Report - l2-lords.clan.su/

Report Overview

Visited public
2023-12-01 22:07:50
Tags
URL
l2-lords.clan.su/_ld/0/
Finishing URL
l2-lords.clan.su/_ld/0/
IP / ASN
195.216.243.40
#57724 Ddos-guard Ltd
Title
403 - You don't have permission to access this resource

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
l2-lords.clan.su	unknown	unknown	No data	No data	3.6 kB	72 kB	195.216.243.40
ajax.googleapis.com	12905	2005-01-25	2013-08-16 11:51:31	2023-12-01 08:07:42	444 B	34 kB	142.250.74.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-01 22:07:38	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:38	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:38	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:38	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:38	medium	Client IP	195.216.243.40	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:38	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:39	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:39	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:39	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:39	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-12-01 22:07:39	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	From	Size	First Seen	Last Seen
	ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js	ScriptElement	93 kB	2023-03-07	2025-05-09
Pretty URL ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js IP 142.250.74.106 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 08:26 Times Seen10307 Hash e0e0559014b222245deb26b6ae8bd940 e2f3603e23711f6446f278a411d905623d65201e 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Loading...

	l2-lords.clan.su/.serr/js/core.js	ScriptElement	414 B	2023-03-07	2025-05-06
Pretty URL l2-lords.clan.su/.serr/js/core.js IP 195.216.243.40 ASN #57724 Ddos-guard Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:03 Last Seen2025-05-06 13:08 Times Seen116 Hash 5701bc484b705ef62821a39f29742cba 2da3dc6a488db5812f1911bf96888a4c7aaf436f 80053729721b15fe8667def4e6270e156043789e01f7ec35defae93933274493 Loading...

	l2-lords.clan.su/_ld/0/	ScriptElement	0 B	0001-01-01	2025-05-09
Pretty URL l2-lords.clan.su/_ld/0/ IP 195.216.243.40 ASN #57724 Ddos-guard Ltd Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-05-09 10:41 Times Seen4635402 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (9)

URL IP Response Size

l2-lords.clan.su/_ld/0/

195.216.243.40

301 Moved Permanently

1.1 kB

URL User Request GET HTTP/1.1
l2-lords.clan.su/_ld/0/
IP
195.216.243.40:80
ASN
#57724 Ddos-guard Ltd

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Size
1.1 kB (1103 bytes)
Hash
e79c1cea52873736e8670850d1149453
d8100707cfc467efb1e7da75425a92a1f3211b55
6d61e544c5debbe618d8dd7b3c297983c4fdfe4368ead7e0a925ec335a8b953b

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /_ld/0/ HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Server: nginx
Date: Fri, 01 Dec 2023 22:07:46 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Content-Encoding: gzip

l2-lords.clan.su/_ld/0/

195.216.243.40

301 Moved Permanently

178 B

URL User Request GET HTTP/1.1
l2-lords.clan.su/_ld/0/
IP
195.216.243.40:80
ASN
#57724 Ddos-guard Ltd

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
cd2e0e43980a00fb6a2742d3afd803b8
81ffbd1712afe8cdf138b570c0fc9934742c33c1
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /_ld/0/ HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 01 Dec 2023 22:07:47 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Keep-Alive: timeout=15
Location: https://l2-lords.clan.su/_ld/0/
X-Frame-Options: SAMEORIGIN

l2-lords.clan.su/_ld/0/

195.216.243.40

301 Moved Permanently

1.1 kB

URL User Request GET HTTP/1.1
l2-lords.clan.su/_ld/0/
IP
195.216.243.40:80
ASN
#57724 Ddos-guard Ltd

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Size
1.1 kB (1103 bytes)
Hash
e79c1cea52873736e8670850d1149453
d8100707cfc467efb1e7da75425a92a1f3211b55
6d61e544c5debbe618d8dd7b3c297983c4fdfe4368ead7e0a925ec335a8b953b

Detections

NIDS	Severity	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET /_ld/0/ HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Server: nginx
Date: Fri, 01 Dec 2023 22:07:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Content-Encoding: gzip

l2-lords.clan.su/.serr/css/style.css

195.216.243.40

200 OK

4.3 kB

URL GET HTTP/1.1
l2-lords.clan.su/.serr/css/style.css
IP
195.216.243.40:443
ASN
#57724 Ddos-guard Ltd

Requested by
https://l2-lords.clan.su/_ld/0/
Certificate
IssuerGlobalSign nv-sa
Subject*.clan.su
Fingerprint72:0F:A9:E1:43:31:46:F3:D0:87:C7:4C:8C:61:F2:CC:95:9B:F8:2B
ValiditySat, 30 Sep 2023 16:28:50 GMT - Thu, 31 Oct 2024 16:28:49 GMT

File type
ASCII text, with CRLF line terminators
Size
4.3 kB (4288 bytes)
Hash
98a90bc50f0b53842d1863fec51697fa
2e39243745ccb62e77a2fa92357f703619aba6d8
6fcbe05fd7251ea2506caecbb12812dc2273ceb231a3182aeee4124b0165d9ef

HTTP Headers

GET /.serr/css/style.css HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://l2-lords.clan.su/_ld/0/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 22:07:47 GMT
Content-Type: text/css
Last-Modified: Thu, 09 Nov 2023 14:44:37 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
ETag: W/"654cf055-4c25"
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip

ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

142.250.74.106

200 OK

33 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://l2-lords.clan.su/_ld/0/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT

File type
ASCII text, with very long lines (32072)
Size
33 kB (32954 bytes)
Hash
e0e0559014b222245deb26b6ae8bd940
e2f3603e23711f6446f278a411d905623d65201e
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

HTTP Headers

GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://l2-lords.clan.su/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 32954
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 01 Dec 2023 11:16:17 GMT
expires: Sat, 30 Nov 2024 11:16:17 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 39077
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

l2-lords.clan.su/.serr/js/core.js

195.216.243.40

200 OK

234 B

URL GET HTTP/1.1
l2-lords.clan.su/.serr/js/core.js
IP
195.216.243.40:443
ASN
#57724 Ddos-guard Ltd

Requested by
https://l2-lords.clan.su/_ld/0/
Certificate
IssuerGlobalSign nv-sa
Subject*.clan.su
Fingerprint72:0F:A9:E1:43:31:46:F3:D0:87:C7:4C:8C:61:F2:CC:95:9B:F8:2B
ValiditySat, 30 Sep 2023 16:28:50 GMT - Thu, 31 Oct 2024 16:28:49 GMT

File type
ASCII text, with very long lines (414), with no line terminators
Size
234 B (234 bytes)
Hash
5701bc484b705ef62821a39f29742cba
2da3dc6a488db5812f1911bf96888a4c7aaf436f
80053729721b15fe8667def4e6270e156043789e01f7ec35defae93933274493

HTTP Headers

GET /.serr/js/core.js HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://l2-lords.clan.su/_ld/0/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 22:07:47 GMT
Content-Type: text/javascript
Last-Modified: Thu, 09 Nov 2023 14:44:38 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
ETag: W/"654cf056-19e"
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip

l2-lords.clan.su/.serr/img/ulogo.svg

195.216.243.40

200 OK

4.2 kB

URL GET HTTP/1.1
l2-lords.clan.su/.serr/img/ulogo.svg
IP
195.216.243.40:443
ASN
#57724 Ddos-guard Ltd

Requested by
https://l2-lords.clan.su/_ld/0/
Certificate
IssuerGlobalSign nv-sa
Subject*.clan.su
Fingerprint72:0F:A9:E1:43:31:46:F3:D0:87:C7:4C:8C:61:F2:CC:95:9B:F8:2B
ValiditySat, 30 Sep 2023 16:28:50 GMT - Thu, 31 Oct 2024 16:28:49 GMT

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size
4.2 kB (4235 bytes)
Hash
993299552bfd263cd4a75ad398e75b58
3fc9ad991516b8ad0c6553a05de4a8c9759c5020
c660064588748948fcadc6a86b73dcb981d124c370b0ba764fe8a210854f6cd5

HTTP Headers

GET /.serr/img/ulogo.svg HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://l2-lords.clan.su/.serr/css/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 22:07:47 GMT
Content-Type: image/svg+xml
Content-Length: 4235
Last-Modified: Thu, 09 Nov 2023 14:44:38 GMT
Connection: keep-alive
Keep-Alive: timeout=15
ETag: "654cf056-108b"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes

l2-lords.clan.su/.serr/img/permission.png

195.216.243.40

200 OK

57 kB

URL GET HTTP/1.1
l2-lords.clan.su/.serr/img/permission.png
IP
195.216.243.40:443
ASN
#57724 Ddos-guard Ltd

Requested by
https://l2-lords.clan.su/_ld/0/
Certificate
IssuerGlobalSign nv-sa
Subject*.clan.su
Fingerprint72:0F:A9:E1:43:31:46:F3:D0:87:C7:4C:8C:61:F2:CC:95:9B:F8:2B
ValiditySat, 30 Sep 2023 16:28:50 GMT - Thu, 31 Oct 2024 16:28:49 GMT

File type
PNG image data, 290 x 343, 8-bit/color RGBA, non-interlaced\012- data
Size
57 kB (56622 bytes)
Hash
e2920dd1c2415512bae8f8a14cc2e6ce
37a64753c87c0697251c39846f56ae8940e76a34
9e05947c753727bf2f39f344befd4f5bb006c1dd2f66ec5a65fad41d411a1bf1

HTTP Headers

GET /.serr/img/permission.png HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://l2-lords.clan.su/.serr/css/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 01 Dec 2023 22:07:47 GMT
Content-Type: image/png
Content-Length: 56622
Last-Modified: Thu, 09 Nov 2023 14:44:38 GMT
Connection: keep-alive
Keep-Alive: timeout=15
ETag: "654cf056-dd2e"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes

l2-lords.clan.su/.serr/img/favicon.ico

195.216.243.40

404 Not Found

2.7 kB

URL GET HTTP/1.1
l2-lords.clan.su/.serr/img/favicon.ico
IP
195.216.243.40:443
ASN
#57724 Ddos-guard Ltd

Requested by
https://l2-lords.clan.su/_ld/0/
Certificate
IssuerGlobalSign nv-sa
Subject*.clan.su
Fingerprint72:0F:A9:E1:43:31:46:F3:D0:87:C7:4C:8C:61:F2:CC:95:9B:F8:2B
ValiditySat, 30 Sep 2023 16:28:50 GMT - Thu, 31 Oct 2024 16:28:49 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (348)
Size
2.7 kB (2656 bytes)
Hash
5c75256ff15177fadac5c895c962b733
e90e0c7a8be93e60dc3410157c38d7d3f732b88f
62f1c6afca91811f41c42ddb85464a4ddf0787793a079a68587c1a0f0b53c5d3

HTTP Headers

GET /.serr/img/favicon.ico HTTP/1.1
Host: l2-lords.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://l2-lords.clan.su/_ld/0/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 01 Dec 2023 22:07:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Content-Encoding: gzip

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN