Report - 67.225.218.6/fj

Report Overview

Visited public
2023-11-01 06:08:06
Tags
URL
67.225.218.6/fj
Finishing URL
simcast.com/?d=67.225.218.6&pcid=48&rid=112&a=0
IP / ASN
67.225.218.6
#32244 LIQUIDWEB
Title
simcast.com/?d=67.225.218.6&pcid=48&rid=112&a=0

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
simcast.com	53300	2002-12-28	2017-02-01 17:43:29	2023-10-31 05:14:07	986 B	462 B	45.79.244.12
67.225.218.6	unknown	unknown	No data	No data	1.3 kB	3.2 kB	67.225.218.6
ocsp.sectigo.com	487	2018-08-16	2019-11-29 12:50:24	2023-10-31 13:44:23	330 B	963 B	172.64.149.23

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-10-31	medium	67.225.218.6	Sinkholed
2023-10-31	medium	67.225.218.6	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (5)

URL IP Response Size

67.225.218.6/fj

67.225.218.6

1.9 kB

URL
67.225.218.6/fj
IP
67.225.218.6:0
ASN
#32244 LIQUIDWEB

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (520)
Size
1.9 kB (1936 bytes)
Hash
d2a652c942a26a56541f70e22747a9e8
eef28dc1cf06d54bad389fa4d544e5aaaff8278a
99965276faba4dda32fd5969e5b122a8bc4d7c0161daff9c43e7ab571f3ae5e5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fj HTTP/1.1
Host: 67.225.218.6
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 01 Nov 2023 06:07:50 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1936
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

67.225.218.6/page/bouncy.php?&bpae=GbhGd6smYk1zD3Nke5XPFfq63lLuejGoKSs1t5%2BnKzHX6AaaItXJlCkIo%2F%2BvTZLppMbOjbakQnQ17c1JcU12uQmwbedGenIoO3DnAzV52qzpb3HRPESTQX716R79ITpMV2%2FG%2BBeXjx9yxF55DZP%2BlqvzyCm7BbQueLvYzUMPlJkAivsAWySv7sqhK0iI92M9fXSUb6hbHbBZ2jFj%2Bs%2BqJPi6B3GQ6gnv6ya5bUghj%2BAkUMdCxLuyWPnDKyHCzs0yw1tita3%2BOt3t%2FHs80vrbhUQVKGpGv0vIO%2F63L5ilbbbdSKh1uiceXQ61MBMcvR3XAgnKuRvnHo6C%2FaTxMfekk3If9LrQSEZKGv4hKKeKPE0jDe9Hn7GDvNdKEKdWhK%2FTgVfOODuBfqfOs0I%3D&redirectType=js&inIframe=false&inPopUp=false

67.225.218.6

691 B

URL
67.225.218.6/page/bouncy.php?&bpae=GbhGd6smYk1zD3Nke5XPFfq63lLuejGoKSs1t5%2BnKzHX6AaaItXJlCkIo%2F%2BvTZLppMbOjbakQnQ17c1JcU12uQmwbedGenIoO3DnAzV52qzpb3HRPESTQX716R79ITpMV2%2FG%2BBeXjx9yxF55DZP%2BlqvzyCm7BbQueLvYzUMPlJkAivsAWySv7sqhK0iI92M9fXSUb6hbHbBZ2jFj%2Bs%2BqJPi6B3GQ6gnv6ya5bUghj%2BAkUMdCxLuyWPnDKyHCzs0yw1tita3%2BOt3t%2FHs80vrbhUQVKGpGv0vIO%2F63L5ilbbbdSKh1uiceXQ61MBMcvR3XAgnKuRvnHo6C%2FaTxMfekk3If9LrQSEZKGv4hKKeKPE0jDe9Hn7GDvNdKEKdWhK%2FTgVfOODuBfqfOs0I%3D&redirectType=js&inIframe=false&inPopUp=false
IP
67.225.218.6:0
ASN
#32244 LIQUIDWEB

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text
Size
691 B (691 bytes)
Hash
8d8a80d00c72e0f31479cdfe5fbac6c0
cb3854df5c28dfdbf0c170dae182b504e2237ef2
c5f641c207729301205f6ee4935551f2932627cc00edeb2f415c4beddd46bd70

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /page/bouncy.php?&bpae=GbhGd6smYk1zD3Nke5XPFfq63lLuejGoKSs1t5%2BnKzHX6AaaItXJlCkIo%2F%2BvTZLppMbOjbakQnQ17c1JcU12uQmwbedGenIoO3DnAzV52qzpb3HRPESTQX716R79ITpMV2%2FG%2BBeXjx9yxF55DZP%2BlqvzyCm7BbQueLvYzUMPlJkAivsAWySv7sqhK0iI92M9fXSUb6hbHbBZ2jFj%2Bs%2BqJPi6B3GQ6gnv6ya5bUghj%2BAkUMdCxLuyWPnDKyHCzs0yw1tita3%2BOt3t%2FHs80vrbhUQVKGpGv0vIO%2F63L5ilbbbdSKh1uiceXQ61MBMcvR3XAgnKuRvnHo6C%2FaTxMfekk3If9LrQSEZKGv4hKKeKPE0jDe9Hn7GDvNdKEKdWhK%2FTgVfOODuBfqfOs0I%3D&redirectType=js&inIframe=false&inPopUp=false HTTP/1.1
Host: 67.225.218.6
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://67.225.218.6/fj
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
Cache-Control: no-cache
Content-Type: text/html; charset=UTF-8
Date: Wed, 01 Nov 2023 06:07:50 GMT
Pragma: no-cache
Connection: Keep-Alive
X-Powered-By: PHP/5.4.16
Content-Length: 691

ocsp.sectigo.com/

172.64.149.23

471 B

URL
ocsp.sectigo.com/
IP
172.64.149.23:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
471 B (471 bytes)
Hash
e92868b2182b2631f4dc2c2518c91434
8c99f3caf309d5c8142d6dd3ff532b6e4365dea0
a0cec029fd1beb3b8efe1d6f14a9d9b486020db135cf949da6bcb2020fb3022c

HTTP Headers

POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 01 Nov 2023 06:07:51 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Mon, 30 Oct 2023 13:23:38 GMT
Expires: Mon, 06 Nov 2023 13:23:37 GMT
Etag: "8c99f3caf309d5c8142d6dd3ff532b6e4365dea0"
Cache-Control: max-age=458286,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 81f1f5b9cf9ab4f9-OSL

simcast.com/?d=67.225.218.6&pcid=48&rid=112&a=0

45.79.244.12

503 Service Unavailable

107 B

URL User Request GET HTTP/1.1
simcast.com/?d=67.225.218.6&pcid=48&rid=112&a=0
IP
45.79.244.12:443
ASN
#63949 Linode, LLC

Certificate
IssuerSectigo Limited
Subject*.simcast.com
Fingerprint4C:EB:A7:1C:C9:B3:CB:B5:7D:80:45:91:D6:98:47:12:5A:BF:E6:BB
ValidityMon, 09 Oct 2023 00:00:00 GMT - Thu, 29 Aug 2024 23:59:59 GMT

File type
HTML document, ASCII text
Size
107 B (107 bytes)
Hash
ff4ed829ffd04e9c6095842b07d11f09
6fbe9df856956467c1691558796c86fc392ed5b6
839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79

HTTP Headers

GET /?d=67.225.218.6&pcid=48&rid=112&a=0 HTTP/1.1
Host: simcast.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://67.225.218.6/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 503 Service Unavailable
content-length: 107
cache-control: no-cache
content-type: text/html
connection: close

simcast.com/favicon.ico

45.79.244.12

503 Service Unavailable

107 B

URL GET HTTP/1.1
simcast.com/favicon.ico
IP
45.79.244.12:443
ASN
#63949 Linode, LLC

Requested by
https://simcast.com/?d=67.225.218.6&pcid=48&rid=112&a=0
Certificate
IssuerSectigo Limited
Subject*.simcast.com
Fingerprint4C:EB:A7:1C:C9:B3:CB:B5:7D:80:45:91:D6:98:47:12:5A:BF:E6:BB
ValidityMon, 09 Oct 2023 00:00:00 GMT - Thu, 29 Aug 2024 23:59:59 GMT

File type
HTML document, ASCII text
Size
107 B (107 bytes)
Hash
ff4ed829ffd04e9c6095842b07d11f09
6fbe9df856956467c1691558796c86fc392ed5b6
839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: simcast.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://simcast.com/?d=67.225.218.6&pcid=48&rid=112&a=0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 503 Service Unavailable
content-length: 107
cache-control: no-cache
content-type: text/html
connection: close

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (5)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers