| 159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll |  159.69.101.181 | 301 Moved Permanently | 276 B |
URL User Request GET HTTP/2159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll IP159.69.101.181:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerSectigo Limited Subject*.whserv.de Fingerprint72:A3:F7:14:4F:35:F5:AD:37:EC:2D:FD:F7:2D:F5:CD:8F:7C:4C:FC ValidityMon, 15 Jul 2024 00:00:00 GMT - Fri, 15 Aug 2025 23:59:59 GMT
File typeHTML document, ASCII text Hash07a1df1ae8aed8591e2cb0aac4d71b76 a40c68ab43d60d50b13684d4b806b0482b9f697a ef3a8a5ab9af3f4a31b5db410c26fe69c88dabe393badeaf87af6a7dfb9fdc6e
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Possible Infostealer Payload | | Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO Dotted Quad Host DLL Request | | suricata | medium | ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity |
GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1
Host: 159.69.101.181
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Mon, 20 Jan 2025 21:05:54 GMT
Server: Apache
Location: https://159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
Content-Length: 276
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
| 159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll | 159.69.101.181 | 404 Not Found | 196 B |
URL User Request GET HTTP/2159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll IP159.69.101.181:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerSectigo Limited Subject*.whserv.de Fingerprint72:A3:F7:14:4F:35:F5:AD:37:EC:2D:FD:F7:2D:F5:CD:8F:7C:4C:FC ValidityMon, 15 Jul 2024 00:00:00 GMT - Fri, 15 Aug 2025 23:59:59 GMT
File typeHTML document, ASCII text Hash62962daa1b19bbcc2db10b7bfd531ea6 d64bae91091eda6a7532ebec06aa70893b79e1f8 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Possible Infostealer Payload | | Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO Dotted Quad Host DLL Request | | suricata | medium | ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity |
GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1
Host: 159.69.101.181
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
content-length: 196
content-type: text/html; charset=iso-8859-1
date: Mon, 20 Jan 2025 21:05:56 GMT
server: Apache
X-Firefox-Spdy: h2
|
| 159.69.101.181/favicon.ico | 159.69.101.181 | 200 OK | 108 kB |
URL GET HTTP/2159.69.101.181/favicon.ico IP159.69.101.181:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll CertificateIssuerSectigo Limited Subject*.whserv.de Fingerprint72:A3:F7:14:4F:35:F5:AD:37:EC:2D:FD:F7:2D:F5:CD:8F:7C:4C:FC ValidityMon, 15 Jul 2024 00:00:00 GMT - Fri, 15 Aug 2025 23:59:59 GMT
File typeMS Windows icon resource - 6 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel Size108 kB (107474 bytes) Hash05b3cd7e44d6a4000a73f10a4901acad 30e70f771040d2c9b226e3ce99b9250159e684bb b0359bba34f1f807a76d1bab843815db36518f349a4d633706435d0503e119de
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 159.69.101.181
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://159.69.101.181/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 16 Oct 2023 12:17:17 GMT
etag: "1a3d2-607d463164d89"
accept-ranges: bytes
content-length: 107474
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
strict-transport-security: max-age=15768000
content-type: image/vnd.microsoft.icon
date: Mon, 20 Jan 2025 21:05:56 GMT
server: Apache
X-Firefox-Spdy: h2
|