ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
200 OK 33 kB URL GET HTTP/1.1 ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
IP
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (32072)
Hash e0e0559014b222245deb26b6ae8bd940
e2f3603e23711f6446f278a411d905623d65201e
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 32954
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 29 Nov 2023 21:48:58 GMT
Expires: Thu, 28 Nov 2024 21:48:58 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Age: 303955
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Content-Type: text/javascript; charset=UTF-8
Vary: Accept-Encoding
www.jacklmoore.com/colorbox/example1/colorbox.css
200 OK 1.5 kB URL GET HTTP/1.1 www.jacklmoore.com/colorbox/example1/colorbox.css
IP
Requested by http://164.115.43.44/hospital/web/index.php
Hash bbf688345ad4210ae3e38ad44a759b18
917e0a570e692ebc3616d188cea87b9b0969a071
7c19e7fddbe8e759b0a0248f156a88336c307256a93eddffbc7192cc2f8fe933
GET /colorbox/example1/colorbox.css HTTP/1.1
Host: www.jacklmoore.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1460
Server: GitHub.com
Content-Type: text/css; charset=utf-8
Last-Modified: Sun, 10 Apr 2022 05:47:46 GMT
Access-Control-Allow-Origin: *
ETag: W/"62526f82-114f"
expires: Sun, 03 Dec 2023 10:24:53 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
x-proxy-cache: MISS
X-GitHub-Request-Id: A672:69C8:6720AC4:68DA786:656C551D
Accept-Ranges: bytes
Date: Sun, 03 Dec 2023 10:14:53 GMT
Via: 1.1 varnish
Age: 0
X-Served-By: cache-bma1644-BMA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1701598493.070637,VS0,VE182
Vary: Accept-Encoding
X-Fastly-Request-ID: 7835823bc5b174b973275dda33c73c2fca215df5
164.115.43.44/hospital/web/index.php
200 OK 109 kB URL User Request GET HTTP/1.1 164.115.43.44/hospital/web/index.php
IP
ASN #9835 Government Information Technology Services
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Non-ISO extended-ASCII text, with very long lines (674), with CRLF, LF line terminators
Size 109 kB (109392 bytes)
Hash e7c1ef6783382528698b3bc3f9578c25
9bb28427dc393698797ce52710ee7844fdedc2e8
f26ba52e66f002419de815b7c7fbcd178637c9792a394be45eff11ceb0228191
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/index.php HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:52 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Set-Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; path=/; httponly
cookiesession1=678B76F4BD24803B08FBD4044E164577;Expires=Mon, 02 Dec 2024 10:14:52 GMT;Path=/;HttpOnly
content-length: 109392
164.115.43.44/hospital/web/assets/88a39f1e/css/themes/image.css
200 OK 206 B URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/88a39f1e/css/themes/image.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 5224f48ad1621dad8dbcb99d983f5bf9
50abc03ed7c2eb47243e912f65699ccaed3e14e1
7fb9487c9fe47198088893139120386c9bc41006509e810edd10c42a6404dc5f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/88a39f1e/css/themes/image.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "ce-56cdb4f27fbc0"
Accept-Ranges: bytes
Content-Length: 206
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/owl.carousel/owl-carousel/owl.carousel.css
200 OK 1.5 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/owl.carousel/owl-carousel/owl.carousel.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash d49fbfc6c0444e7c67b2ee7ae284a293
986a35e93e719dd08b35c8c8762626ceb495418a
c9430ccc20d8d58e10dbcaba36ae11739cf20190424b6f55c0d8cf90241658f6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/owl.carousel/owl-carousel/owl.carousel.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 18 Apr 2017 07:46:31 GMT
ETag: "60b-54d6c1b2883c0"
Accept-Ranges: bytes
Content-Length: 1547
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/67ec78d7/css/ripples.css
200 OK 1.0 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/css/ripples.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash aadfb267f7c3b0e07cef9a7db53acaad
8bd8fcac0f3fa29ada835bf63349533b8835ea7c
5fcfd06edc59285267685cb0397733b39815e2115e8bf3a52c8619a4ed727069
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/css/ripples.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:44 GMT
ETag: "3f1-56cdb4f20e34f"
Accept-Ranges: bytes
Content-Length: 1009
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
www.jacklmoore.com/colorbox/jquery.colorbox.js
200 OK 8.9 kB URL GET HTTP/1.1 www.jacklmoore.com/colorbox/jquery.colorbox.js
IP
Requested by http://164.115.43.44/hospital/web/index.php
Hash 2769d3c25dc8edb989788823b8c81e57
21ac7e1924dc1c9c3c129f1786d1d153f43e3b92
598bb39a9e2ce06b0fd1fb3ee55ea21c955af996d7cb08598271f2689f79bd25
GET /colorbox/jquery.colorbox.js HTTP/1.1
Host: www.jacklmoore.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 8925
Server: GitHub.com
Content-Type: application/javascript; charset=utf-8
Last-Modified: Sun, 10 Apr 2022 05:47:46 GMT
Access-Control-Allow-Origin: *
ETag: W/"62526f82-71f0"
expires: Sun, 03 Dec 2023 07:11:52 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
x-proxy-cache: MISS
X-GitHub-Request-Id: CD1A:D891:2DD6D7C:2E9C7A3:656C27DC
Accept-Ranges: bytes
Date: Sun, 03 Dec 2023 10:14:53 GMT
Via: 1.1 varnish
Age: 0
X-Served-By: cache-bma1644-BMA
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1701598493.410750,VS0,VE119
Vary: Accept-Encoding
X-Fastly-Request-ID: b65360175d99cf862474a5f91d1c69507a8333f7
164.115.43.44/hospital/web/assets/67ec78d7/css/ripples.min.css
200 OK 786 B URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/css/ripples.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (741), with CRLF line terminators
Hash 4df9b8a78dd012f910dda53b72065303
a88c1f6dbcbed81483e21df3fdbd2af1c462ab64
5fa735f4e4b9d9c6ad77923373148f4787f80a660d8dac3df343ca564e07289f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/css/ripples.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:44 GMT
ETag: "312-56cdb4f20f2ef"
Accept-Ranges: bytes
Content-Length: 786
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/67ec78d7/css/site.css
200 OK 2.3 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/css/site.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Hash aac7351c275fad265d08d281061c7295
c3843b97f075b82a306059fd46eac1439c40acce
3cf6703e23c4c5f5b1a16b2d93441966e2177d40720b00798a24d62fd3f0cf5f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/css/site.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:44 GMT
ETag: "8e2-56cdb4f210677"
Accept-Ranges: bytes
Content-Length: 2274
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/67ec78d7/font-awesome/css/font-awesome.min.css
200 OK 24 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/font-awesome/css/font-awesome.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (23577), with CRLF line terminators
Hash f667e6132f8470a39d2395b81ab4ef09
3e435d5167460aaf367836e1973e90a47039faea
222d75918bb518d46a4d283da7de243b4409d597a8c6856070a07e96b600e6d7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:44 GMT
ETag: "5cbe-56cdb4f22b042"
Accept-Ranges: bytes
Content-Length: 23742
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/67ec78d7/fonts/fonts.css
200 OK 1.5 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/fonts/fonts.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 48b5c18f05a51a9be17a479de56d9934
b2076bdd2574df6ae382c41b38decc56dd6e3140
923aa286fcf06604706f5d6bab854760e6c3e9c8e2f8a7dab1b6d2b8daaff9f8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/fonts/fonts.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "606-56cdb4f25f04e"
Accept-Ranges: bytes
Content-Length: 1542
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/6456f1ce/css/bootstrap-tabs-x.css
200 OK 7.8 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/6456f1ce/css/bootstrap-tabs-x.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash f29e5bc2b5ac6336a11016582c03b421
8927b9a0bc65b1ce09eaa196996ae99072c44985
3c33c2b69aa9ba304dbf400a309719389610773752de63b6b3d1c58203620d86
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/6456f1ce/css/bootstrap-tabs-x.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:35 GMT
ETag: "1e9b-56cdb4e998e16"
Accept-Ranges: bytes
Content-Length: 7835
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/95decc00/css/kv-widgets.css
200 OK 725 B URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/95decc00/css/kv-widgets.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 26240da9a450d13374baeb5d1146414d
4555f6bb38453029564a5a75b6e14903de42077c
3249bf33bb636adb0295fe1189b79eb7632adf8a7e58db32f6c5f05f7397de98
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/95decc00/css/kv-widgets.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "2d5-56cdb4e9fcfae"
Accept-Ranges: bytes
Content-Length: 725
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/18268b73/fullcalendar.min.css
200 OK 15 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/18268b73/fullcalendar.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (15148), with CRLF line terminators
Hash 486556af1452188adfd749f7880e47ec
ef01debc130887bcc1550ca9a7576f2e610b23b8
19b47ff0b3d0bbd74d47408ff62eabe785fc95788444c68c9ce52522299c5570
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/18268b73/fullcalendar.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "3b97-56cdb4ea16dc0"
Accept-Ranges: bytes
Content-Length: 15255
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital
301 Moved Permanently 238 B IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash e3e264e6194b4368e82707d1be2fc1db
451039d2bca34e66da0a15136bbdcc5e8f8adad9
da7a226d702aad0bf2b782fb63e13bfaded0007bb1b0a17dcab04038627c2e05
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Location: http://164.115.43.44/hospital/
Content-Length: 238
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
164.115.43.44/hospital/web/assets/2b33065f/css/bootstrap.css
200 OK 153 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/2b33065f/css/bootstrap.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (540), with CRLF line terminators
Size 153 kB (152767 bytes)
Hash 794f8177af9645a4f4e2d74fa0c1cc73
afb383fa13c40821106e7b39b2e29c06a2f01ff5
a29236eed54ff257f34dd88abfd5a2f14b9190d84802f6703152d6b4ea511ca9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/2b33065f/css/bootstrap.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "254bf-56cdb4e9caee2"
Accept-Ranges: bytes
Content-Length: 152767
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/28b8f359/yii.js
200 OK 19 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/28b8f359/yii.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash d8f87356cfbe45f95773a4f3bfeddbc0
0e13159148a98c17704451fdac919ab24b428c68
13fe4f185430fe114aaa048304d741281159947bf23cc93a3a7d59fd5fc76a10
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/28b8f359/yii.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "48a6-56cdb4e9b7e31"
Accept-Ranges: bytes
Content-Length: 18598
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/a5dfc11b/themes/smoothness/jquery-ui.css
