URL User Request GET HTTP/1.1IP 104.21.95.120:80
File typeHTML document, ASCII text, with very long lines (611) Hash46dd133ee00dc1bae5e4eeba7b88432f 8af86a4ac91ce48c062216fb94a6e1d57618a19b 9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET / HTTP/1.1
Host: setup.pekora.zip
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Sat, 11 Jan 2025 03:19:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZqRr0OAmUVpeNdRUsRkRSvR5qH6J1scig2Bis8pBsJ6O4T48grKWBAFF8qAWnKhcxTpX30hdkW0bl2sXMLlSOFmuKSRo%2FFXNbFZm34I6C82n%2FC%2F2h1dOqzTelf%2FuxULwW4qv"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 9001c342493ab4ff-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=436&min_rtt=436&rtt_var=218&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=389&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
| GET www.cloudflare.com/favicon.ico | 104.16.123.96 | 200 OK | 9.5 kB |
URL GET www.cloudflare.com/favicon.ico IP104.16.123.96:0
CertificateIssuerGoogle Trust Services Subjectwww.cloudflare.com Fingerprint62:A5:BB:3C:80:24:E1:6F:B3:26:AD:BE:80:28:8D:51:CF:15:35:52 ValidityWed, 01 Jan 2025 17:30:57 GMT - Tue, 01 Apr 2025 18:30:53 GMT
File typePNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced Hash112ad5f84433e5f46d607f73fb64bd60 a8bf11f3f6099ca49d1cbf73c050eb7e6fbc68b4 0f84307ad691800e391fccb42b4ba290a87febf001abedfbe03b34767d45e441
GET /favicon.ico HTTP/1.1
Host: www.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://setup.pekora.zip/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 11 Jan 2025 03:19:00 GMT
content-type: image/vnd.microsoft.icon
etag: W/"ffb25f3edc5c56acfdf7e7cdffcb217c"
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: geolocation=(), camera=(), microphone=()
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-gww-loc: EN-US
x-pgs-loc: EN-US
x-xss-protection: 1; mode=block
set-cookie: __cf_bm=uyJmEYePtHd2IzvVmAw.KkM9e.zcHjY_B6LWIwKO6WU-1736565540-1.0.1.1-0cZkp.vdsXFdguvBQZWhMJUhfTgkmsbB22YpkMS_BV55RBjR_5CvCTXO8w7HPSRGfLTO59Fz7gRJk9RWUCcIeS6ZwBsly8wVlFYEOeY1QXI; path=/; expires=Sat, 11-Jan-25 03:49:00 GMT; domain=.www.cloudflare.com; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oVnpt915KVuyUG3GoleYHnvn1Sh4iPJoI1sYk%2FndXCHDGRX%2BIOeSyCBqm5Ok8Vygh6CT81UN45yWbHamFhM8PWPb1o1wogHdQdf7OYyAfNLXQSlBXUvke6I9Wv83yRU0Blrewg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9001c344ce6056cc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|