| obsidian.im-not-a-virus.zip/favicon.ico | 188.114.97.1 | 403 Forbidden | 4.5 kB |
URL GET obsidian.im-not-a-virus.zip/favicon.ico IP 188.114.97.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
File typeHTML document, ASCII text, with very long lines (394) Hash0363c7c97c6af029135155c5bd7dae91 01850d7e2577931049097deaa56adbdbeae64edc f379994affc5e6f59ea70b9eb6d45c5164e91d7e582223d309794c8d91ea29ec
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /favicon.ico HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://obsidian.im-not-a-virus.zip/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 09 May 2025 20:40:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: max-age=15
Expires: Fri, 09 May 2025 20:40:28 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mVqW0GStOkJSlbeON4hUqLytqECWz119BnkXSph2ufN9EYp2tgBbVOBHC%2F3p4P3bvyUiCL6mnT8vrOByNjU65wa8gupMq3fW6aDeCHsyyiKBNJDjDQczIlC%2F51Up7URsJ2hBLrPAjvrsEgpTTUg%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93d402bb1c5a0b55-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=502&min_rtt=442&rtt_var=185&sent=4&recv=7&lost=0&retrans=0&sent_bytes=3651&recv_bytes=816&delivery_rate=6884310&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e | 188.114.97.1 | 302 Moved Temporarily | 0 B |
URL POST obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e IP 188.114.97.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: text/plain;charset=UTF-8
Content-Length: 11539
Origin: http://obsidian.im-not-a-virus.zip
DNT: 1
Connection: keep-alive
Referer: http://obsidian.im-not-a-virus.zip/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Fri, 09 May 2025 20:40:13 GMT
Content-Type: text/html
Content-Length: 143
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=00nliw16z%2BN60DfYYqtKClZ2fry68cRlfEaOSyqv9X9pIgAWVKyCx21DKM3MGskxzxv719iS7jZ7lzgR%2BRub6OQeDB7mcj%2FtbKKHFqkWAIUTbP4ZXBxEeO5fZexwLqci5diBpk%2Ftx7aCCBT6dmE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93d402bcef260b55-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=6491&min_rtt=442&rtt_var=12003&sent=11&recv=22&lost=0&retrans=0&sent_bytes=6745&recv_bytes=14461&delivery_rate=6884310&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e | 188.114.96.1 | 405 Method Not Allowed | 0 B |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e IP 188.114.96.1:443
Requested byhttp://obsidian.im-not-a-virus.zip/ CertificateIssuerGoogle Trust Services Subjectim-not-a-virus.zip Fingerprint7A:2C:1E:36:AF:D8:59:AF:FD:49:B7:14:F3:03:F4:24:11:F4:28:BF ValiditySun, 13 Apr 2025 18:24:13 GMT - Sat, 12 Jul 2025 19:20:41 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.8194969978268719:1746821636:SuPGaZLisjVcYC-5OdeVcqO0hU1b-hGeEZuPrgRfxks/93d402b8eaa71c0e HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://obsidian.im-not-a-virus.zip
Referer: http://obsidian.im-not-a-virus.zip/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 405 Method Not Allowed
date: Fri, 09 May 2025 20:40:13 GMT
content-length: 0
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 93d402bd2a6356ab-OSL
allow: POST
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TsWdQoxhT5Kq%2F%2F%2BQWrDcWrkGpR%2BYnrUlYYBnYqOUyPHuHkYY955BKZh2tDHKkw7%2BFE5zS0ZLoeAVI%2FN69UPpo0WzpYwCwZjGJebv8XJPC2wIzdUB74xZpMki%2FiSuMu5uNBuzWUCDbwZZGbfsAGU%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4308&min_rtt=4236&rtt_var=1733&sent=11&recv=8&lost=0&retrans=0&sent_bytes=4138&recv_bytes=1305&delivery_rate=132699&cwnd=12000&unsent_bytes=0&cid=1600eb761f5551fb&ts=52&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| obsidian.im-not-a-virus.zip/ | 188.114.96.1 | 403 Forbidden | 5.9 kB |