200 OK 36 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/a5dfc11b/themes/smoothness/jquery-ui.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (2363), with CRLF line terminators
Hash 7bbf1240a8461ec9b83207237d05022d
b88676dc1f917fddeded83bfc57237076fb857f6
c87b93427458ffcc687de50c24b749794c35bd314c22a9760f4cf0bcf0b74487
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/a5dfc11b/themes/smoothness/jquery-ui.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:42 GMT
ETag: "8e55-56cdb4f024737"
Accept-Ranges: bytes
Content-Length: 36437
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/67ec78d7/css/material.min.css
200 OK 1.1 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/css/material.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (65536), with no line terminators
Size 1.1 MB (1136754 bytes)
Hash fe6d0864f0e41013f0d0d2cec6c947c1
ba4d676d0c85ffbdf91a66797e4a96f99b0ee982
db12875e9829c0b2eeddde7fba6b8972d4ad57e7b47aebec2ce33598d26303e6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/css/material.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:53 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:44 GMT
ETag: "115872-56cdb4f20cbdf"
Accept-Ranges: bytes
Content-Length: 1136754
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/hospital/web/assets/67ec78d7/js/material.js
200 OK 8.1 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/js/material.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 6da18e6a568ff336aa156d2c428f1bab
c2d9e6f547099efcff073cb13b29361d6bfa2f61
4d22e9c6b3af0002b21eac029df92f38462dbfcc44fc53bf438db5e8215f85cf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/js/material.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "1f80-56cdb4f2701bf"
Accept-Ranges: bytes
Content-Length: 8064
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/67ec78d7/js/ripples.js
200 OK 7.7 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/js/ripples.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 6d31aaed21e2967ae2455395ee9ba575
d71551e79413588e671ee809dd42ead6af770cd5
4518acecbc24a4b4d0e1f6e9844ee42ee4bfbb2db2bedfd94f4d39a12c22d86b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/js/ripples.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "1e04-56cdb4f276750"
Accept-Ranges: bytes
Content-Length: 7684
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/67ec78d7/js/material.min.js
200 OK 4.4 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/js/material.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (4327), with CRLF line terminators
Hash b0d91cc649d3974d2beb9c9102fcfc21
28172e701b8ed55133002053de300796f345ba16
7b97a3cb942f795484c27cf3e796f23fac5e5fedec431ad04156f407614fc796
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/js/material.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "1111-56cdb4f2728cf"
Accept-Ranges: bytes
Content-Length: 4369
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/67ec78d7/js/ripples.min.js
200 OK 2.8 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/js/ripples.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (2763), with CRLF line terminators
Hash 0bceb1dfc9a6927c39bff3d76390a36a
6a6ebfbddd206c4a871b0f09ba879f38ae9bc068
8ad941b2cf8df4fe4b86a7480dde4b37bd6d8637d04f0ed05a32b8cb8ea631ca
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/js/ripples.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "af4-56cdb4f278690"
Accept-Ranges: bytes
Content-Length: 2804
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/owl.carousel/owl-carousel/owl.carousel.min.js
200 OK 24 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/owl.carousel/owl-carousel/owl.carousel.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (635), with CRLF line terminators
Hash 8c52f27fcac36c7667f8fb846e1e94d5
e5862559db659ffd530c91452d668c5e7b3f0f2d
6c1e31700f68d1666de6b0992e89d413434707718bf729a472404029845bdbad
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/owl.carousel/owl-carousel/owl.carousel.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 18 Apr 2017 07:46:32 GMT
ETag: "5d80-54d6c1b37c600"
Accept-Ranges: bytes
Content-Length: 23936
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/js/index.js
200 OK 1.9 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/js/index.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 2a3de47589338c1dba911833b7cd3dfc
e816e705b98200c6b665307e8bc7d5770e42ee47
c7dfeb11a399840c7544a035939acb8acfb41a6077cb0631d0120b27a0846f77
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/js/index.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 18 Apr 2017 07:46:29 GMT
ETag: "775-54d6c1b09ff40"
Accept-Ranges: bytes
Content-Length: 1909
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/2b33065f/js/bootstrap.js
200 OK 72 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/2b33065f/js/bootstrap.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 24276f268f56771dc4141e6b3d93a2aa
474b25cebd06d57a38090c6716d5dfaa5591baad
d5fa375baaa8c2ae0f8a7a42b0ab21695a9ec04c68166ceb44118a6d27405449
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/2b33065f/js/bootstrap.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "11994-56cdb4e9ee54d"
Accept-Ranges: bytes
Content-Length: 72084
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/6456f1ce/js/bootstrap-tabs-x.js
200 OK 7.3 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/6456f1ce/js/bootstrap-tabs-x.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 91db0c3a9fb5dc2cab9fb8a39b81ff55
14a43b76106263d6376d1f705ce67d54ff7013a3
7b65757f5e6346549f639b13c5d778ec51ec7f4b2fca31aeb3739c62346090d0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/6456f1ce/js/bootstrap-tabs-x.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:35 GMT
ETag: "1c7c-56cdb4e9a64ef"
Accept-Ranges: bytes
Content-Length: 7292
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/95decc00/js/kv-widgets.js
200 OK 1.1 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/95decc00/js/kv-widgets.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Hash 09e47d15efbd5c3768e009c43abea69e
d37eb493480584eb3aac71320f9f982ad55dc9a8
73f094731fe3b3a2d718db2a0ee0a6e757a6339dce3b898c33371bd327b8de8a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/95decc00/js/kv-widgets.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "444-56cdb4e9ff2d6"
Accept-Ranges: bytes
Content-Length: 1092
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/37e49b9e/moment.js
200 OK 128 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/37e49b9e/moment.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Algol 68 source text\012- Pascal source, ASCII text, with CRLF line terminators
Size 128 kB (127759 bytes)
Hash 6173af690dc476b563deeaf02b4edb21
ce74f58c44a79e9da489d285e774a40c015ccb80
d0727f6592ef311fb92c444362ece347824a6dc7ca3b9d677462dec6f3cebc5c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/37e49b9e/moment.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:38 GMT
ETag: "1f30f-56cdb4ebd8d1d"
Accept-Ranges: bytes
Content-Length: 127759
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/18268b73/locale/th.js
200 OK 3.4 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/18268b73/locale/th.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Unicode text, UTF-8 text, with very long lines (2167), with no line terminators
Hash 5295ce92d1baec69473c01327c4bfc2b
bca7c5fac4bb6c7ef538a08c542998e52be14e56
63286a03664b26113424fb1262635d346687e18e989c3666eade85e16b3a8476
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/18268b73/locale/th.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "d69-56cdb4ea843c9"
Accept-Ranges: bytes
Content-Length: 3433
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
www.youtube.com/s/player/31e0b6d9/player_ias.vflset/en_US/embed.js
200 OK 16 kB URL GET HTTP/3 www.youtube.com/s/player/31e0b6d9/player_ias.vflset/en_US/embed.js
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (3391)
Hash 4b993df6aaec92ba17cc4d526ad2e4bd
a0b696788d5d621280e4f642b4c66875d40870cb
f21a803f0b7f63109cd608bfbe9769a3dc2e2a17c8e885826529d3981d15d313
GET /s/player/31e0b6d9/player_ias.vflset/en_US/embed.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 16506
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:32:15 GMT
expires: Fri, 29 Nov 2024 04:32:15 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 30 Nov 2023 03:10:29 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
age: 279759
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.youtube.com/s/player/31e0b6d9/www-player.css
200 OK 49 kB URL GET HTTP/3 www.youtube.com/s/player/31e0b6d9/www-player.css
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash 18f844aa571ef66c0f165fe56a2f0821
849c61720b741db03f689c461e8e4eedd3c4ce21
436743ad0889ad9399a1f33edb65d8bf1c71cfbce1b0fce549769e7705c9ceec
GET /s/player/31e0b6d9/www-player.css HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 48920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:32:12 GMT
expires: Fri, 29 Nov 2024 04:32:12 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 30 Nov 2023 03:10:29 GMT
content-type: text/css
vary: Accept-Encoding, Origin
age: 279762
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.youtube.com/s/player/31e0b6d9/www-embed-player.vflset/www-embed-player.js
200 OK 98 kB URL GET HTTP/3 www.youtube.com/s/player/31e0b6d9/www-embed-player.vflset/www-embed-player.js
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (682)
Hash 24cd2bdc1dd00086a1efbc664060bb49
064027f89f2e8f22be774e7468f7ae4ab79efcbc
4d453a47ad0d1b30a7292b6f712d8645db141ed6adea69b8e7d802f8022365fd
GET /s/player/31e0b6d9/www-embed-player.vflset/www-embed-player.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 98499
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:32:12 GMT
expires: Fri, 29 Nov 2024 04:32:12 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 30 Nov 2023 03:10:29 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
age: 279762
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
164.115.43.44/hospital/web/js/main.js
200 OK 1.6 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/js/main.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 8e7e5ce12eb2d9f12d98e09b16324091
c2749d9fb7f8f8a0105e777ed0f2dc343f0edaa1
ff1f238e900a136a871653debc0940d95c37b8c030fff8d3973fd9d6e878b5a6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/js/main.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 18 Apr 2017 07:46:29 GMT
ETag: "649-54d6c1b09ff40"
Accept-Ranges: bytes
Content-Length: 1609
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15552, version 1.0\012- data
Hash 285467176f7fe6bb6a9c6873b3dad2cc
ea04e4ff5142ddd69307c183def721a160e0a64e
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15552
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 11:28:20 GMT
expires: Fri, 29 Nov 2024 11:28:20 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
content-type: font/woff2
age: 254795
