IP
ASN #24429 Zhejiang Taobao Network Co.,Ltd
Hash 916e02642e3ba350dd29c668ca612f17
9771c0d84081b3e04ece690673a47d30bc81890d
0275baf3449f329d8b795e7a6d7d488e54657220854c5d70248d871385dc3160
POST / HTTP/1.1
Host: ocsp.digicert.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Fri, 11 Aug 2023 11:52:16 GMT
Ali-Swift-Global-Savetime: 1691754736
Via: cache5.l2de2[273,272,200-0,M], cache5.l2de2[275,0], cache5.se1[297,297,200-0,M], cache5.se1[299,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Fri, 11 Aug 2023 11:52:16 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9916917547360196200e
IP
ASN #24429 Zhejiang Taobao Network Co.,Ltd
Hash 916e02642e3ba350dd29c668ca612f17
9771c0d84081b3e04ece690673a47d30bc81890d
0275baf3449f329d8b795e7a6d7d488e54657220854c5d70248d871385dc3160
POST / HTTP/1.1
Host: ocsp.digicert.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Fri, 11 Aug 2023 11:52:16 GMT
Ali-Swift-Global-Savetime: 1691754736
Via: cache7.l2de2[504,503,200-0,M], cache7.l2de2[506,0], cache1.se1[528,527,200-0,M], cache1.se1[529,0]
X-Cache: MISS TCP_MISS dirn:-2:-2
X-Swift-SaveTime: Fri, 11 Aug 2023 11:52:16 GMT
X-Swift-CacheTime: 0
Timing-Allow-Origin: *
EagleId: 2ff62c9516917547358363882e
140.249.239.114/epicgames-download1-1251447533.file.myqcloud.com/builds/org/o-cul2z53mrw3bxltv63v68rgd4b3w52/da519d41698b4854815db7371210c3a1/default/chunksv4/41/c81952da12ae3712_763ea0694e7fac10e990eca7038c7f4a.chunk?mkey=646f42397d459b10&f=a86e&cip=125.69.189.229&proto=http
403 Forbidden 3.1 kB URL User Request GET HTTP/1.1 140.249.239.114/epicgames-download1-1251447533.file.myqcloud.com/builds/org/o-cul2z53mrw3bxltv63v68rgd4b3w52/da519d41698b4854815db7371210c3a1/default/chunksv4/41/c81952da12ae3712_763ea0694e7fac10e990eca7038c7f4a.chunk?mkey=646f42397d459b10&f=a86e&cip=125.69.189.229&proto=http
IP
ASN #136195 Qingdao, Shandong Province, P.R.China.
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (1679)
Hash 6f2857583efb4a83b5b47697356063ff
d82b91cf80f17f782962f405ae06c1e12f0e34a7
b4e0b4eba12611459073a9ae1f00dd0cd3ca120a33577e0357a9dc70d9e827ab
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /epicgames-download1-1251447533.file.myqcloud.com/builds/org/o-cul2z53mrw3bxltv63v68rgd4b3w52/da519d41698b4854815db7371210c3a1/default/chunksv4/41/c81952da12ae3712_763ea0694e7fac10e990eca7038c7f4a.chunk?mkey=646f42397d459b10&f=a86e&cip=125.69.189.229&proto=http HTTP/1.1
Host: 140.249.239.114
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
x-amz-request-id: GSCR046J02FHH5V8
x-amz-id-2: 8JnaLMGYynd0Go7sOGiCkICo81CKu72iwhqMBcRp3prP/ePcD0oQGifjY/hvyAhQBusf3ijpcSI=
Content-Type: application/xml
Server: AmazonS3
Date: Fri, 11 Aug 2023 11:52:17 GMT
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
X-Cache-Lookup: Cache Miss, Cache Miss, Hit From Upstream Cluster, Hit From Inner Cluster, Cache Miss
Content-Length: 3082
X-NWS-LOG-UUID: 9623310957382615768
Connection: keep-alive
140.249.239.114/favicon.ico
404 Not Found 0 B URL GET HTTP/1.1 140.249.239.114/favicon.ico
IP
ASN #136195 Qingdao, Shandong Province, P.R.China.
Requested by http://140.249.239.114/epicgames-download1-1251447533.file.myqcloud.com/builds/org/o-cul2z53mrw3bxltv63v68rgd4b3w52/da519d41698b4854815db7371210c3a1/default/chunksv4/41/c81952da12ae3712_763ea0694e7fac10e990eca7038c7f4a.chunk?mkey=646f42397d459b10&f=a86e&cip=125.69.189.229&proto=http
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: 140.249.239.114
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://140.249.239.114/epicgames-download1-1251447533.file.myqcloud.com/builds/org/o-cul2z53mrw3bxltv63v68rgd4b3w52/da519d41698b4854815db7371210c3a1/default/chunksv4/41/c81952da12ae3712_763ea0694e7fac10e990eca7038c7f4a.chunk?mkey=646f42397d459b10&f=a86e&cip=125.69.189.229&proto=http
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Length: 0
X-NWS-LOG-UUID: 2515406009542023624
Connection: close
Server: Lego Server
Date: Fri, 11 Aug 2023 11:52:17 GMT
X-Cache-Lookup: Return Directly
140.249.239.114
47.246.44.205