| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash59f504b373ca5c60694d89699bf99f9d 98d3531909c87a27c1cedcda49b9450cb398bdc7 7cd67c1e38bf7cf396230f1f4ca4d83bd04fedd7d1258139ecfceda994200568
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "7CD67C1E38BF7CF396230F1F4CA4D83BD04FEDD7D1258139ECFCEDA994200568"
Last-Modified: Sat, 13 Jul 2024 01:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20296
Expires: Mon, 15 Jul 2024 10:44:28 GMT
Date: Mon, 15 Jul 2024 05:06:12 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash71d8b1aa21db1e3bd7c1c93ec0a27e67 fedadfaa4439b365295709d4bdc6e3ec0fe6c086 b480a5bc991ec721db08973ad1c2946c09ca899b78ca50bfd56bffac0d2d4e39
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B480A5BC991EC721DB08973AD1C2946C09CA899B78CA50BFD56BFFAC0D2D4E39"
Last-Modified: Sun, 14 Jul 2024 15:29:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4437
Expires: Mon, 15 Jul 2024 06:20:09 GMT
Date: Mon, 15 Jul 2024 05:06:12 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash3ce85b1d34b1e8024ca9a37cff66221a 39236c242bdb2053821ca7b473582450acff9b39 4efba0f7a3c02e999ff66fdeea5e0170ef5feb724739a1eeb9b4719772c0deac
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4EFBA0F7A3C02E999FF66FDEEA5E0170EF5FEB724739A1EEB9B4719772C0DEAC"
Last-Modified: Sun, 14 Jul 2024 23:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7919
Expires: Mon, 15 Jul 2024 07:18:11 GMT
Date: Mon, 15 Jul 2024 05:06:12 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP 23.36.77.32:0
ASN#20940 Akamai International B.V.
Hash1069501beed320ba3e21b591ba8dc5ce 9e6b836cfea33a56e2e2598f27cb528578c8033c 568773d146699ebccbd5d393211720dd1b3d4eeb03bdfd8ad4d32c4720814c31
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "568773D146699EBCCBD5D393211720DD1B3D4EEB03BDFD8AD4D32C4720814C31"
Last-Modified: Sun, 14 Jul 2024 16:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3361
Expires: Mon, 15 Jul 2024 06:02:13 GMT
Date: Mon, 15 Jul 2024 05:06:12 GMT
Connection: keep-alive
|
|
| GET cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip | 162.159.135.233 | 301 Moved Permanently | 36 B |
URL User Request GET HTTP/1.1cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip IP 162.159.135.233:80
File typeASCII text, with no line terminators Hasha1ca4bebcd03fafbe2b06a46a694e29a ffc88125007c23ff6711147a12f9bba9c3d197ed c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
NIDS | Severity | Alert | suricata | low | ET INFO ZIP File Download Request via Discord | suricata | low | ET HUNTING Redirect to Discord Attachment Download |
GET /attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Mon, 15 Jul 2024 05:06:12 GMT
content-type: text/plain;charset=UTF-8
content-length: 36
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OC9yJsqtzqtkDmf9%2FLa0X5iCttosCcGiLgrsQNr68f64XicIbJqwUgBC6UjiQHgH1IlJ9Wuz%2FPEQbEwMrIg4M0XcieYRdnIMRp%2FDrtinLQC1I7S%2Fl3Y2vFGYw2%2B6HfoSDSUb8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
set-cookie: __cf_bm=rk_BexoSRcRBlauufRQQ14OQaYF.yh0pMEi54CeUC5M-1721019972-1.0.1.1-ijeZA3ZhqHV1kD9L9qYIBVK88TsfJTH.MMM.FqddE3z7wsGQrCPA2_MF_qmwD06nOQADKV4DLFYEpBd25Cd3EQ; path=/; expires=Mon, 15-Jul-24 05:36:12 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=LZH34zZEFESmX2YO11V1con8rGWF4LoK10KhJLt66Xs-1721019972710-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 8a3738cd6842b50f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| GET cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip | 162.159.135.233 | 301 Moved Permanently | 167 B |
URL User Request GET HTTP/1.1cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip IP 162.159.135.233:80
File typeHTML document, ASCII text, with CRLF line terminators Hash0104c301c5e02bd6148b8703d19b3a73 7436e0b4b1f8c222c38069890b75fa2baf9ca620 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
NIDS | Severity | Alert | suricata | low | ET INFO ZIP File Download Request via Discord | suricata | low | ET HUNTING Redirect to Discord Attachment Download |
GET /attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Mon, 15 Jul 2024 05:06:13 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 15 Jul 2024 06:06:13 GMT
Location: https://cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JDEtmBGc2iXaejyaygU6NdpTFirl3ZqiB4V6H15%2FLOTGIjlrprZuRRsDKRQ0XEcZ49TSYhwrSOIOpS9JmulrLbAT3G%2By%2Fpvnw2zWN%2FabS7FOuPylRmsHHN0jC8MUMijY%2B%2BInGg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Set-Cookie: __cf_bm=VZry3w3B5NLylexhQ1ekiQJhi5JA32qwFxIIBCWNZzg-1721019973-1.0.1.1-PvmF8EzO0W0e.FumTxiajnLunRj9F_zYvTJdT9BhHMsiIYCwg0AUCH_T414pbpjs0AJHqBYecOReRbMKGYgl_A; path=/; expires=Mon, 15-Jul-24 05:36:13 GMT; domain=.discordapp.com; HttpOnly
_cfuvid=MwoCHVxyvC9Dy4mbixFfoESIindmcyH_8XY9WOD0uN0-1721019973015-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly
Server: cloudflare
CF-RAY: 8a3738cf4e36568f-OSL
alt-svc: h3=":443"; ma=86400
|
|
| GET cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip | 162.159.135.233 | 301 Moved Permanently | 36 B |
URL User Request GET HTTP/1.1cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip IP 162.159.135.233:80
File typeASCII text, with no line terminators Hasha1ca4bebcd03fafbe2b06a46a694e29a ffc88125007c23ff6711147a12f9bba9c3d197ed c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
NIDS | Severity | Alert | suricata | low | ET INFO ZIP File Download Request via Discord | suricata | low | ET HUNTING Redirect to Discord Attachment Download |
GET /attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=rk_BexoSRcRBlauufRQQ14OQaYF.yh0pMEi54CeUC5M-1721019972-1.0.1.1-ijeZA3ZhqHV1kD9L9qYIBVK88TsfJTH.MMM.FqddE3z7wsGQrCPA2_MF_qmwD06nOQADKV4DLFYEpBd25Cd3EQ; _cfuvid=LZH34zZEFESmX2YO11V1con8rGWF4LoK10KhJLt66Xs-1721019972710-0.0.1.1-604800000
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Mon, 15 Jul 2024 05:06:13 GMT
content-type: text/plain;charset=UTF-8
content-length: 36
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gHJnxtFRNtXgYgxD6gvMS1tOpK6Tj70XWxG7Lg8sKt5RSEnsMbFqYo%2BPpI8wdeW23m6xoNKi8iDEkByntKL0sf05FVBpt5BqV5EbupwpJprhvoe5s4e3d8BiY6Xe96tYfU2MSA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a3738cf9d73b523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash80ee007415e4a9cd9ff180ee56d4fd90 08276896e8774d12a699400ffe88939d02acd056 b76186c793cde690af253f9096553d00dffd54dc33faf5b9a7059b5ce61de651
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B76186C793CDE690AF253F9096553D00DFFD54DC33FAF5B9A7059B5CE61DE651"
Last-Modified: Sat, 13 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8117
Expires: Mon, 15 Jul 2024 07:21:31 GMT
Date: Mon, 15 Jul 2024 05:06:14 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP 23.36.76.226:0
ASN#20940 Akamai International B.V.
Hash80ee007415e4a9cd9ff180ee56d4fd90 08276896e8774d12a699400ffe88939d02acd056 b76186c793cde690af253f9096553d00dffd54dc33faf5b9a7059b5ce61de651
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B76186C793CDE690AF253F9096553D00DFFD54DC33FAF5B9A7059B5CE61DE651"
Last-Modified: Sat, 13 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8117
Expires: Mon, 15 Jul 2024 07:21:31 GMT
Date: Mon, 15 Jul 2024 05:06:14 GMT
Connection: keep-alive
|
|
| GET cdn.discordapp.com/favicon.ico | 162.159.135.233 | 403 Forbidden | 298 B |
URL GET HTTP/3cdn.discordapp.com/favicon.ico IP 162.159.135.233:443
Requested byhttps://cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip CertificateIssuerCloudflare, Inc. Subjectdiscordapp.com Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39 ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT
File typeXML 1.0 document, ASCII text, with no line terminators Hash3861a3795095fe81fcb8382d2b9066bd 2cef2af9a35d636c3af48902c20891ec49a8e791 b19463cb9b847bdfc7dbf8133d9702d0a0ecc4175335c4a75db211e0196f84b3
GET /favicon.ico HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn.discordapp.com/attachments/1103945982540009533/1234583790811218044/nazimodpc-v1.01.zip
Cookie: __cf_bm=rk_BexoSRcRBlauufRQQ14OQaYF.yh0pMEi54CeUC5M-1721019972-1.0.1.1-ijeZA3ZhqHV1kD9L9qYIBVK88TsfJTH.MMM.FqddE3z7wsGQrCPA2_MF_qmwD06nOQADKV4DLFYEpBd25Cd3EQ; _cfuvid=LZH34zZEFESmX2YO11V1con8rGWF4LoK10KhJLt66Xs-1721019972710-0.0.1.1-604800000
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
date: Mon, 15 Jul 2024 05:06:13 GMT
content-type: application/xml; charset=UTF-8
x-guploader-uploadid: ACJd0NpjtATMPLDVEByDGGBh02elC5OmyhaOOCVlmsAOubgXA9yLBb1m5l0fAzRs2F8dp4lusg
expires: Mon, 15 Jul 2024 05:06:13 GMT
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Spxov%2FHKnxGww0MiSN25q%2F8MnRIygKnsZz67du5NZC5P0MLfuVvKwEUf8RO1QSoxGYUteVbpYeUn2BRBN2vq704hIE6tmdFrFjj8nBIGhDCyFeVn3xSR0iklm3jCGNQP9SWoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a3738d13e59b523-OSL
content-encoding: br
|
|