URL User Request GET obsidian.im-not-a-virus.zip/ IP 188.114.96.1:80
File typeHTML document, ASCII text, with very long lines (1426) Hashc92065c33a924b3d6e84f75b6c46913e 159b01dcbc507ff612276570d9ba08d04c07eddb 4a468c81e49853446a2e1c33c3cbb54f293b1d9def4839c9c2246e886f7cffd3
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET / HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Fri, 09 May 2025 20:40:12 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: max-age=15
Expires: Fri, 09 May 2025 20:40:27 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gih9nSRCo7EMkbcNLxM0vKsVkMWf95NYHXRILmdBxi9SxNdmkIPy7%2Bi1v9obAvN0DU7Jbd%2FztIhKup665sXhJrJbZdoGiwuVSFLdWMOQH181T%2FGhJ1pqmuz0V3w3iJNuSzQMocCwJaZQXopnHCk%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93d402b8eaa71c0e-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=488&min_rtt=488&rtt_var=244&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=412&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 | 104.16.80.73 | 200 OK | 20 kB |
URL GET static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 IP 104.16.80.73:443
Requested byhttp://obsidian.im-not-a-virus.zip/ CertificateIssuerGoogle Trust Services Subjectcloudflareinsights.com FingerprintEA:C7:0D:68:3A:45:CB:AD:C5:33:41:B6:DF:F1:60:64:E1:0F:52:6A ValiditySun, 27 Apr 2025 18:18:02 GMT - Sat, 26 Jul 2025 19:17:55 GMT
File typeJavaScript source, ASCII text, with very long lines (19948), with no line terminators Hashec18af6d41f6f278b6aed3bdabffa7bc 62c9e2cab76b888829f3c5335e91c320b22329ae 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://obsidian.im-not-a-virus.zip
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 09 May 2025 20:40:13 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.6.1"
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 93d402ba58471c02-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/images/browser-bar.png?1376755637 | 188.114.96.1 | 200 OK | 715 B |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/images/browser-bar.png?1376755637 IP 188.114.96.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
File typePNG image data, 960 x 53, 8-bit colormap, non-interlaced Hash226dcb8f6144bdaafdfbd8f2f354be64 3785cc5b3bf52f8e398177b0ff1020b24aa86b8c 8c873472f4925d5d47521db4d52532d2983e9cb1bde8b43143a6cc6db56c35db
Analyzer | Verdict | Alert | urlquery | suspicious | Suspicious - Sinkholed / Blocked |
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://obsidian.im-not-a-virus.zip/cdn-cgi/styles/cf.errors.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 09 May 2025 20:40:13 GMT
Content-Type: image/png
Content-Length: 715
Connection: keep-alive
Last-Modified: Tue, 06 May 2025 09:55:49 GMT
ETag: "6819dca5-2cb"
Server: cloudflare
CF-RAY: 93d402ba8c6d1c0e-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 09 May 2025 22:40:13 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/images/cf-no-screenshot-error.png | 188.114.97.1 | 200 OK | 3.2 kB |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/images/cf-no-screenshot-error.png IP 188.114.97.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
File typePNG image data, 178 x 175, 8-bit colormap, non-interlaced Hash0d768cbc261841d3affc933b9ac3130e aff136a4c761e1df1ada7e5d9a6ed0ebea74a4b7 1c53772285052e52bb7c12ad46a85a55747ed7bf66963fe1993fcef91ff5b0d0
Analyzer | Verdict | Alert | urlquery | suspicious | Suspicious - Sinkholed / Blocked |
