Report - 154.84.6.13/forum/archiver/tid-10180579.html

Report Overview

Visited public
2024-07-04 10:20:00
Tags
URL
154.84.6.13/forum/archiver/tid-10180579.html
Finishing URL
154.84.6.13/forum/archiver/tid-10180579.html
IP / ASN
154.84.6.13
#40065 CNSERVERS
Title
【魔女妈妈前篇之小姨的足下求生！】（11-12）【作者：一个人】(页 1) - 重口另类区 - SiS001! Board - [第一会所关闭注册] - SiS001 Archiver

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-07-02 18:12:20	327 B	887 B	2.16.206.143
154.84.6.13	unknown	unknown	No data	No data	1.9 kB	223 kB	154.84.6.13
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-02 18:12:35	1.6 kB	4.4 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-07-04	medium	154.84.6.13	Sinkholed
2024-07-04	medium	154.84.6.13	Sinkholed
2024-07-04	medium	154.84.6.13	Sinkholed
2024-07-04	medium	154.84.6.13	Sinkholed
2024-07-04	medium	154.84.6.13	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (11)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
957cd8e6bd774045d4cab550ce76f80a
d06d4246273e9ba4fba69494038c77f5c53aadb6
e4778c960b009c229dbb555ff7679b6d245d6f7111fd66fd5c514847b06acdbb

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E4778C960B009C229DBB555FF7679B6D245D6F7111FD66FD5C514847B06ACDBB"
Last-Modified: Wed, 03 Jul 2024 01:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7185
Expires: Thu, 04 Jul 2024 12:19:19 GMT
Date: Thu, 04 Jul 2024 10:19:34 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
b8ee6ca153df6819132dd5d8a6ba5c76
0ed0f0f631777272bd71ba23719e71695c9d95e1
bdca7ce7bb6febd6a6afb56a828cf4422c1a8971524484e8128cafad8e6b3367

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "BDCA7CE7BB6FEBD6A6AFB56A828CF4422C1A8971524484E8128CAFAD8E6B3367"
Last-Modified: Tue, 02 Jul 2024 11:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11372
Expires: Thu, 04 Jul 2024 13:29:06 GMT
Date: Thu, 04 Jul 2024 10:19:34 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
29a90370a62299ab28dd09d9bb017b64
54e136495ccb82671708b41981735ca7b384c63f
af9ff8700281064d12b8237fa5350720f4c67756063b971777a353aee916bc59

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "AF9FF8700281064D12B8237FA5350720F4C67756063B971777A353AEE916BC59"
Last-Modified: Tue, 02 Jul 2024 04:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16448
Expires: Thu, 04 Jul 2024 14:53:42 GMT
Date: Thu, 04 Jul 2024 10:19:34 GMT
Connection: keep-alive

r11.o.lencr.org/

2.16.206.143

504 B

URL
r11.o.lencr.org/
IP
2.16.206.143:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
5b7edca18a5a081bcb9cc51db53473b3
48493b0684eb140d75f5bf2c1134bb40ce4e15d8
314128a8223411147dddac10ee3c608fde5322cc489644842210c8ce149e33b0

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "314128A8223411147DDDAC10EE3C608FDE5322CC489644842210C8CE149E33B0"
Last-Modified: Tue, 02 Jul 2024 08:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2708
Expires: Thu, 04 Jul 2024 11:04:43 GMT
Date: Thu, 04 Jul 2024 10:19:35 GMT
Connection: keep-alive

GET 154.84.6.13/forum/archiver/tid-10180579.html

154.84.6.13

200 OK

1.6 kB

URL User Request GET HTTP/1.1
154.84.6.13/forum/archiver/tid-10180579.html
IP
154.84.6.13:80
ASN
#40065 CNSERVERS

File type
HTML document, Unicode text, UTF-8 text, with CRLF, LF line terminators
Size
1.6 kB (1573 bytes)
Hash
1dda44d8c5c6489d68749cb92062564e
3cb3ac00679b85470b89cdbae87c9409ce43dcfd
f2897c58b765a59b95ee84fe637c2fdfe3f960326bf36b5d087a132692e8b515

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /forum/archiver/tid-10180579.html HTTP/1.1
Host: 154.84.6.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 04 Jul 2024 10:19:35 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1573
Connection: keep-alive
vary: Accept-Encoding
content-encoding: gzip
x-turbo-charged-by: LiteSpeed

GET 154.84.6.13/forum/forumdata/cache/style_24.css

154.84.6.13

200 OK

9.9 kB

URL GET HTTP/1.1
154.84.6.13/forum/forumdata/cache/style_24.css
IP
154.84.6.13:80
ASN
#40065 CNSERVERS

