r11.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 686480d25645ac2aca7a99974693a82f
55ca9d53bd758d2afc75e8a9b59c656ff26a3f70
8902058e383c2f43751417e1af1d582f7a16ce0b6fc180ab20cbc76c4b00f914
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8902058E383C2F43751417E1AF1D582F7A16CE0B6FC180AB20CBC76C4B00F914"
Last-Modified: Wed, 14 Aug 2024 12:55:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13904
Expires: Fri, 16 Aug 2024 08:42:25 GMT
Date: Fri, 16 Aug 2024 04:50:41 GMT
Connection: keep-alive
r10.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 90149b127cd563315012f026a9e0544f
1e148905fa524fb8fec15249f30f33085978dc2e
7098a3b23aece2b00e86fd3a23c5e532001a5002b061170d3ed53ddd36bf8f5b
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "7098A3B23AECE2B00E86FD3A23C5E532001A5002B061170D3ED53DDD36BF8F5B"
Last-Modified: Tue, 13 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4717
Expires: Fri, 16 Aug 2024 06:09:18 GMT
Date: Fri, 16 Aug 2024 04:50:41 GMT
Connection: keep-alive
r10.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 4d209e16679910b467c26590a0073236
ddd59fa6902b498e9c0cfb22e342757f954789d0
9ef3dab56215a67804db0e12d33772a1902f5914b788530717712902a294bcb5
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9EF3DAB56215A67804DB0E12D33772A1902F5914B788530717712902A294BCB5"
Last-Modified: Wed, 14 Aug 2024 21:59:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7687
Expires: Fri, 16 Aug 2024 06:58:48 GMT
Date: Fri, 16 Aug 2024 04:50:41 GMT
Connection: keep-alive
r10.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash e4a9f1133ab7ff8fdfec972dc9d80181
2a253964c7b022d903b90b57585333f32f730527
62acc6047405e1e5e89c898325a6f5ba2d9f993214648dc9e50cf0d4f5aa9baa
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "62ACC6047405E1E5E89C898325A6F5BA2D9F993214648DC9E50CF0D4F5AA9BAA"
Last-Modified: Tue, 13 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4483
Expires: Fri, 16 Aug 2024 06:05:24 GMT
Date: Fri, 16 Aug 2024 04:50:41 GMT
Connection: keep-alive
172.67.173.151301 Moved Permanently 167 B URL User Request GET HTTP/1.1 IP 172.67.173.151:80
File type HTML document, ASCII text, with CRLF line terminators
Hash 0104c301c5e02bd6148b8703d19b3a73
7436e0b4b1f8c222c38069890b75fa2baf9ca620
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.top domain
GET / HTTP/1.1
Host: usjn.qjtinw.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: ASP.NET_SessionId=cn5cidq0s2nxce2xveyihd1a; RdStr=cn5cidq0s2nxce2xveyihd1a
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Fri, 16 Aug 2024 04:50:43 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Fri, 16 Aug 2024 05:50:43 GMT
Location: https://usjn.qjtinw.top/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cq%2B9ZXfek%2BKU%2Ft9hlxrpo1re78MoWH8mPTkk%2FEiyhrrR9HU%2Bv1f%2Bn9XYZJDuu43o3fFC2WiaTVWM7oK2ALE9EO73p2l8EcNrcU6RtsvQjyFcoe1ASIu3ZkMoOJJQv0ROkys%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8b3ece1d4fb8b4f4-OSL
alt-svc: h2=":443"; ma=60
r11.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 3c14cfb85dc9ceb923d7d3c3648719d2
10ea83f83398870f50ca771216ad77bd95aa66cc
bc868b2a34fe0c66d7a2dc1754676cc4031891c797fdd23e82d135559bd82c1b
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BC868B2A34FE0C66D7A2DC1754676CC4031891C797FDD23E82D135559BD82C1B"
Last-Modified: Thu, 15 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8587
Expires: Fri, 16 Aug 2024 07:13:50 GMT
Date: Fri, 16 Aug 2024 04:50:43 GMT
Connection: keep-alive
r11.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 3c14cfb85dc9ceb923d7d3c3648719d2
10ea83f83398870f50ca771216ad77bd95aa66cc
bc868b2a34fe0c66d7a2dc1754676cc4031891c797fdd23e82d135559bd82c1b
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BC868B2A34FE0C66D7A2DC1754676CC4031891C797FDD23E82D135559BD82C1B"
Last-Modified: Thu, 15 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8587
Expires: Fri, 16 Aug 2024 07:13:50 GMT
Date: Fri, 16 Aug 2024 04:50:43 GMT
Connection: keep-alive
r11.o.lencr.org/
23.36.76.226 504 B IP 23.36.76.226:0
ASN #20940 Akamai International B.V.
