URL User Request GET HTTP/2IP 104.21.32.1:443
CertificateIssuerGoogle Trust Services Subject676.su Fingerprint10:32:34:D7:F6:85:2A:2C:19:B1:AD:11:D9:23:B4:6C:94:3A:BD:6A ValiditySun, 22 Dec 2024 09:23:37 GMT - Sat, 22 Mar 2025 10:22:16 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash0104c301c5e02bd6148b8703d19b3a73 7436e0b4b1f8c222c38069890b75fa2baf9ca620 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
GET /fUuw HTTP/1.1
Host: 676.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: ishort_session=eyJpdiI6IiszdmNVdmZmcXJLWk10VWdpa0dQTnc9PSIsInZhbHVlIjoiSmJlZjc2ZGdWcE9FSDdZQWtlQzZaSjUzenlXdmxRTTBMdG9HdTVkaFNSY2o0dzNwL2ZWVXdxaTFCekRHMXBkS3lPUmxSUjlHRWUrUlJjVUtCczdmK2tXdFVuYTlDRFhHM05UQUFYYnBwOWhLNlJDY2grRlRpbHRXVEdmSUpWR3QiLCJtYWMiOiI4NWZjZmIyZTEwYjMzMDU2MmQyNDFhNTVjNDg2ZTJlOTZhY2Q3NjY0ZDFjYzA2MTE2ODhkMjJjMWJhNTM4ODMyIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Sun, 26 Jan 2025 12:32:17 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 26 Jan 2025 13:32:17 GMT
Location: https://676.su/fUuw
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nc8n5Ae%2Fvep%2Fzu0sKU2bF0iulkWQ0VkwJmRuDwg1HOzWM1HJhQ%2F%2BxuWeXubOOhwb%2Bs69KrJpw8yZbynrhMWrqL3BZhPjqiitEBCU5A4m6OU39ne0zIQVAmA%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 9080865df8c3b4f9-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=400&min_rtt=400&rtt_var=200&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=750&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
IP104.21.32.1:443
CertificateIssuerGoogle Trust Services Subject676.su Fingerprint10:32:34:D7:F6:85:2A:2C:19:B1:AD:11:D9:23:B4:6C:94:3A:BD:6A ValiditySun, 22 Dec 2024 09:23:37 GMT - Sat, 22 Mar 2025 10:22:16 GMT
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel Hash670d69326930632a8f1593850832b29e 8ff579fd8591a7dfe03c3fa0e8c22a37b6218e57 6880fc798347ab02deea2e4c521b8640566e8db4d6d55c557101c43f50d346c4
GET /favicon.ico HTTP/1.1
Host: 676.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://676.su/fUuw
Cookie: XSRF-TOKEN=eyJpdiI6Ii9ZVGhQbm1UZi9pYWtoQWxhZ1NTY3c9PSIsInZhbHVlIjoiQnVxbjBBSFhnUkdVTkpML3pQSFNBSmhUcTlNQVlNNlNlYlRtSGxEYXEraVRVTTZTdU05ZG1hVVhPVmhITnVUZWFubmtoSEpjS2h0TS9jTThDRDRicS9jNzRvNWJPRzI0V3BnMmR5Sk55ZW84WFQzQ1BvRHErT01Ia01vUXFxdWciLCJtYWMiOiJjNzQ2M2Q1MzMwOGE0NDRiNjIxOTAyNjMwNDIxOTZiNjhmZWY5NGM4MTYzZGU2OTg1MmMyZmUzOWRhOWQzODliIiwidGFnIjoiIn0%3D; ishort_session=eyJpdiI6IktvUnFra292Zm9ORHNnRWNUcmJsVEE9PSIsInZhbHVlIjoieHNLZDNlb0FlL21vcmVmT0tMbzRWa21tSC8zaWM3NlNaWHlWRFFxVG03M0hrNUF5azBqWWxOODVDT09BSFZ2RFNOc0RCMjZCazNZQWYzeGFyQmQ1WGJaRG94MzI3TUNlRjJxdG9PWTNMbGQ3Y2dOemx2d0RuMUlTV1pUaWVSeHYiLCJtYWMiOiIwYmEzZDYzYWRlNDAzYzc4NGI4ZWVmMDdhNDRlYjllNGEzNjY1OWY4ZTJiZWFmNWI2MGZkMzg4ZDJhMjkyY2FiIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 26 Jan 2025 12:32:18 GMT
content-type: image/x-icon
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iCmdpB8RGKR5%2B5B5VYk6Ad0NqS2%2BIQzPGMC5t55a7Hx5cmwdwUMdzqBl9JHPY%2F%2F2%2F8DLxMn5whjt9ohkkIwgWvk0jEo6xVw9GtZc8vrj%2BHtasVPsT2NGPkI%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Sun, 29 Oct 2023 03:52:05 GMT
vary: Accept-Encoding
etag: W/"653dd6e5-47e"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
cf-ray: 908086606bd60b41-OSL
server: cloudflare
alt-svc: h3=":443"; ma=86400
|