IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash9d139a09a36fce99ece1fb963d49d2a9 a7d96d8755d02c7204c147daade1b1168a6ddb73 f9a59ebef1ee608c709b274e1c7be1320323232cdc79b17bdbf453a5a5aead09
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F9A59EBEF1EE608C709B274E1C7BE1320323232CDC79B17BDBF453A5A5AEAD09"
Last-Modified: Mon, 17 Jun 2024 11:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13232
Expires: Wed, 19 Jun 2024 18:22:57 GMT
Date: Wed, 19 Jun 2024 14:42:25 GMT
Connection: keep-alive
|
| install.telivy.com/install-agents.ps1 |  34.49.244.59 | 200 OK | 4.7 kB |
URL User Request GET HTTP/2install.telivy.com/install-agents.ps1 IP34.49.244.59:443 ASN#396982 GOOGLE-CLOUD-PLATFORM
CertificateIssuerGoogle Trust Services LLC Subjectinstall.telivy.com FingerprintB0:21:3C:08:7C:CF:56:CA:BA:8B:29:6C:E7:BC:4D:68:88:D0:E0:05 ValidityFri, 26 Apr 2024 01:29:12 GMT - Thu, 25 Jul 2024 02:23:26 GMT
Hash7e3ba0433ebd1cef0b6fef2c1ed6ce53 b31c85fa6e3423dad68c358aba6265c2b1733b44 208024d571d0386223c73e31261d1607a73dfa4a83a7194e63e35e8fdc4fe495
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
GET /install-agents.ps1 HTTP/1.1
Host: install.telivy.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 19 Jun 2024 14:42:26 GMT
last-modified: Thu, 29 Feb 2024 18:41:56 GMT
etag: "7e3ba0433ebd1cef0b6fef2c1ed6ce53"
x-goog-generation: 1709232116795804
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4713
content-type: application/octet-stream
x-goog-hash: crc32c=TzYZDA==, md5=fjugQz69HO8Lb+8sHtbOUw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 4713
access-control-allow-origin: *
access-control-expose-headers: Content-Type,Access-Control-Allow-Origin
x-guploader-uploadid: ACJd0NrqcAXXCnEj2xm1DC4tpO2p6I9DOLa34-Bh3NLaUh1BMkhFSE2QJgiWdrijcvjaCcg94xnrkNxSlA
server: UploadServer
via: 1.1 google
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hasha4a98cb7858bfd671309bced772b0095 703c86e6784782333c82f615335a6b5d6826607e 224e289334c48e0048c8e7805fae8e7b485ea11d278ed892156c67ce21e8e04c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "224E289334C48E0048C8E7805FAE8E7B485EA11D278ED892156C67CE21E8E04C"
Last-Modified: Tue, 18 Jun 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16708
Expires: Wed, 19 Jun 2024 19:20:56 GMT
Date: Wed, 19 Jun 2024 14:42:28 GMT
Connection: keep-alive
|
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hasha4a98cb7858bfd671309bced772b0095 703c86e6784782333c82f615335a6b5d6826607e 224e289334c48e0048c8e7805fae8e7b485ea11d278ed892156c67ce21e8e04c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "224E289334C48E0048C8E7805FAE8E7B485EA11D278ED892156C67CE21E8E04C"
Last-Modified: Tue, 18 Jun 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16708
Expires: Wed, 19 Jun 2024 19:20:56 GMT
Date: Wed, 19 Jun 2024 14:42:28 GMT
Connection: keep-alive
|
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hasha4a98cb7858bfd671309bced772b0095 703c86e6784782333c82f615335a6b5d6826607e 224e289334c48e0048c8e7805fae8e7b485ea11d278ed892156c67ce21e8e04c
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "224E289334C48E0048C8E7805FAE8E7B485EA11D278ED892156C67CE21E8E04C"
Last-Modified: Tue, 18 Jun 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16708
Expires: Wed, 19 Jun 2024 19:20:56 GMT
Date: Wed, 19 Jun 2024 14:42:28 GMT
Connection: keep-alive
|