Hash 3c14cfb85dc9ceb923d7d3c3648719d2
10ea83f83398870f50ca771216ad77bd95aa66cc
bc868b2a34fe0c66d7a2dc1754676cc4031891c797fdd23e82d135559bd82c1b
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BC868B2A34FE0C66D7A2DC1754676CC4031891C797FDD23E82D135559BD82C1B"
Last-Modified: Thu, 15 Aug 2024 09:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8587
Expires: Fri, 16 Aug 2024 07:13:50 GMT
Date: Fri, 16 Aug 2024 04:50:43 GMT
Connection: keep-alive
GET usjn.qjtinw.top/?parameter=5s957cuz&question=1b7ea935jet9&bf=y0ecpju/ef301/jwleiy/nlcipx/qcejjx5uixh8y28qfc98ewrhqguqpt9nda2/e75aa4/ciphzy/paaw8kjcolzxqhl3w_psvxzf5/uev58ehwkqh5lyw2/691c8/bi9jkin-fgkqzsrnyv5-zv4hb0b/0cir4/esu_pxx/8jxfkjq2/3d7e4/ecfxz2vyjsq_i/wn0zc/v8psfvev5akm4/jfi9aaweqfebliw2/02cbff/eHFuYXw_aSUjQCNlISQqQ/CpjKm9-/L0B-dGdkIX58/PXJleQ2/1436f/JC9yJXxucWdA/IW89K/kAhfCVeXmV5JWFAaW/MkZV54Kj90ZA2
172.67.173.151302 Found 7.4 kB URL User Request GET HTTP/2 usjn.qjtinw.top/?parameter=5s957cuz&question=1b7ea935jet9&bf=y0ecpju/ef301/jwleiy/nlcipx/qcejjx5uixh8y28qfc98ewrhqguqpt9nda2/e75aa4/ciphzy/paaw8kjcolzxqhl3w_psvxzf5/uev58ehwkqh5lyw2/691c8/bi9jkin-fgkqzsrnyv5-zv4hb0b/0cir4/esu_pxx/8jxfkjq2/3d7e4/ecfxz2vyjsq_i/wn0zc/v8psfvev5akm4/jfi9aaweqfebliw2/02cbff/eHFuYXw_aSUjQCNlISQqQ/CpjKm9-/L0B-dGdkIX58/PXJleQ2/1436f/JC9yJXxucWdA/IW89K/kAhfCVeXmV5JWFAaW/MkZV54Kj90ZA2
IP 172.67.173.151:443
Certificate IssuerGoogle Trust Services
Subjectqjtinw.top
FingerprintFD:E3:36:4C:53:A4:56:94:4E:CB:47:87:A5:5C:CF:93:4E:39:AB:80
ValidityTue, 25 Jun 2024 14:27:56 GMT - Mon, 23 Sep 2024 14:27:55 GMT
Hash 625922ab47b821d2fdc9e9e57e310cdd
1736cced7b393deb983baaf29eb201b92063c138
f9c97b9eee368a3874f244fb7966584bfda9c9cad30b01c23a96ab6187521947
GET /?parameter=5s957cuz&question=1b7ea935jet9&bf=y0ecpju/ef301/jwleiy/nlcipx/qcejjx5uixh8y28qfc98ewrhqguqpt9nda2/e75aa4/ciphzy/paaw8kjcolzxqhl3w_psvxzf5/uev58ehwkqh5lyw2/691c8/bi9jkin-fgkqzsrnyv5-zv4hb0b/0cir4/esu_pxx/8jxfkjq2/3d7e4/ecfxz2vyjsq_i/wn0zc/v8psfvev5akm4/jfi9aaweqfebliw2/02cbff/eHFuYXw_aSUjQCNlISQqQ/CpjKm9-/L0B-dGdkIX58/PXJleQ2/1436f/JC9yJXxucWdA/IW89K/kAhfCVeXmV5JWFAaW/MkZV54Kj90ZA2 HTTP/1.1
Host: usjn.qjtinw.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 16 Aug 2024 04:50:42 GMT
content-type: text/html; charset=utf-8
cache-control: private
location: /9772eeb/ZyRAJWllJSFjfiFAIyN-Y/T89bnk/vJHJefCRlb354ZHRxXg2
set-cookie: ASP.NET_SessionId=cn5cidq0s2nxce2xveyihd1a; path=/; HttpOnly
RdStr=cn5cidq0s2nxce2xveyihd1a; path=/
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3aJgyhjKZLjttCkgIiMfCitDum8jGeC3ZdwkYz2h7WQxuqDGxorF1kZcspe%2BbFXt4gvJRVFy0EGud1q1mJZYjhjyiTZtI5gXUaC5HfVPG5Q89KBXkPHq9g5CsQjeD1QxLHs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8b3ece13baa15690-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
172.67.173.151301 Moved Permanently 9.9 kB URL User Request GET HTTP/1.1 IP 172.67.173.151:80
File type HTML document, ISO-8859 text, with CRLF line terminators
Hash 8363acaeab9cbb099b59b78a44127ca6
aef448ce5500e3734059ec285cf6ec0b547075f2
9b342ae7f25d65bdb817d8c995f3211ac398e41575fc5d149d994c1dcb008f0a
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.top domain
GET / HTTP/1.1
Host: usjn.qjtinw.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: ASP.NET_SessionId=cn5cidq0s2nxce2xveyihd1a; RdStr=cn5cidq0s2nxce2xveyihd1a
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 16 Aug 2024 04:50:43 GMT
content-type: text/html
cache-control: private
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C12FNPCXamgr9vXuqEeE159F0edXvxY35mNmZAFsdTfUyzMGV2fW4fkHeak1qLnllc2o0ZcV6zrPAZ%2BEv4gSNhLmWjLjL1fFVRNbf90hxiK65L6MX4GoZLuIwJfVWbIMhiM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8b3ece1d88da56ca-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET usjn.qjtinw.top/favicon.ico
172.67.173.151200 OK 32 kB URL GET HTTP/3 usjn.qjtinw.top/favicon.ico
IP 172.67.173.151:443
Certificate IssuerGoogle Trust Services
Subjectqjtinw.top
FingerprintFD:E3:36:4C:53:A4:56:94:4E:CB:47:87:A5:5C:CF:93:4E:39:AB:80
ValidityTue, 25 Jun 2024 14:27:56 GMT - Mon, 23 Sep 2024 14:27:55 GMT
File type MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Hash 3f0f72ed57a54b97cda500bcf0545efb
2f252619c18e729d98e16b96d37cd7cd567b38eb
67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943
GET /favicon.ico HTTP/1.1
Host: usjn.qjtinw.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://usjn.qjtinw.top/
Cookie: ASP.NET_SessionId=cn5cidq0s2nxce2xveyihd1a; RdStr=cn5cidq0s2nxce2xveyihd1a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 16 Aug 2024 04:50:43 GMT
content-type: image/x-icon
last-modified: Thu, 01 Aug 2024 10:57:54 GMT
etag: W/"f3c513a91e4da1:0"
x-powered-by: ASP.NET
cache-control: max-age=14400
cf-cache-status: HIT
age: 3709
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a0rx39ow0XBqycuGRzdVK8aGB7bVCSZ2pzzYJisOGaAxLjqeV%2FDl3s74AgNKLn3DbU7w7G74wMc3MPk1JZPnOLAywYpKAY0%2BS9N05tYfQBVLGEN2sr6utopw0oKvkzgUmbE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8b3ece1f9a8256ca-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET usjn.qjtinw.top/9772eeb/ZyRAJWllJSFjfiFAIyN-Y/T89bnk/vJHJefCRlb354ZHRxXg2
172.67.173.151302 Found 1.2 kB URL User Request GET HTTP/2 usjn.qjtinw.top/9772eeb/ZyRAJWllJSFjfiFAIyN-Y/T89bnk/vJHJefCRlb354ZHRxXg2
IP 172.67.173.151:443
Certificate IssuerGoogle Trust Services
Subjectqjtinw.top
FingerprintFD:E3:36:4C:53:A4:56:94:4E:CB:47:87:A5:5C:CF:93:4E:39:AB:80
ValidityTue, 25 Jun 2024 14:27:56 GMT - Mon, 23 Sep 2024 14:27:55 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /9772eeb/ZyRAJWllJSFjfiFAIyN-Y/T89bnk/vJHJefCRlb354ZHRxXg2 HTTP/1.1
Host: usjn.qjtinw.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: ASP.NET_SessionId=cn5cidq0s2nxce2xveyihd1a; RdStr=cn5cidq0s2nxce2xveyihd1a
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 16 Aug 2024 04:50:42 GMT
content-type: text/html; charset=utf-8
cache-control: private
location: /
x-aspnetmvc-version: 5.2
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mc0EAJRg0%2BZSVUSQKp7x1YlldIoEZgLMxCL7VmoGYnXy720sqRqpNIYD8ID7V4HppB6KA2Aqed4sFXBMkwAD%2BQofB%2BaGiLcaXCETmxrUk0th33Pxjg%2F%2BvFRZMccjemkgqDg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8b3ece176d475690-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2