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/hospital/web/assets/18268b73/locale-all.js
200 OK 157 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/18268b73/locale-all.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Unicode text, UTF-8 text, with very long lines (32003), with CRLF line terminators
Size 157 kB (157314 bytes)
Hash 361fc0942441729ca6e4cd80ba0edd81
c8f848e215cfab26724eb1962cbc51334baf675c
b49059c5721da12c6abace5a5977f0b43be2f403fee908b851bc69c0317561f5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/18268b73/locale-all.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "26682-56cdb4ea935fb"
Accept-Ranges: bytes
Content-Length: 157314
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/assets/20653ae5/jquery.js
200 OK 267 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/20653ae5/jquery.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with CRLF line terminators
Size 267 kB (267365 bytes)
Hash 30907cfce66ebfcca66785ed6fad9fa5
49ddeac2f7898effe25af2fa7ff1fd0d7ee9b5e2
30fc40baadcbcf1ff2e024739241f6fc8479a96145b5d975978831a123457e3c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/20653ae5/jquery.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:35 GMT
ETag: "41465-56cdb4e971543"
Accept-Ranges: bytes
Content-Length: 267365
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
www.youtube.com/s/player/31e0b6d9/player_ias.vflset/en_US/base.js
200 OK 784 kB URL GET HTTP/3 www.youtube.com/s/player/31e0b6d9/player_ias.vflset/en_US/base.js
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (555)
Size 784 kB (784263 bytes)
Hash 101fe6d09a2a65ba52bbafa55f73d316
46b1b5f64db74e841d0f606543980dea804707d8
ddc70bebc8a0e4ae5b13a5f8409693a3e88aa4b4415a75f632f11d0f0c423457
GET /s/player/31e0b6d9/player_ias.vflset/en_US/base.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-encoding: gzip
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 784263
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:32:15 GMT
expires: Fri, 29 Nov 2024 04:32:15 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 30 Nov 2023 03:10:29 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
age: 279759
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
164.115.43.44/hospital/web/assets/88a39f1e/js/jquery.scrollUp.js
200 OK 5.7 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/88a39f1e/js/jquery.scrollUp.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Unicode text, UTF-8 text, with CRLF line terminators
Hash 71ca06b14249a7812782cdf90338d622
e6393f86e69c8eeaceb647eac0281d0b94547510
9be1178fa12f1bcfeff76803f7daa29614036956bc444911e03357855e86772d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/88a39f1e/js/jquery.scrollUp.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "1625-56cdb4f283e29"
Accept-Ranges: bytes
Content-Length: 5669
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/javascript
fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 15 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 15344, version 1.0\012- data
Hash 5d4aeb4e5f5ef754e307d7ffaef688bd
06db651cdf354c64a7383ea9c77024ef4fb4cef8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 10:04:07 GMT
expires: Fri, 29 Nov 2024 10:04:07 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
age: 259848
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/hospital/
302 Found 0 B IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/ HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://164.115.43.44/hospital/web/index.php
DNT: 1
Connection: keep-alive
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
Location: web/
Content-Length: 0
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
164.115.43.44/hospital/web/assets/67ec78d7/fonts/thsarabunnew-webfont.woff
200 OK 52 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/fonts/thsarabunnew-webfont.woff
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Web Open Font Format, TrueType, length 51956, version 1.0\012- data
Hash 940b7d9976165f2795824c2dbd0de318
5077b570c4dcdc07137c64378dab87fc1258b9b3
a5f4eac957aecb8e896a19d6ba5e748133c99e74d3b620b41e81125d8a1c1fff
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/fonts/thsarabunnew-webfont.woff HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/assets/67ec78d7/fonts/fonts.css
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "caf4-56cdb4f261f2e"
Accept-Ranges: bytes
Content-Length: 51956
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/font-woff
164.115.43.44/hospital/web/assets/67ec78d7/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0
200 OK 57 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Web Open Font Format (Version 2), TrueType, length 56780, version 4.197\012- data
Hash 97493d3f11c0a3bd5cbd959f5d19b699
1075231650f579955905bb2f6527148a8e2b4b16
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0 HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/assets/67ec78d7/font-awesome/css/font-awesome.min.css
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:44 GMT
ETag: "ddcc-56cdb4f238eeb"
Accept-Ranges: bytes
Content-Length: 56780
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
164.115.43.44/hospital/web/assets/2b33065f/fonts/glyphicons-halflings-regular.woff2
200 OK 18 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/2b33065f/fonts/glyphicons-halflings-regular.woff2
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Web Open Font Format (Version 2), TrueType, length 18028, version 1.589\012- data
Hash 448c34a56d699c29117adc64c43affeb
ca35b697d99cae4d1b60f2d60fcd37771987eb07
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/2b33065f/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/assets/2b33065f/css/bootstrap.css
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "466c-56cdb4e9eae9d"
Accept-Ranges: bytes
Content-Length: 18028
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
164.115.43.44/hospital/web/assets/67ec78d7/fonts/thsarabunnew_bold-webfont.woff
200 OK 52 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/67ec78d7/fonts/thsarabunnew_bold-webfont.woff
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type Web Open Font Format, TrueType, length 51744, version 1.0\012- data
Hash 8d8146f04b5d6c7acd967c6bbc512cfe
8e567388f800dc1552ab488f6441572d42b80d3a
7792dfc28a9bc9559d391e8109a338a7546b04eab9f1896c7ed021b4563bc75c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/67ec78d7/fonts/thsarabunnew_bold-webfont.woff HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/assets/67ec78d7/fonts/fonts.css
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:45 GMT
ETag: "ca20-56cdb4f2659c6"
Accept-Ranges: bytes
Content-Length: 51744
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/font-woff
164.115.43.44/hospital/web/assets/a5dfc11b/jquery-ui.js
200 OK 487 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/a5dfc11b/jquery-ui.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type ASCII text, with very long lines (547), with CRLF line terminators
Size 487 kB (487212 bytes)
Hash 43109e12e36805738ddf8deca737c53b
cb6bc7d0b27bdf80a672b857bf6db0d41cc55995
37fbfc8e36798a479dd09027315d1de63f53d75aa169c97b7991ae9afbd249e4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/a5dfc11b/jquery-ui.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:41 GMT
ETag: "76f2c-56cdb4ef2b2db"
Accept-Ranges: bytes
Content-Length: 487212
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/images/bos1.jpg
200 OK 13 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/bos1.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 254x336, components 3\012- data
Hash fb8c7d61821361569fd04c9865789217
988fd0f2bcb2a8608f57fc76315e1d5dab2197e0
b34ecc01864f641057fb71cabc8cb0ed4f8b5f60ff905003ba0fb26d515e3cf5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/bos1.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 01 Dec 2021 08:44:14 GMT
ETag: "3472-5d211adb2b380"
Accept-Ranges: bytes
Content-Length: 13426
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/
200 OK 109 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Non-ISO extended-ASCII text, with very long lines (674), with CRLF, LF line terminators
Size 109 kB (109392 bytes)
Hash 0f90208813de1d9eb822ab8c3c827def
277321c9313f63b3da797e54b6b667993b069dae
21e9093e46d4c142597bd761d5e1f19eda235b5040e02c8ee25d33a2fa9b8ff0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/ HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://164.115.43.44/hospital/web/index.php
DNT: 1
Connection: keep-alive
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
content-length: 109392
164.115.43.44/hospital/web/images/LSMI_web.png
200 OK 12 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/LSMI_web.png
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type PNG image data, 376 x 79, 8-bit/color RGBA, non-interlaced\012- data
Hash 3586ffcd5d361db4fee216b74d1ec0a1
ec1d4580e9e1b702cdb0dadca15333f98f60a776
d54f4ec6eac4e9d7734de352264bb480eb85ed724a1d419c0e35abdf69c75096
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/LSMI_web.png HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 16 Jul 2013 09:01:44 GMT
ETag: "3061-4e19d39e0ee00"
Accept-Ranges: bytes
Content-Length: 12385
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: image/png
164.115.43.44/hospital/web/assets/18268b73/fullcalendar.print.css
200 OK 5.8 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/18268b73/fullcalendar.print.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type troff or preprocessor input, ASCII text, with CRLF line terminators
Hash 9f6911457f19b7b6c098c2b98e1fff60
ed5345bf7abddc3e4a6e66884c3c5cb950aaad3b
a4f9cbd12a6f4de0ce984b82d6c5d776763dcf1f96fe3f503dfe146d95f2cd5c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/18268b73/fullcalendar.print.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "168d-56cdb4ea1cf69"
Accept-Ranges: bytes
Content-Length: 5773
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/
200 OK 20 kB IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Hash 6cabf7ec0ee3968216da51260df34447
2ff4a2aea881c63abb21234159c92837bfc31164
e44273aa7127ca8c22f89fbf03d4f7f2dbfcbbe6095ca8867833f7e6c9a34349
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/ HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
content-length: 19830
164.115.43.44/hospital/web/images/logo/Logopjw.png
200 OK 45 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/logo/Logopjw.png
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type PNG image data, 600 x 136, 8-bit/color RGBA, non-interlaced\012- data
Hash 2b1049610c54e9cfe83491e9fd53ef19
f21e0f4b7893b05e32f7fdfc6ce4060ff74fc27e
18321e517add2b582d5303c8fa823e5a150647ac287f8b73a04069e829445072
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/logo/Logopjw.png HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 25 May 2023 05:08:35 GMT
ETag: "b005-5fc7d9cc7bac0"
Accept-Ranges: bytes
Content-Length: 45061
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: image/png
164.115.43.44/hospital/web/assets/18268b73/fullcalendar.js
200 OK 0 B URL GET HTTP/1.1 164.115.43.44/hospital/web/assets/18268b73/fullcalendar.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/assets/18268b73/fullcalendar.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:54 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 23 May 2018 08:27:36 GMT
ETag: "63aa7-56cdb4ea0c9b0"
Accept-Ranges: bytes
Content-Length: 408231
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/hospital/web/images/tel1669.png
200 OK 12 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/tel1669.png
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type PNG image data, 500 x 110, 8-bit/color RGBA, non-interlaced\012- data
Hash c28ac33cac7c494e1dbab24bec3fae81
128b46a14296b2f194f9b64b51cc36ac6e115d15
e82b6b94694f61b4792aa7866cfe6558a69915f46e3e5acb34afa1df9cb981ca
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/tel1669.png HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Fri, 31 Jul 2020 04:17:45 GMT
ETag: "2e28-5abb5121eec40"
Accept-Ranges: bytes
Content-Length: 11816
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: image/png
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
200 OK 33 kB URL OPTIONS HTTP/2 jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Hash 2b2ffd8f730a966ed243b578e7da50fe
2ec6a0ff38d3be25cd38534ca4ff3670697946c3
6239c37c0a02a4fa25ed36e25eed2ab44fde32e665e23dd69b3bd009374d3751
POST /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Content-Length: 24
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Sun, 03 Dec 2023 10:14:55 GMT
server: ESF
cache-control: private
content-length: 32873
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
access-control-allow-credentials: true
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/hospital/web/uploaded/news/icons/160.png
200 OK 213 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/uploaded/news/icons/160.png
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type PNG image data, 709 x 354, 8-bit/color RGB, non-interlaced\012- data
Size 213 kB (213402 bytes)
Hash db575fad3e4e2644e5b8fc55cce4f6e5
1d34ec6cc135fc6a7e55c7e941a1158436c7e49d
669e8a9a771262cc2e82d5a3e3c0741178435ed169d8c6275f010c129fc78bbb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/uploaded/news/icons/160.png HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Mon, 16 Aug 2021 07:51:32 GMT
ETag: "3419a-5c9a878354900"
Accept-Ranges: bytes
Content-Length: 213402
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: image/png
164.115.43.44/hospital/web/photolibrarys/Adpz5bf3wy8IJ6v8e_XeFN/
200 OK 1.0 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/Adpz5bf3wy8IJ6v8e_XeFN/
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 3c105274d49879f238d6b96ab9be618f
80d0b8630d42242a3b85b64401598087801922f7
ae28aec2c17b3221eb12cf24b2802be8ef6ff52bacdf6997598448ff6d9d131d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/Adpz5bf3wy8IJ6v8e_XeFN/ HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 1001
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
i.ytimg.com/vi_webp/RSq66Sr9uac/sddefault.webp
200 OK 21 kB URL GET HTTP/2 i.ytimg.com/vi_webp/RSq66Sr9uac/sddefault.webp
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subjectedgestatic.com
FingerprintC8:30:4C:1A:A8:FF:83:E1:A2:7F:DB:02:8C:D9:05:46:C4:D6:CA:95
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type RIFF (little-endian) data, Web/P image, VP8 encoding, 640x480, Scaling: [none]x[none], YUV color, decoders should clamp\012- data
Hash 7b8be75d1e884e670b518950e37886cc
59e79ea54e8f658c87deb00dbe730fd1435d1283
235c90c5f5b8c0caeae38b0823e7db13db32b25bd7abdedc0b3af739822a8ec6
GET /vi_webp/RSq66Sr9uac/sddefault.webp HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/webp
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 21350
date: Sun, 03 Dec 2023 10:14:56 GMT
expires: Sun, 03 Dec 2023 12:14:56 GMT
cache-control: public, max-age=7200
etag: "1522921045"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/hospital/web/images/ha/vision2023.png
200 OK 358 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/ha/vision2023.png
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type PNG image data, 794 x 1123, 8-bit/color RGBA, non-interlaced\012- data
Size 358 kB (357892 bytes)
Hash dc19c255285ae1d143927ae0ca3d6bd9
a2b91535b6a519e1dc3663c51fcdc843698dcda7
525b1d4fd314b7a782a668bf8a58dacdccd036fc05ee3d9ab27ff8cedd677ede
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/ha/vision2023.png HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 30 May 2023 04:30:38 GMT
ETag: "57604-5fce1aa445780"
Accept-Ranges: bytes
Content-Length: 357892
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: image/png
www.youtube.com/s/player/31e0b6d9/player_ias.vflset/en_US/remote.js
200 OK 34 kB URL GET HTTP/3 www.youtube.com/s/player/31e0b6d9/player_ias.vflset/en_US/remote.js
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (537)
Hash 63aa8296f70f3dcbf8b5df6faf8d46c3
2494976b44b1d3ec3b5825297e243679e7cca1dd
869da04350e0925de923dd2c39c41d18ba0625e3541bd5059ed5a611550552b6
GET /s/player/31e0b6d9/player_ias.vflset/en_US/remote.js HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-length: 33484
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:32:21 GMT
expires: Fri, 29 Nov 2024 04:32:21 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 30 Nov 2023 03:10:29 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
age: 279755
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
200 OK 0 B URL OPTIONS HTTP/3 jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Referer: https://www.youtube.com/
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
access-control-allow-origin: https://www.youtube.com
vary: origin, referer, x-origin
access-control-allow-credentials: true
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-max-age: 3600
date: Sun, 03 Dec 2023 10:14:56 GMT
content-type: text/html
server: ESF
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
164.115.43.44/ita66/plugins/fontawesome-free/css/all.min.css
200 OK 57 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/fontawesome-free/css/all.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (56656)
Hash 41d394990448b2c2b1afe840e837dc8e
29250ef1fa6bfbda364a1112a86b2fb7157dd44b
f8de3f57f49b005896d4c3c10979df9cff5048ddfe29ebbe36507ed1ebff60a4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/fontawesome-free/css/all.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "de0a-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 56842
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/css
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
200 OK 110 B URL OPTIONS HTTP/3 jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash de2ece2f391429666aa22723fa9e39cd
d8da03877b908a41d14755805d5f9d3eec992399
aee7b75078d59ed9e517fa367e833821e4f7f479828ff8ee978780cf7e52d35b
POST /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Host: jnn-pa.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Content-Length: 1186
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: gzip
date: Sun, 03 Dec 2023 10:14:56 GMT
server: ESF
cache-control: private
content-length: 110
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
access-control-allow-credentials: true
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.google.com/js/th/lYY52XQrUlH64Wh-f-QMzQSikq1nuSlNPE5Z4_DU2e4.js
200 OK 15 kB URL GET HTTP/2 www.google.com/js/th/lYY52XQrUlH64Wh-f-QMzQSikq1nuSlNPE5Z4_DU2e4.js
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintB0:8E:97:10:7E:30:90:F6:42:A1:32:63:5C:78:27:D3:A8:F1:05:D1
ValidityMon, 23 Oct 2023 11:24:57 GMT - Mon, 15 Jan 2024 11:24:56 GMT
File type ASCII text, with very long lines (38673)
Hash 1e5f8b711886c56ac3b42b46e8a98b36
801b5154aa0c22d8cca350a48af2682456633fde
958639d9742b5251fae1687e7fe40ccd04a292ad67b9294d3c4e59e3f0d4d9ee
GET /js/th/lYY52XQrUlH64Wh-f-QMzQSikq1nuSlNPE5Z4_DU2e4.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 15149
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 11:08:52 GMT
expires: Thu, 28 Nov 2024 11:08:52 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 06 Nov 2023 17:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 342364
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/hospital/web/images/nogif.jpg
200 OK 655 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/nogif.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:12:21 15:57:31], baseline, precision 8, 1600x900, components 3\012- data
Size 655 kB (655259 bytes)
Hash dc6f1511e1164cd44ec8953ccb05c000
1050be98d28745476590efc939ff862f108d50a3
a689658509ca1c16ff03fcb4f142b55375e3ffe93ff48a984e512580cda08a73
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/nogif.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 21 Dec 2022 08:57:33 GMT
ETag: "9ff9b-5f052be39d940"
Accept-Ranges: bytes
Content-Length: 655259
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/Po6IcWkBtcjdpdp1mefy4p/c8c39032ce49147aafe3456e0f23035d.jpg
200 OK 380 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/Po6IcWkBtcjdpdp1mefy4p/c8c39032ce49147aafe3456e0f23035d.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 380 kB (379950 bytes)
Hash 9ec60de80d77a42814952c85510137e7
1a7c85d63e4bf6e57f00fb19718890f9f2bfa838
6ce6a4c7bff1d1f26faf9b468e619d91d8346bc1a7f6aa35d4f57d0451ebcbf0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/Po6IcWkBtcjdpdp1mefy4p/c8c39032ce49147aafe3456e0f23035d.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 24 Feb 2022 08:34:48 GMT
ETag: "5cc2e-5d8bf74820adb"
Accept-Ranges: bytes
Content-Length: 379950
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/ita66/plugins/tempusdominus-bootstrap-4/css/tempusdominus-bootstrap-4.min.css
200 OK 9.1 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/tempusdominus-bootstrap-4/css/tempusdominus-bootstrap-4.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (836), with CRLF, LF line terminators
Hash be1a1448dd867946cb6a580d348bc369
444757a3725470f67dddb403dc8788aea0cb1c86
be2d34616cdaf0c442488e4676c14ba6d0192142e7cb930f9fad8fc447ff6536
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/tempusdominus-bootstrap-4/css/tempusdominus-bootstrap-4.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "236f-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 9071
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/plugins/icheck-bootstrap/icheck-bootstrap.min.css
200 OK 12 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/icheck-bootstrap/icheck-bootstrap.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (12293), with CRLF line terminators
Hash e067d8454ea71a421ac69892bc0f1bdf
3185a60f3cafa077277c925bb83a80517a1ed9a7
7f1c6f368fef383f3c0107eb1a1f3c0fbe308187b1e3b93dfac6b76d69827a52
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/icheck-bootstrap/icheck-bootstrap.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "30d9-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 12505
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/css
www.youtube.com/generate_204?eaEXig
204 No Content 0 B URL GET HTTP/3 www.youtube.com/generate_204?eaEXig
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /generate_204?eaEXig HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
content-length: 0
cross-origin-resource-policy: cross-origin
date: Sun, 03 Dec 2023 10:14:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
164.115.43.44/ita66/plugins/jqvmap/jqvmap.min.css
200 OK 613 B URL GET HTTP/1.1 164.115.43.44/ita66/plugins/jqvmap/jqvmap.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (612)
Hash 126a06688aa11c13a58772a516cf6d72
e9230a3801d2e674864a1b801fbf0b7eac59d1e6
32d26b3f38f5adcf544dcb92bd5ef604d67ac7300a28f7f8b072ae0e9f555a3c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/jqvmap/jqvmap.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "265-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 613
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/plugins/overlayScrollbars/css/OverlayScrollbars.min.css
200 OK 20 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/overlayScrollbars/css/OverlayScrollbars.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (19243)
Hash eecdf1a424a68e5ee7c2a5c2ab9d62f1
7d7cdccce8b7b79df4e812380d06408ce335992d
7df82b8eed52fe2aa69b1adf0feb904d177286ce98568bfc496c401cf2d37614
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/overlayScrollbars/css/OverlayScrollbars.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "4c0e-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 19470
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/css
yt3.ggpht.com/3inJ78NumLjNpqeK6ixV173XFu3AV-ZcKhEQQbPuym0Hlq1qebbHqpzCI_uBqqN-2lVib0C0V-A=s68-c-k-c0x00ffffff-no-rj
200 OK 1.5 kB URL GET HTTP/2 yt3.ggpht.com/3inJ78NumLjNpqeK6ixV173XFu3AV-ZcKhEQQbPuym0Hlq1qebbHqpzCI_uBqqN-2lVib0C0V-A=s68-c-k-c0x00ffffff-no-rj
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE
ValidityMon, 23 Oct 2023 11:23:50 GMT - Mon, 15 Jan 2024 11:23:49 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3\012- data
Hash 21a6fe4aee591cc80e00d4def6f105dc
62c9f1aea87f206b67d3bf76e15928cbf45b6849
0edce1577d256f02afaca431261ac083c643b0023c6ffdb776db22a164a54307
GET /3inJ78NumLjNpqeK6ixV173XFu3AV-ZcKhEQQbPuym0Hlq1qebbHqpzCI_uBqqN-2lVib0C0V-A=s68-c-k-c0x00ffffff-no-rj HTTP/1.1
Host: yt3.ggpht.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
etag: "v1"
expires: Mon, 04 Dec 2023 10:14:56 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="channels4_profile.jpg"
x-content-type-options: nosniff
date: Sun, 03 Dec 2023 10:14:56 GMT
server: fife
content-length: 1501
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/ita66/plugins/daterangepicker/daterangepicker.css
200 OK 8.1 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/daterangepicker/daterangepicker.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with CRLF line terminators
Hash 55e1d560821b4a4b141b0ab6cbb74d26
8ea448a2344bcc364a92e8c9282fc1585874512e
94fdb66ec8fe748981a4f2090fdf4a2a0a3dbe5ace2e65c4ce46e95d692bdac7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/daterangepicker/daterangepicker.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "1f85-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 8069
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/plugins/summernote/summernote-bs4.css
200 OK 19 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/summernote/summernote-bs4.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (18647), with no line terminators
Hash 549b762da219736cc3a8179735ba61cd
4501e16117944c197a925cef1a278ca103aacdf4
08b3181d5897342c4351dff248b789263c8bb6d7816708ea678739a7a53b2fbf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/summernote/summernote-bs4.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "48d7-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 18647
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/css/bootstrap.min.css
200 OK 157 kB URL GET HTTP/1.1 164.115.43.44/ita66/css/bootstrap.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (39783), with CRLF line terminators
Size 157 kB (157211 bytes)
Hash 65807a29f2e8721ef7ba70123ce632e4
b3c0a433cf8f6a71ea59d4fe86632e4201d80359
afb04835c07505bd152d141eb6d1dbd18323e16e5a0a87cd8463aa84c94c8243
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/css/bootstrap.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 09 Apr 2019 12:08:06 GMT
ETag: "2661b-58617ce3c9580"
Accept-Ranges: bytes
Content-Length: 157211
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/css/style.css
200 OK 4.0 kB URL GET HTTP/1.1 164.115.43.44/ita66/css/style.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
Hash da1d2fb930d9197ec0d5a9b9d4f1507e
f923957d5713ca64e4bb0153221f30298d99820b
d000ec52d9b3801b3221a1c5efff262b86b095deeef07408bde7a49198f4afff
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/css/style.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 18 Mar 2020 06:22:40 GMT
ETag: "fcb-5a11b1447ec00"
Accept-Ranges: bytes
Content-Length: 4043
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/dist/css/adminlte.min.css
200 OK 603 kB URL GET HTTP/1.1 164.115.43.44/ita66/dist/css/adminlte.min.css
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (65141)
Size 603 kB (602813 bytes)
Hash 910ac55aefb30feb1e68afb805213a3e
85a868fa4f880d51104775004f059955da73af3b
12f9018fd11c48eb11d1d3714b2459351e29bfadaefd08199ea31165de8be29d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/dist/css/adminlte.min.css HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "932bd-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 602813
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/css
164.115.43.44/ita66/js/jquery.min.js
404 Not Found 220 B URL GET HTTP/1.1 164.115.43.44/ita66/js/jquery.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 4060e4af891b2dfa22c54d04893923bf
6d7c069f1e63cc25550ab694454f0e97f7a04433
2f87acb049945c75bc88b19338e09def7f034691a8dcc5ebfec6dbc3230dca67
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/js/jquery.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 220
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
164.115.43.44/ita66/js/bootstrap.min.js
404 Not Found 223 B URL GET HTTP/1.1 164.115.43.44/ita66/js/bootstrap.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 71cd4fa1fb76e6b2e665f5183b623bc9
9628b09e714e2011737812aa1a7d253d0ac975f8
881cd0cc9cf25a2f542218ad9c28a23ecb4508607da065a17d33ddab340b17c2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/js/bootstrap.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 223
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
164.115.43.44/ita66/js/fontawsome.js
404 Not Found 220 B URL GET HTTP/1.1 164.115.43.44/ita66/js/fontawsome.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash f048550cfc68150bfbb05d9a5ba84ae2
61709ae2587abcf09728c21e631762aa72675b28
191907b858a7d677b0a3d59edf9dd8cbff22a0fa75caa25fd5990902ac2af0d5
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/js/fontawsome.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 220
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
164.115.43.44/ita66/plugins/jquery/jquery.min.js
200 OK 88 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/jquery/jquery.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (65451)
Hash 220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/jquery/jquery.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "15851-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 88145
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/jquery-ui/jquery-ui.min.js
200 OK 254 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/jquery-ui/jquery-ui.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (32074)
Size 254 kB (253669 bytes)
Hash c15b1008dec3c8967ea657a7bb4baaec
78489e580adaef931e6e5b131dab556c397e4a1a
28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/jquery-ui/jquery-ui.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "3dee5-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 253669
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/bootstrap/js/bootstrap.bundle.min.js
200 OK 79 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/bootstrap/js/bootstrap.bundle.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (65297)
Hash a454220fc07088bf1fdd19313b6bfd50
265a733cb7fbc481fd2510a659a85ad55c93c895
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "1332b-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 78635
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/chart.js/Chart.min.js
200 OK 173 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/chart.js/Chart.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (65414)
Size 173 kB (172810 bytes)
Hash 5423897f58abad24d4ae62381db3417d
1445ca9d819381bbefaf4e1e21efbf3533ab7bcc
6485aa93c81317de6df661c89711cbe32718bb9d881d5703884f6be566ae3631
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/chart.js/Chart.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "2a30a-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 172810
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/sparklines/sparkline.js
200 OK 7.2 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/sparklines/sparkline.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with CRLF line terminators
Hash 3ffd8341d66e61f94991e97394a0a6f9
e81642192dfcfbc2c44da63ed8821529bdbcb8cc
643753ec4cdd550d26401f2b1e45cabdb04341587a4ac28954909980b5a69de3
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/sparklines/sparkline.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "1c33-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 7219
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/jqvmap/jquery.vmap.min.js
200 OK 21 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/jqvmap/jquery.vmap.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (20912)
Hash 935f68d33bdd88a1341647523f7813a2
2ea92021c03f2956158f67aa51f08fbdcf0fed38
4f1dd628138e379c385de592abd2dd881302e37cf6dd80a7a13cf95b83221a09
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/jqvmap/jquery.vmap.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "529e-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 21150
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/jqvmap/maps/jquery.vmap.usa.js
200 OK 48 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/jqvmap/maps/jquery.vmap.usa.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (47680)
Hash 43e330fe0440c72344722238695dc793
9877bca1d7babc71d4068dbb6c57672ce850878a
c6603cbe3c9ec566e4657a9f46f8c870f86c125fb6885a208549228a1c0acde8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/jqvmap/maps/jquery.vmap.usa.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "ba60-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 47712
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/jquery-knob/jquery.knob.min.js
200 OK 11 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/jquery-knob/jquery.knob.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (10804), with no line terminators
Hash e708020309de1747a08957f691324ac8
4df8f239f9a18fcdd446d2238e6c1b0e32ea52d5