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://obsidian.im-not-a-virus.zip/cdn-cgi/styles/cf.errors.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 09 May 2025 20:40:13 GMT
Content-Type: image/png
Content-Length: 3213
Connection: keep-alive
Last-Modified: Tue, 06 May 2025 09:55:49 GMT
ETag: "6819dca5-c8d"
Server: cloudflare
CF-RAY: 93d402ba9b9a0b55-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 09 May 2025 22:40:13 GMT
Cache-Control: max-age=7200, public
Accept-Ranges: bytes
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/rum? | 188.114.97.1 | 204 No Content | 0 B |
URL POST obsidian.im-not-a-virus.zip/cdn-cgi/rum? IP 188.114.97.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
POST /cdn-cgi/rum? HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://obsidian.im-not-a-virus.zip/
content-type: application/json
Content-Length: 1068
Origin: http://obsidian.im-not-a-virus.zip
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Date: Fri, 09 May 2025 20:40:13 GMT
Connection: keep-alive
access-control-allow-origin: http://obsidian.im-not-a-virus.zip
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
Server: cloudflare
CF-RAY: 93d402bb5cae0b55-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
|
|
| obsidian.im-not-a-virus.zip/ | 188.114.96.1 | 403 Forbidden | 5.9 kB |
URL User Request GET obsidian.im-not-a-virus.zip/ IP 188.114.96.1:443
CertificateIssuerGoogle Trust Services Subjectim-not-a-virus.zip Fingerprint7A:2C:1E:36:AF:D8:59:AF:FD:49:B7:14:F3:03:F4:24:11:F4:28:BF ValiditySun, 13 Apr 2025 18:24:13 GMT - Sat, 12 Jul 2025 19:20:41 GMT
File typeHTML document, ASCII text, with very long lines (1420) Hash7145923c59b8c87bb88163332ba453d9 4ee5c9cf561857b7f8c7967c4d2e562ba265acb6 afdcfd60dd653b93113b2da20f2b4394acd7d5567fe84005f875bc31d0b458cf
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET / HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Fri, 09 May 2025 20:40:12 GMT
content-type: text/html; charset=UTF-8
content-encoding: br
cf-ray: 93d402b738a51c0e-OSL
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: max-age=15
expires: Fri, 09 May 2025 20:40:27 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GE6TUw0ePRXDpUxrde%2Bq89yQKuEOE9JOZAiBQX6WVfDIWpM7bcES6uTaEzw6LXDNwJrBJMCSRhtyBbs0vMEUbzf36o7BcwoS%2BKfd%2FMpE%2BXr%2FcAmlVfEFUiP7KD9CHpSV7%2FhMKGnSgU6BxetCIKU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=512&min_rtt=454&rtt_var=169&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3294&recv_bytes=1273&delivery_rate=8227272&cwnd=253&unsent_bytes=0&cid=b445e0d73bf77d4a&ts=50&x=0"
X-Firefox-Spdy: h2
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/styles/cf.errors.css | 188.114.96.1 | 200 OK | 24 kB |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/styles/cf.errors.css IP 188.114.96.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
File typeASCII text, with very long lines (24050) Hash5e8c69a459a691b5d1b9be442332c87d f24dd1ad7c9080575d92a9a9a2c42620725ef836 84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://obsidian.im-not-a-virus.zip/
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 09 May 2025 20:40:13 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 06 May 2025 09:55:49 GMT
ETag: W/"6819dca5-5df3"
Server: cloudflare
CF-RAY: 93d402ba2bf71c0e-OSL
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Expires: Fri, 09 May 2025 22:40:13 GMT
Cache-Control: max-age=7200, public
Content-Encoding: gzip
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/scripts/jsd/main.js | 188.114.96.1 | 302 Moved Temporarily | 8.4 kB |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 188.114.96.1:80
