrqhmXG4B4ib21UZ6b6CqqpqBTEjCvKhpi4f9_s6vybYxYQ; path=/; expires=Fri, 19-Jul-24 10:09:28 GMT; domain=.radar.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8a59be96c8f36dea-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2