db5e38abe34e33f5d4e99c52a914c9f0fd16fc2918eb35dcea65d8b78fa617db
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/jquery-knob/jquery.knob.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "2a34-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 10804
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/moment/moment.min.js
200 OK 53 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/moment/moment.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (53324), with no line terminators
Hash 761502841c035afcf6a9bdc5d0a20d11
69ab16ba8ca68431ab59eff286c7ed1e520bca30
e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/moment/moment.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "d04c-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 53324
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/daterangepicker/daterangepicker.js
200 OK 67 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/daterangepicker/daterangepicker.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with CRLF line terminators
Hash eea458a9a48a89094b8adf75a89dabce
8042e37aef14f4dee78e350bcf2ff961a54c0299
7071393d236d9c35f0904907d217b95e42453e2056a452aa06005bf5459df9d2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/daterangepicker/daterangepicker.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "106c4-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 67268
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/tempusdominus-bootstrap-4/js/tempusdominus-bootstrap-4.min.js
200 OK 57 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/tempusdominus-bootstrap-4/js/tempusdominus-bootstrap-4.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (32032)
Hash ac4d4d755b70ee1a00f7fc78cc85bc05
e6ce53ab1858b532c037334b512e010f0f093943
cf4a0a620eb188bab7c891aca7f2ec63d5f291bc1e4251e5e368c7bf65d3073e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/tempusdominus-bootstrap-4/js/tempusdominus-bootstrap-4.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "de2f-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 56879
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/summernote/summernote-bs4.min.js
200 OK 128 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/summernote/summernote-bs4.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (65450)
Size 128 kB (127927 bytes)
Hash e1828c10ba4dee962f9be1a7494789e6
3ca3382a49700536b989ccb2ccbd1ab655b814bb
8cf2b50019380ae16f4abdf5bf808b53b5fb5c2be2c594a2f1f4d30b0fedb2da
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/summernote/summernote-bs4.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "1f3b7-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 127927
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/overlayScrollbars/js/jquery.overlayScrollbars.min.js
200 OK 42 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/overlayScrollbars/js/jquery.overlayScrollbars.min.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type ASCII text, with very long lines (41849)
Hash b9248cb54d63e2b173e6fafc3d1654c4
8d3d4c908db775e6e9dd658250f1e1ec3a80b81a
92d19fd35b64fd48bbd5b3d31dca62b260a164542fe5af298cf05037233c7749
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/overlayScrollbars/js/jquery.overlayScrollbars.min.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "a45c-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 42076
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/dist/js/adminlte.js
200 OK 54 kB URL GET HTTP/1.1 164.115.43.44/ita66/dist/js/adminlte.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
Hash e750c01aaf38601429c71425a9c6ff86
7d6cc88ca7bfd3317caffed152e1b5a810c0e2fd
b85717aaa03eb27be84971065ea8cbe10b66f387384be208dc89cc99ee388e30
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/dist/js/adminlte.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "d39d-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 54173
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/dist/js/pages/dashboard.js
200 OK 7.6 kB URL GET HTTP/1.1 164.115.43.44/ita66/dist/js/pages/dashboard.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
Hash 778ac038287811d827b6784b9b6bee41
76dbca6af5a10c7a0fe4081af5d3ea92512dbdf4
fed707524ce1241d055a02f61ef9332ac5d748972dfb77b12d9ba63fd80ff1fa
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/dist/js/pages/dashboard.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "1d99-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 7577
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/dist/js/demo.js
200 OK 12 kB URL GET HTTP/1.1 164.115.43.44/ita66/dist/js/demo.js
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
Hash 736dc546c6354a9e89331b7bbcf44993
cd366f0aa3387b6fdea9d0ba8f2fb88075c00c4d
7156ea6e3afdcd4933b639699c18d0bfcd75ea842987da78fe867269022b95f1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/dist/js/demo.js HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "2f95-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 12181
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: application/javascript
164.115.43.44/ita66/plugins/fontawesome-free/webfonts/fa-solid-900.woff2
200 OK 76 kB URL GET HTTP/1.1 164.115.43.44/ita66/plugins/fontawesome-free/webfonts/fa-solid-900.woff2
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type Web Open Font Format (Version 2), TrueType, length 75728, version 330.32636\012- data
Hash 44d537ab79f921fde5a28b2c1636f397
b2879f9e1d0985a96842bf7f55a2b2cc4c636d04
3d1080625d3030e88357b3ac9aa377dcec23f1b529c4ad03f7a9a435ccae04be
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/plugins/fontawesome-free/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/plugins/fontawesome-free/css/all.min.css
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 19 Nov 2019 17:41:28 GMT
ETag: "127d0-597b692e6e200"
Accept-Ranges: bytes
Content-Length: 75728
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
164.115.43.44/ita66/css/fonts/sukhumvitset-text-webfont.woff2
200 OK 34 kB URL GET HTTP/1.1 164.115.43.44/ita66/css/fonts/sukhumvitset-text-webfont.woff2
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type Web Open Font Format (Version 2), TrueType, length 34452, version 0.66\012- data
Hash 015ae8cf3bf3e722e599e7e4603de2df
1226004502f3a64da535dbbd4e6917bdc3e94f01
98580bb9b36c9a0a0a591f9c361e13c0de4bd6d3d37c46422c021bf8434ebdd8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/css/fonts/sukhumvitset-text-webfont.woff2 HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/css/style.css
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 04 May 2017 17:50:22 GMT
ETag: "8694-54eb66827b380"
Accept-Ranges: bytes
Content-Length: 34452
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
164.115.43.44/hospital/web/photolibrarys/zv7HWFwA-riUWmgItN0R47/44e274eab88fdf21090e8da946d71200.jpg
200 OK 434 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/zv7HWFwA-riUWmgItN0R47/44e274eab88fdf21090e8da946d71200.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 434 kB (433461 bytes)
Hash 639baf4e54d553e9b977cb70987f7c67
bd37dd576049180b66d9a47738380df0f970453f
6a54467ab5f04631a5f237fd953017df80f927a6f886cb9f0dd64eebcf1bc776
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/zv7HWFwA-riUWmgItN0R47/44e274eab88fdf21090e8da946d71200.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 24 Feb 2022 07:36:11 GMT
ETag: "69d35-5d8bea2e6a87f"
Accept-Ranges: bytes
Content-Length: 433461
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: image/jpeg
www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
200 OK 31 B URL POST HTTP/3 www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type JSON data\012- , ASCII text
Hash 5e1fa6fd9abd549a576f3f24b1d3c8d4
d5335d7f7d33be6a0b663f03b2df4df2521c4a87
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Request-Time: 1701598503223
Content-Type: application/json
X-Goog-Visitor-Id: CgtTbEdwM0p2ZkVoTSieqrGrBjIICgJOTxICEgA%3D
X-YouTube-Client-Name: 56
X-YouTube-Client-Version: 1.20231128.01.01
X-YouTube-Utc-Offset: 0
X-YouTube-Time-Zone: UTC
X-YouTube-Ad-Signals: dt=1701598500403&flash=0&frm=2&u_tz&u_his=2&u_h=1024&u_w=1280&u_ah=1024&u_aw=1280&u_cd=24&bc=23&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C1024%2C510%2C287&vis=1&wgl=true&ca_type=image
Content-Length: 16660
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: br
date: Sun, 03 Dec 2023 10:14:57 GMT
server: scaffolding on HTTPServer2
content-length: 31
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: CONSENT=PENDING+271; expires=Tue, 02-Dec-2025 10:14:57 GMT; path=/; domain=.youtube.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 03 Dec 2023 10:14:57 GMT
cache-control: private
164.115.43.44/hospital/web/photolibrarys/lHCdEI4YFERb8kjUrszJ8e/c0a5eb359f1faae0a362dcb926b0054e.jpg
200 OK 537 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/lHCdEI4YFERb8kjUrszJ8e/c0a5eb359f1faae0a362dcb926b0054e.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 537 kB (536807 bytes)
Hash e5d598030ef21ca26bf58df0449a9162
11a32421844bd9010a8c887506a7c2a8853b13d1
f91fefd0960524ad6a1a78705b5cb45ca62acd15645187acd084f8a1acbe02b2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/lHCdEI4YFERb8kjUrszJ8e/c0a5eb359f1faae0a362dcb926b0054e.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 22 Jul 2021 03:59:18 GMT
ETag: "830e7-5c7ae4fa875bf"
Accept-Ranges: bytes
Content-Length: 536807
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/3nRMJSOEe9DcAwtjQE85Q7/44b442dcca870f24f016214b2156e69d.jpg
200 OK 372 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/3nRMJSOEe9DcAwtjQE85Q7/44b442dcca870f24f016214b2156e69d.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 372 kB (372075 bytes)
Hash b988493bf8f05bf3e5532b94bc152f2b
773d40c4170732c6fb9be9a123f5e74b7303d353
1a1b8698175089f234cf36f53ff00f82eea19ee6dd49b26a358775f4eec86393
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/3nRMJSOEe9DcAwtjQE85Q7/44b442dcca870f24f016214b2156e69d.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Mon, 26 Apr 2021 07:22:45 GMT
ETag: "5ad6b-5c0db031429b0"
Accept-Ranges: bytes
Content-Length: 372075
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/qCBDqheUBPeaDAzkdpU5_U/f8ef19bbe7c57dbc1ece44a9363a0360.jpg
200 OK 368 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/qCBDqheUBPeaDAzkdpU5_U/f8ef19bbe7c57dbc1ece44a9363a0360.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 368 kB (368167 bytes)
Hash 3190f950ed77ade9b7e3c3605403dcab
2e108451cc444ff35af9a8efa97864ac81ad3ca2
952856038224142a98e6959ea8e036d609a0cc59017d82dbca76871c0ec3ad09
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/qCBDqheUBPeaDAzkdpU5_U/f8ef19bbe7c57dbc1ece44a9363a0360.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Sat, 10 Apr 2021 05:24:21 GMT
ETag: "59e27-5bf977e2f592d"
Accept-Ranges: bytes
Content-Length: 368167
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/IQtE8DNEh5trgzkn5dprCu/2ca8eb664f447166fc1e97ca8ad928bb.jpg