Requested by
http://154.84.6.13/forum/archiver/tid-10180579.html

File type
HTML document, ASCII text, with CRLF, LF line terminators
Size
9.9 kB (9935 bytes)
Hash
c06b46fd3b0f18c02a9a1c05c4d60e2d
7de2baeadc33595d5e717e675f1f80edafc2bcac
2ce00c03a8917874f8df50ae3820e4606b85ec6ed2eca0eddec56c0daf24247c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /forum/forumdata/cache/style_24.css HTTP/1.1
Host: 154.84.6.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://154.84.6.13/forum/archiver/tid-10180579.html
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 04 Jul 2024 10:19:35 GMT
Content-Type: text/css
Content-Length: 9935
Connection: keep-alive
cache-control: public, max-age=604800
expires: Thu, 11 Jul 2024 10:19:35 GMT
last-modified: Thu, 04 Jul 2024 05:08:45 GMT
etag: "b8bf-66862e5d-e385a518efc2afc7;gz"
accept-ranges: bytes
content-encoding: gzip
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET 154.84.6.13/favicon.ico

154.84.6.13

200 OK

1.2 kB

URL GET HTTP/1.1
154.84.6.13/favicon.ico
IP
154.84.6.13:80
ASN
#40065 CNSERVERS

Requested by
http://154.84.6.13/forum/archiver/tid-10180579.html

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
7d7b53ebc19b888c9e21f5481b4f053c
5d7f7e4d23e3ac01706846e9cad46873db499fa5
741438482da0e7bd34d2d2b79a5430e66511ac589482b45644afc68ef1bd926b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 154.84.6.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://154.84.6.13/forum/archiver/tid-10180579.html
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 04 Jul 2024 10:19:36 GMT
Content-Type: image/x-icon
Content-Length: 1150
Connection: keep-alive
cache-control: public, max-age=604800
expires: Thu, 11 Jul 2024 10:19:36 GMT
last-modified: Mon, 26 Mar 2012 13:51:18 GMT
etag: "47e-4f707456-de831f31ce25ae6b;;;"
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
20f6da3946882ea83e1d78dfaedbf953
1a8f214ff6a98dae0e57244bac88b6721452a40c
a6ad831046e57007e12f62b75b6fc71963f13823e799a3e25e618ee09a3c9d27

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A6AD831046E57007E12F62B75B6FC71963F13823E799A3E25E618EE09A3C9D27"
Last-Modified: Wed, 03 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4107
Expires: Thu, 04 Jul 2024 11:28:03 GMT
Date: Thu, 04 Jul 2024 10:19:36 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
20f6da3946882ea83e1d78dfaedbf953
1a8f214ff6a98dae0e57244bac88b6721452a40c
a6ad831046e57007e12f62b75b6fc71963f13823e799a3e25e618ee09a3c9d27

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A6AD831046E57007E12F62B75B6FC71963F13823E799A3E25E618EE09A3C9D27"
Last-Modified: Wed, 03 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4107
Expires: Thu, 04 Jul 2024 11:28:03 GMT
Date: Thu, 04 Jul 2024 10:19:36 GMT
Connection: keep-alive

GET 154.84.6.13/forum/paypic/202406292125557302.png

154.84.6.13

200 OK

69 kB

URL GET HTTP/1.1
154.84.6.13/forum/paypic/202406292125557302.png
IP
154.84.6.13:80
ASN
#40065 CNSERVERS

Requested by
http://154.84.6.13/forum/archiver/tid-10180579.html

File type
PNG image data, 660 x 60, 8-bit/color RGB, non-interlaced
Size
69 kB (69013 bytes)
Hash
a5a1dd3d27efce64af0a08d11dfff707
4751b484ed2a3c71a6919104c93b289475397380
055b11f91a975ea2dcd610ddc5b327b21a49c05e2caa8e245e6f02b7de7c4b00

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /forum/paypic/202406292125557302.png HTTP/1.1
Host: 154.84.6.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://154.84.6.13/forum/archiver/tid-10180579.html
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 04 Jul 2024 10:19:36 GMT
Content-Type: image/png
Content-Length: 69013
Connection: keep-alive
cache-control: public, max-age=604800
expires: Thu, 11 Jul 2024 10:19:36 GMT
last-modified: Sat, 29 Jun 2024 13:25:55 GMT
etag: "10d95-66800b63-fd656238c32fc92f;;;"
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed

GET 154.84.6.13/forum/paypic/202405272308153707.gif

154.84.6.13

200 OK

140 kB

URL GET HTTP/1.1
154.84.6.13/forum/paypic/202405272308153707.gif
IP
154.84.6.13:80
ASN
#40065 CNSERVERS

Requested by
http://154.84.6.13/forum/archiver/tid-10180579.html

File type
GIF image data, version 89a, 660 x 60
Size
140 kB (139523 bytes)
Hash
a18308a5568af783a95ca2a93dd2a6cc
0bef22cb91944944499ce2206429927664b8fb08
0a1124aaaff0776085abe1cac42268ad4b97970eb1f4eeaa5f809d44dba5bef5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /forum/paypic/202405272308153707.gif HTTP/1.1
Host: 154.84.6.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://154.84.6.13/forum/archiver/tid-10180579.html
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 04 Jul 2024 10:19:36 GMT
Content-Type: image/gif
Content-Length: 139523
Connection: keep-alive
cache-control: public, max-age=604800
expires: Thu, 11 Jul 2024 10:19:36 GMT
last-modified: Mon, 27 May 2024 15:08:15 GMT
etag: "22103-6654a1df-f1a11ae4ff4b395;;;"
accept-ranges: bytes
x-turbo-charged-by: LiteSpeed

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (11)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size