Requested byhttp://obsidian.im-not-a-virus.zip/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Fri, 09 May 2025 20:40:13 GMT
Content-Type: text/html
Content-Length: 143
Connection: keep-alive
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Location: https://obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/scripts/jsd/main.js
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c4eJXLqMKbUgWagw5YnmvUFy1sP3grmC14FFccVtNjUIeH%2BTmQl94TsqT%2FZW%2FjjxP64LO1rc3neWDWp7wBOPlG9xKaaeJUIJjP%2Fp%2F2bhvoRzesU650Y0a%2BJy8Cq4KpuZB%2FvdQfit3H6G7gfMIe4%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 93d402bb2d401c0e-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=539&min_rtt=488&rtt_var=47&sent=11&recv=16&lost=0&retrans=0&sent_bytes=9522&recv_bytes=1584&delivery_rate=12882562&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/scripts/jsd/main.js | 188.114.96.1 | 302 Found | 8.4 kB |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/scripts/jsd/main.js IP 188.114.96.1:443
Requested byhttp://obsidian.im-not-a-virus.zip/ CertificateIssuerGoogle Trust Services Subjectim-not-a-virus.zip Fingerprint7A:2C:1E:36:AF:D8:59:AF:FD:49:B7:14:F3:03:F4:24:11:F4:28:BF ValiditySun, 13 Apr 2025 18:24:13 GMT - Sat, 12 Jul 2025 19:20:41 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS | Severity | Alert | suricata | low | ET INFO HTTP Request to a *.zip Domain |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 09 May 2025 20:40:13 GMT
content-length: 0
server: cloudflare
vary: Accept-Encoding
cf-ray: 93d402bb9dcb1c0e-OSL
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Knh56rHW7Nvoo8R9FpOk%2FRv6HPW58Yjc7BsBzU2PorMlDFlaYnnRz5aRDKcht6TJ%2Fo41ldsG0l4gsQ%2BAmbCN159Lt%2BMp6XQkN%2BY57AMuPeDJ7g%2FA01fnJ2%2FzVWZgcP2caKKRx9Yy9xDy4tiJul4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=505&min_rtt=439&rtt_var=173&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3293&recv_bytes=1220&delivery_rate=7661375&cwnd=253&unsent_bytes=0&cid=539c62eb5d917a28&ts=28&x=0"
X-Firefox-Spdy: h2
|
|
| obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js? | 188.114.96.1 | 200 OK | 8.4 kB |
URL GET obsidian.im-not-a-virus.zip/cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js? IP 188.114.96.1:443
Requested byhttp://obsidian.im-not-a-virus.zip/ CertificateIssuerGoogle Trust Services Subjectim-not-a-virus.zip Fingerprint7A:2C:1E:36:AF:D8:59:AF:FD:49:B7:14:F3:03:F4:24:11:F4:28:BF ValiditySun, 13 Apr 2025 18:24:13 GMT - Sat, 12 Jul 2025 19:20:41 GMT
File typeJavaScript source, ASCII text, with very long lines (8422), with no line terminators Hashd990f536637a769f8629177a97cb8c51 fad8cd0c3d1b3c3f25cc455e05519055f8280abb d7b263a6a116063bac9047fd2e8f43918484c11ee7daf4ae715f94262cd35978
GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/701fd2559006/main.js? HTTP/1.1
Host: obsidian.im-not-a-virus.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 09 May 2025 20:40:13 GMT
content-type: application/javascript; charset=UTF-8
cf-ray: 93d402bbcdfd1c0e-OSL
server: cloudflare
content-encoding: br
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9AoXJfAzlTpUVG6o%2FXg1acVbJdZ4GkpNxMJZWWJuiXRu6p%2FgbftuZx3zYq%2F5%2B8K37MHolyUak7%2BBdmC%2B813OLzMY5CxRSnAgEqiCNhUQ3ikMZx2pvCbCBRzfs%2F2hQknMSCZUtUvFpiBroap4iw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1779&min_rtt=439&rtt_var=2678&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3980&recv_bytes=1332&delivery_rate=7661375&cwnd=255&unsent_bytes=0&cid=539c62eb5d917a28&ts=62&x=0"
X-Firefox-Spdy: h2
|
|