200 OK 1.0 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/IQtE8DNEh5trgzkn5dprCu/2ca8eb664f447166fc1e97ca8ad928bb.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1754, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1240], baseline, precision 8, 1240x1754, components 3 DIY-Thermocam raw data\012- (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 16, minimum point enabled, calibration: offset 0.000000, slope 4754540834632868954551630168064.000000\012- data
Size 1.0 MB (1042558 bytes)
Hash 328485e4906319941bfeed3c10e9f87d
0522326d66aa10cf225349ced164614b88d4979f
779ef655b1eff2d77a5e81bdaaec429accc30c4f33d3db8981f5086ba44c2f78
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/IQtE8DNEh5trgzkn5dprCu/2ca8eb664f447166fc1e97ca8ad928bb.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 10 Feb 2022 08:05:16 GMT
ETag: "fe87e-5d7a5691b7740"
Accept-Ranges: bytes
Content-Length: 1042558
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/pYEuahH-N13GNcc1bMDlUH/8a260a369f6c8131247777cfb22ee451.jpg
200 OK 392 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/pYEuahH-N13GNcc1bMDlUH/8a260a369f6c8131247777cfb22ee451.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 392 kB (392449 bytes)
Hash 7ae8470b7c7573673d09f78df96aaad3
9add3e15bd8938897cc1321e1435313905316f54
79bd104d0162023838570cb9250878ba831c286a13e9bb0cc108397ec37ec5a9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/pYEuahH-N13GNcc1bMDlUH/8a260a369f6c8131247777cfb22ee451.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 07 Apr 2021 03:19:47 GMT
ETag: "5fd01-5bf59672cffd1"
Accept-Ranges: bytes
Content-Length: 392449
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/lnJ8OPghkfIsE2hekjzVbi/25f0a8ebc70b502ffdde712acf532839.jpg
200 OK 413 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/lnJ8OPghkfIsE2hekjzVbi/25f0a8ebc70b502ffdde712acf532839.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 413 kB (413331 bytes)
Hash 340a2c8bc3cddcc2f6ebc2fdf01a77ba
614a6c58f162069a0a74e9ce1437567c1fc2c869
e41fd800485fa5627b16d23af1fb1d334b5d0222e6e9e22e52d4b24b87f7ed60
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/lnJ8OPghkfIsE2hekjzVbi/25f0a8ebc70b502ffdde712acf532839.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Mon, 05 Apr 2021 11:14:08 GMT
ETag: "64e93-5bf37cbe6fe23"
Accept-Ranges: bytes
Content-Length: 413331
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/JOIgMALzDVzHKS0Ys5xSjn/da907c174e0eedf4464794d68ce612c1.jpg
200 OK 378 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/JOIgMALzDVzHKS0Ys5xSjn/da907c174e0eedf4464794d68ce612c1.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 378 kB (377651 bytes)
Hash 1b1bca31f8d05e6008e1c5ca58cd2566
a4fbd61a7f38a27d1372ffec7e98e7833e99f21e
f46b4fc0317a3202a7c4b500022a1891bcce1edd3d6009b8b043ac098073be16
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/JOIgMALzDVzHKS0Ys5xSjn/da907c174e0eedf4464794d68ce612c1.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Fri, 29 Jan 2021 07:41:14 GMT
ETag: "5c333-5ba052100e9f9"
Accept-Ranges: bytes
Content-Length: 377651
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/CcPZJkziMpuMZu0fRCIgTg/6c6a659115f024810b8a3e3ed52d5d71.jpg
200 OK 546 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/CcPZJkziMpuMZu0fRCIgTg/6c6a659115f024810b8a3e3ed52d5d71.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 546 kB (546103 bytes)
Hash 6a4d8de68f71948e6ba7b8363dc023f5
1ede01d9c8fc5459b38b14c0c358477becd527ad
5be8fe43870f05ab18ff2b8519b9ac510d1652d170419e25c6baf0e2fcd41a76
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/CcPZJkziMpuMZu0fRCIgTg/6c6a659115f024810b8a3e3ed52d5d71.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 24 Feb 2022 07:34:16 GMT
ETag: "85537-5d8be9c06897b"
Accept-Ranges: bytes
Content-Length: 546103
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/Q_kQZfYCX6C62HFYZBRrRt/0f6f7db72afbd15b312ab6ee75d784b3.jpg
200 OK 1.3 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/Q_kQZfYCX6C62HFYZBRrRt/0f6f7db72afbd15b312ab6ee75d784b3.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1754, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1240], baseline, precision 8, 1240x1754, components 3\012- data
Size 1.3 MB (1286038 bytes)
Hash cb1640f8939d74f2370d8551685b9228
3b7b27917088ea21066cc184a123444e03b9e6bd
f735d9b4745f8d86a2f06cab92772207055d65c9eacbf852b698ddafe09fc002
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/Q_kQZfYCX6C62HFYZBRrRt/0f6f7db72afbd15b312ab6ee75d784b3.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:57 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 15 Feb 2022 07:59:52 GMT
ETag: "139f96-5d809eb064749"
Accept-Ranges: bytes
Content-Length: 1286038
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/E9xrAt_JDlUlKR72EWfYIk/fc549ec59e524f1932db653beeed9749.jpg
200 OK 425 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/E9xrAt_JDlUlKR72EWfYIk/fc549ec59e524f1932db653beeed9749.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 425 kB (424746 bytes)
Hash 3e9bcc17d8cde1c8f9574ce24d243a20
256db78a07c6cc265e56eae12b1482c9a36ffee3
50b5ccec26dc73122bd072adb4518de859ece3a057fb9ad925d642bca49396a8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/E9xrAt_JDlUlKR72EWfYIk/fc549ec59e524f1932db653beeed9749.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Mon, 18 Jan 2021 09:20:35 GMT
ETag: "67b2a-5b9293c0f4b69"
Accept-Ranges: bytes
Content-Length: 424746
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/jSLrq-8iV_k8hnbklqOYu7/d783d8ad537cd3b06c159805bd6f3067.jpg
200 OK 432 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/jSLrq-8iV_k8hnbklqOYu7/d783d8ad537cd3b06c159805bd6f3067.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 432 kB (432155 bytes)
Hash 216e1dac8cae6fe4bc727e0d92604292
45c53740d9671c2a4eacfc76fa59cfb6d919f437
2e6a1ecb27305f3fc539e4ab666806c1f377b15421336d16681acce3831cd7be
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/jSLrq-8iV_k8hnbklqOYu7/d783d8ad537cd3b06c159805bd6f3067.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Fri, 04 Dec 2020 07:59:17 GMT
ETag: "6981b-5b59eda72bd8f"
Accept-Ranges: bytes
Content-Length: 432155
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/sxxoB5x2o6b38C2N1XAEDL/1528a392ab9f9d4cab75fa35816684b0.jpg
200 OK 351 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/sxxoB5x2o6b38C2N1XAEDL/1528a392ab9f9d4cab75fa35816684b0.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 351 kB (350592 bytes)
Hash df7ed24d85494687e9b7163e87a48a27
5c79bfdd40fcc6e9db1be5da4f6a607c4607dc6d
0d50b6df75c61a481ea78d21d0f9c7e8a2b734530b7aee5758806e231bd53e78
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/sxxoB5x2o6b38C2N1XAEDL/1528a392ab9f9d4cab75fa35816684b0.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 02 Dec 2020 09:04:27 GMT
ETag: "55980-5b57787c939f3"
Accept-Ranges: bytes
Content-Length: 350592
Keep-Alive: timeout=5, max=83
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/Kt95NfGa-6lTcF_rqYw2Vv/ccd955d9af30c3e6e6fa553cd1733edc.jpg
200 OK 356 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/Kt95NfGa-6lTcF_rqYw2Vv/ccd955d9af30c3e6e6fa553cd1733edc.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 356 kB (355980 bytes)
Hash c017c150999b8d5982d64008567fa991
5b74f6796bf869d60602d86a540f58fadfea19c2
7b8cce7df5fd89211a4b26b3e233d4856fd3424a913de47715dcb3b45ab40925
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/Kt95NfGa-6lTcF_rqYw2Vv/ccd955d9af30c3e6e6fa553cd1733edc.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 01 Dec 2020 07:37:23 GMT
ETag: "56e8c-5b562328d6c05"
Accept-Ranges: bytes
Content-Length: 355980
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/l7Wv7g_4ci-YczWldRidNY/07560ef7e94db7d8c6e0af6c9f6d6555.jpg
200 OK 353 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/l7Wv7g_4ci-YczWldRidNY/07560ef7e94db7d8c6e0af6c9f6d6555.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 353 kB (353016 bytes)
Hash a394afcb261dd1643714b09351f7b948
cc28f988fe7892dd5dce2250be23d5812cce6378
7db76d61976f27ef0b6893e1c89a4131ac8a36eb597618b3029fb9bac8158170
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/l7Wv7g_4ci-YczWldRidNY/07560ef7e94db7d8c6e0af6c9f6d6555.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 01 Dec 2020 07:30:43 GMT
ETag: "562f8-5b5621ab5ca7a"
Accept-Ranges: bytes
Content-Length: 353016
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/photolibrarys/hF32Z68ONJlnKwlk8BNDDV/09477fafc612f410ad2186cc77f1d9a0.jpg
200 OK 358 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/hF32Z68ONJlnKwlk8BNDDV/09477fafc612f410ad2186cc77f1d9a0.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1240x1754, components 3\012- data
Size 358 kB (358171 bytes)
Hash 3a0edeb0127821e78fbff257afa1a0ac
ee1de72a01c2bf9a9ee62506a067689f7da285e8
ca202b4d4481b4e99a48784b9fa16e1c1c7658bc8bbac9f063db84398231aa15
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/hF32Z68ONJlnKwlk8BNDDV/09477fafc612f410ad2186cc77f1d9a0.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Tue, 01 Dec 2020 07:34:15 GMT
ETag: "5771b-5b5622765e3de"
Accept-Ranges: bytes
Content-Length: 358171
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/ita66/dist/img/logomoph.png
200 OK 21 kB URL GET HTTP/1.1 164.115.43.44/ita66/dist/img/logomoph.png
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/ita66/
File type PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced\012- data
Hash 71ec81a92df96988b033effe3778cff3
8e5d907f48ee467fbc7d6e7aa5fa7ccfd4912522
d40a7923fe721862504fb99bccd22d3e36b68bb987cd0a2edd292a4e4786ab85
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/dist/img/logomoph.png HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/ita66/
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Sun, 12 Jan 2020 03:24:08 GMT
ETag: "517c-59be8e4450600"
Accept-Ranges: bytes
Content-Length: 20860
Keep-Alive: timeout=5, max=83
Connection: Keep-Alive
Content-Type: image/png
164.115.43.44/hospital/web/images/thsss.jpg
200 OK 472 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/thsss.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1980x513, components 3\012- data
Size 472 kB (472462 bytes)
Hash 013437e1f32ed07ac8dcdf5544fba49f
bf9d4cb5644b093efb7dff88bdf0ac53a8e487ea
2960ee2001b8b7659ec5fe8a214ef616e552b2d42f1adbb19266b7402b351b21
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/thsss.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 11 Dec 2019 08:59:21 GMT
ETag: "7358e-59969d82d0c40"
Accept-Ranges: bytes
Content-Length: 472462
Keep-Alive: timeout=5, max=83
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/images/info/info21.jpg
200 OK 2.0 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/info/info21.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, baseline, precision 8, 3296x1241, components 4\012- data
Size 2.0 MB (1988362 bytes)
Hash 2b694fe98ddc7f01464e96623f3538e4
1bc5659726e77e73ce5b471d18fd116246159db5
505707b0841f3f51a1bf6954219f5c99cbe5de5ffa5b550413907e9ad3bc6679
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/info/info21.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 15 Apr 2021 15:08:53 GMT
ETag: "1e570a-5c0043dd00b40"
Accept-Ranges: bytes
Content-Length: 1988362
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/images/info/info22.jpg
200 OK 1.5 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/info/info22.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, baseline, precision 8, 3296x1241, components 4\012- data
Size 1.5 MB (1514635 bytes)
Hash 679f9ba73024bc83bd1d0cc4a8e5fcbf
6bc087ce8dd3ae4b4a2610e49986ea3d7b683aef
dc28754f7d7fce6ef3792b3a9007c8dfdcf4bd4f490fd0109aa792fd778a9d96
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/info/info22.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:58 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 15 Apr 2021 15:07:49 GMT
ETag: "171c8b-5c00439ff7b40"
Accept-Ranges: bytes
Content-Length: 1514635
Keep-Alive: timeout=5, max=82
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/favicon.ico
404 Not Found 209 B URL GET HTTP/1.1 164.115.43.44/favicon.ico
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 18ffb59b61525f781cf9251045be575d
bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Sun, 03 Dec 2023 10:14:59 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Content-Length: 209
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
164.115.43.44/ita66/
200 OK 20 kB IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Hash 6cabf7ec0ee3968216da51260df34447
2ff4a2aea881c63abb21234159c92837bfc31164
e44273aa7127ca8c22f89fbf03d4f7f2dbfcbbe6095ca8867833f7e6c9a34349
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /ita66/ HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:15:12 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Set-Cookie: cookiesession1=678B76F47993D1758CB125109D4A103D;Expires=Mon, 02 Dec 2024 10:15:12 GMT;Path=/;HttpOnly
content-length: 19830
www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
200 OK 31 B URL POST HTTP/3 www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
IP
Requested by https://www.youtube.com/embed/RSq66Sr9uac
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type JSON data\012- , ASCII text
Hash 5e1fa6fd9abd549a576f3f24b1d3c8d4
d5335d7f7d33be6a0b663f03b2df4df2521c4a87
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Goog-Request-Time: 1701598519225
Content-Type: application/json
X-Goog-Visitor-Id: CgtTbEdwM0p2ZkVoTSieqrGrBjIICgJOTxICEgA%3D
X-YouTube-Client-Name: 56
X-YouTube-Client-Version: 1.20231128.01.01
X-YouTube-Utc-Offset: 0
X-YouTube-Time-Zone: UTC
X-YouTube-Ad-Signals: dt=1701598500403&flash=0&frm=2&u_tz&u_his=2&u_h=1024&u_w=1280&u_ah=1024&u_aw=1280&u_cd=24&bc=23&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1280%2C0%2C1280%2C1024%2C510%2C287&vis=1&wgl=true&ca_type=image
Content-Length: 1093
Origin: https://www.youtube.com
DNT: 1
Connection: keep-alive
Referer: https://www.youtube.com/embed/RSq66Sr9uac
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
content-encoding: br
date: Sun, 03 Dec 2023 10:15:14 GMT
server: scaffolding on HTTPServer2
content-length: 31
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: CONSENT=PENDING+000; expires=Tue, 02-Dec-2025 10:15:14 GMT; path=/; domain=.youtube.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 03 Dec 2023 10:15:14 GMT
cache-control: private
fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,400i,700
200 OK 9.3 kB URL GET HTTP/3 fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,400i,700
IP
Requested by http://164.115.43.44/ita66/
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (9493), with no line terminators
Hash 677faf88c9909312ed868d669b63221b
105d45dc6337d2a4784a010c930a21a6e9aa3db7
42d26d154178d6041f6e62ee0519a70508605444e58b0aad646144562b1d45d4
GET /css?family=Source+Sans+Pro:300,400,400i,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 03 Dec 2023 10:14:56 GMT
date: Sun, 03 Dec 2023 10:14:56 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
164.115.43.44/hospital/web/photolibrarys/vG0aiBGy9pF12SpnctXQKj/9038e16e71f7628dff233762a31552b4.jpg
200 OK 1.3 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/vG0aiBGy9pF12SpnctXQKj/9038e16e71f7628dff233762a31552b4.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1754, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1240], baseline, precision 8, 1240x1754, components 3\012- data
Size 1.3 MB (1333381 bytes)
Hash 9ad501ec0041d30f28051a7a3268b986
10455b28f21da0bfd6a55418ec10c099b9181a81
321cf8c93509804c68f3b78d50633ce23048eea8e070ad646bb814b7ce3ddba6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/vG0aiBGy9pF12SpnctXQKj/9038e16e71f7628dff233762a31552b4.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 17 Mar 2022 03:19:52 GMT
ETag: "145885-5da6180e52130"
Accept-Ranges: bytes
Content-Length: 1333381
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: image/jpeg
164.115.43.44/hospital/web/images/info/info20.jpg
200 OK 1.9 MB URL GET HTTP/1.1 164.115.43.44/hospital/web/images/info/info20.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
Size 1.9 MB (1851995 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/images/info/info20.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:55 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Thu, 15 Apr 2021 15:08:42 GMT
ETag: "1c425b-5c0043d283280"
Accept-Ranges: bytes
Content-Length: 1851995
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: image/jpeg
code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css
200 OK 51 kB URL GET HTTP/2 code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css
IP
Requested by http://164.115.43.44/ita66/
Certificate IssuerCloudflare, Inc.
Subjectionicframework.com
FingerprintF0:95:87:C3:E4:A0:31:2D:83:93:BF:FD:9F:E3:6A:84:64:FB:AC:2E
ValiditySat, 01 Apr 2023 00:00:00 GMT - Sun, 31 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ionicons/2.0.1/css/ionicons.min.css HTTP/1.1
Host: code.ionicframework.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 10:14:56 GMT
content-type: text/css; charset=utf-8
x-origin-cache: HIT
last-modified: Thu, 13 Apr 2023 16:20:19 GMT
access-control-allow-origin: *
etag: W/"64382bc3-c854"
expires: Mon, 27 Nov 2023 21:19:56 GMT
cache-control: max-age=31536000
x-proxy-cache: HIT
x-github-request-id: D232:C648:639EA:65491:65650677
via: 1.1 varnish
age: 85315
x-served-by: cache-cph2320048-CPH
x-cache: HIT
x-cache-hits: 1
x-timer: S1701513181.035930,VS0,VE1
vary: Accept-Encoding
x-fastly-request-id: a3da77acc76a98397e5df6668ea8be4ff5aa803b
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dmTMUD5SBBoNzerX8wu%2B1w8HvEQMp2zXeKKnTyWw8NA1aZSMaTFmR0ZQvRIPZJW0BTQxGcvXErgyNrZPoLjoMZXQQOFqAA11mVomZJNpf0iXDNsf0jX4k9a8tCXaifHwRyYGh%2BobnoF3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82fb0ba9ae3ebe4e-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
www.youtube.com/embed/RSq66Sr9uac
200 OK 92 kB URL GET HTTP/2 www.youtube.com/embed/RSq66Sr9uac
IP
Requested by http://164.115.43.44/hospital/web/index.php
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /embed/RSq66Sr9uac HTTP/1.1
Host: www.youtube.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 03 Dec 2023 10:14:54 GMT
strict-transport-security: max-age=31536000
content-security-policy-report-only: require-trusted-types-for 'script';report-uri /cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cross-origin-resource-policy: cross-origin
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=SycHlsfM-bw; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none
VISITOR_INFO1_LIVE=SlGp3JvfEhM; Domain=.youtube.com; Expires=Fri, 31-May-2024 10:14:54 GMT; Path=/; Secure; HttpOnly; SameSite=none
VISITOR_PRIVACY_METADATA=CgJOTxICEgA%3D; Domain=.youtube.com; Expires=Fri, 31-May-2024 10:14:54 GMT; Path=/; Secure; HttpOnly; SameSite=lax
CONSENT=PENDING+455; expires=Tue, 02-Dec-2025 10:14:54 GMT; path=/; domain=.youtube.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
164.115.43.44/hospital/web/photolibrarys/mnR8NhzpeRDHimeNVWvqyG/ed26f98cbe2775630d7917cf56099f3b.jpg
200 OK 472 kB URL GET HTTP/1.1 164.115.43.44/hospital/web/photolibrarys/mnR8NhzpeRDHimeNVWvqyG/ed26f98cbe2775630d7917cf56099f3b.jpg
IP
ASN #9835 Government Information Technology Services
Requested by http://164.115.43.44/hospital/web/index.php
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1108x1478, components 3\012- data
Size 472 kB (472302 bytes)
Hash 0c466a4813e954e8c2e5c3d869c982e7
481cddd7def57218141f3a45b0618f6c208533a9
1f9544fce7b22b5e81c350a17266590d816174beb414d2f59206370c76ba9b53
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /hospital/web/photolibrarys/mnR8NhzpeRDHimeNVWvqyG/ed26f98cbe2775630d7917cf56099f3b.jpg HTTP/1.1
Host: 164.115.43.44
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://164.115.43.44/hospital/web/index.php
Cookie: _csrf=59c9ba75e13d48edcae86179079f375494d49aab530e893b768b407cabe7f9d7a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22KHy9gvyJqH0L2voywZQBNST7mKyP__GR%22%3B%7D; cookiesession1=678B76F4BD24803B08FBD4044E164577
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 03 Dec 2023 10:14:56 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
Last-Modified: Wed, 16 Mar 2022 10:07:00 GMT
ETag: "734ee-5da531316d378"
Accept-Ranges: bytes
Content-Length: 472302
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: image/jpeg
code.ionicframework.com/ionicons/2.0.1/fonts/ionicons.ttf?v=2.0.1
200 OK 188 kB URL GET HTTP/3 code.ionicframework.com/ionicons/2.0.1/fonts/ionicons.ttf?v=2.0.1
IP
Requested by http://164.115.43.44/ita66/
Certificate IssuerCloudflare, Inc.
Subjectionicframework.com
FingerprintF0:95:87:C3:E4:A0:31:2D:83:93:BF:FD:9F:E3:6A:84:64:FB:AC:2E
ValiditySat, 01 Apr 2023 00:00:00 GMT - Sun, 31 Mar 2024 23:59:59 GMT
File type TrueType Font data, 15 tables, 1st "FFTM", 14 names, Macintosh\012- data
Size 188 kB (188508 bytes)
Hash dd4781d1acc57ba4c4808d1b44301201
956116ebe4b3a315b1a43009567e6f8ad0a9a720
5e700835ec05293a3d0f9e354e7d038319d34521cd279e782198dff6d1dd58f2
GET /ionicons/2.0.1/fonts/ionicons.ttf?v=2.0.1 HTTP/1.1
Host: code.ionicframework.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://164.115.43.44
DNT: 1
Connection: keep-alive
Referer: https://code.ionicframework.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 03 Dec 2023 10:14:57 GMT
content-type: font/ttf
last-modified: Thu, 13 Apr 2023 16:20:19 GMT
access-control-allow-origin: *
etag: W/"64382bc3-2e05c"
expires: Tue, 31 Oct 2023 01:58:07 GMT
cache-control: max-age=31536000
x-proxy-cache: MISS
x-github-request-id: 1FCE:113C:7FF887E:822A137:65405CD4
via: 1.1 varnish
x-served-by: cache-cph2320048-CPH
x-cache: HIT
x-cache-hits: 6
x-timer: S1701598497.333956,VS0,VE1
vary: Accept-Encoding
x-fastly-request-id: 4b8416006bc17c729ad5788a7a546ad6cc904625
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9PjZYABZ%2BNC%2FKw3Crlo8abM786gKJVEKR%2FAAk0bhYLTHsZoOIkuIGzSinoAmikkQiv5HOzhyGwB7lI%2BgGKamXKf7GjHYgDFm7TAfrmmRDu7KNc1qqNu8rg8aNQCJbMNZo2GaZ9Ajtbne"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82fb0bb03d25997e-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400
164.115.43.44
142.250.74.106
0.0.0.0