Report - 89.23.100.169:7777/2hsdgpfdg.txt

Report Overview

Visited public
2024-07-02 11:00:17
Tags
URL
89.23.100.169:7777/2hsdgpfdg.txt
Finishing URL
89.23.100.169:7777/2hsdgpfdg.txt
IP / ASN
89.23.100.169
#56694 LLC Smart Ape
Title
89.23.100.169:7777/2hsdgpfdg.txt

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-06-30 18:17:38	1.6 kB	4.4 kB	23.36.76.226
89.23.100.169:7777	unknown	unknown	No data	No data	798 B	1.9 kB	89.23.100.169

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-07-02 10:59:52	high	89.23.100.169	Client IP	ET HUNTING Rejetto HTTP File Sever Response
2024-07-02 11:00:01	medium	Client IP	110.87.98.114	ET INFO Executable Download from dotted-quad Host
2024-07-02 11:00:08	medium	Client IP	110.87.98.114	ET INFO Executable Download from dotted-quad Host
2024-07-02 11:00:08	medium	Client IP	110.87.98.114	ET INFO Executable Download from dotted-quad Host

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-07-02	medium	89.23.100.169	Sinkholed
2024-07-02	medium	89.23.100.169	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (7)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
b7dbdd91e33b4b40b990affe38907ed8
8c1dc814dfd071e0c4dcfc0f5429eb7c221d609a
842512e65717b866647d52bc726c962cc42c7e2027c53a2b5b79d7b86d2e50fc

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "842512E65717B866647D52BC726C962CC42C7E2027C53A2B5B79D7B86D2E50FC"
Last-Modified: Sun, 30 Jun 2024 13:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2567
Expires: Tue, 02 Jul 2024 11:42:38 GMT
Date: Tue, 02 Jul 2024 10:59:51 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f6d043d7b5e98906db1fe2695e98859c
154db889ef567d2839bb7eaa15818cd546495b4f
f4fcc79261acda8e1cb81b9fc6524ee560b60740b0cf8107308dc82750dc079a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F4FCC79261ACDA8E1CB81B9FC6524EE560B60740B0CF8107308DC82750DC079A"
Last-Modified: Sat, 29 Jun 2024 23:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11585
Expires: Tue, 02 Jul 2024 14:12:57 GMT
Date: Tue, 02 Jul 2024 10:59:52 GMT
Connection: keep-alive

89.23.100.169:7777/2hsdgpfdg.txt

89.23.100.169

200 OK

961 B

URL User Request GET HTTP/1.1
89.23.100.169:7777/2hsdgpfdg.txt
IP
89.23.100.169:7777
ASN
#56694 LLC Smart Ape

File type
ASCII text, with CRLF line terminators
Size
961 B (961 bytes)
Hash
55c290d71bd2e5d9644f835380858d42
b6981e85e14923316d6a188326a9795a1990bf3c
12c6ad9d8ed686b20d3e049579a2d04cff72398f11e8ab61daae32cafdd1e759

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2hsdgpfdg.txt HTTP/1.1
Host: 89.23.100.169:7777
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 961
Accept-Ranges: bytes
Server: HFS 2.3m
Set-Cookie: HFS_SID_=0.223409631289542; path=/; HttpOnly
ETag: 359A760D698CE81D8B196F2408ADF386
Last-Modified: Tue, 02 Jul 2024 12:36:42 GMT
Content-Disposition: filename="2hsdgpfdg.txt";

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
6809014b6f52128eea64522a888ef559
c5403c0900fff6604a4f58e3cd83a67d587c7ac2
c6035fcd2c47b60fecbb2f86f67249e4fe21736a75c6cf000f5e9212f88c154d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "C6035FCD2C47B60FECBB2F86F67249E4FE21736A75C6CF000F5E9212F88C154D"
Last-Modified: Tue, 02 Jul 2024 04:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7769
Expires: Tue, 02 Jul 2024 13:09:21 GMT
Date: Tue, 02 Jul 2024 10:59:52 GMT
Connection: keep-alive

89.23.100.169:7777/favicon.ico

89.23.100.169

200 OK

576 B

URL GET HTTP/1.1
89.23.100.169:7777/favicon.ico
IP
89.23.100.169:7777
ASN
#56694 LLC Smart Ape

Requested by
http://89.23.100.169:7777/2hsdgpfdg.txt

File type
GIF image data, version 89a, 16 x 16
Size
576 B (576 bytes)
Hash
759792edd4ef8e6bc2d1877d27153cb1
f15874992d084f6fddc40a93eba12bef1e995447
10dc6e7a6b5a0b86167994767dd0bc652eb04aba06c18d1410d0761da470b00a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 89.23.100.169:7777
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://89.23.100.169:7777/2hsdgpfdg.txt
Cookie: HFS_SID_=0.223409631289542
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 576
Accept-Ranges: bytes
Server: HFS 2.3m

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c4b71305103f33b56dd398fb1f3fa9fe
6237cf96ced2a5d69a73769180ae8250221727ea
4120fbb0536a3608210c487750025bea2ff87804924732c527207e00add13a34

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4120FBB0536A3608210C487750025BEA2FF87804924732C527207E00ADD13A34"
Last-Modified: Sun, 30 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21289
Expires: Tue, 02 Jul 2024 16:54:42 GMT
Date: Tue, 02 Jul 2024 10:59:53 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c4b71305103f33b56dd398fb1f3fa9fe
6237cf96ced2a5d69a73769180ae8250221727ea
4120fbb0536a3608210c487750025bea2ff87804924732c527207e00add13a34

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "4120FBB0536A3608210C487750025BEA2FF87804924732C527207E00ADD13A34"
Last-Modified: Sun, 30 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21289
Expires: Tue, 02 Jul 2024 16:54:42 GMT
Date: Tue, 02 Jul 2024 10:59:53 GMT
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (7)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers