Report - seo.okks01.top/x5.txt

Report Overview

Visitedpublic

2025-07-20 17:00:12

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
seo.okks01.top	unknown	2025-01-09	2025-01-28	2025-04-25	930 B	8.3 kB	172.67.132.148

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-07-20	medium	seo.okks01.top/x5.txt	PHP webshell obfuscated by encoding of mixed hex and dec
2025-07-20	medium	seo.okks01.top/x5.txt	Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions.

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET seo.okks01.top/x5.txt

172.67.132.148

200 OK

6.9 kB

URL

seo.okks01.top/x5.txt

IP / ASN

172.67.132.148

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePHP script, ASCII text, with very long lines (6930), with CRLF line terminators

First Seen2025-07-20

Last Seen2025-07-20

Times Seen1

Size6.9 kB (6932 bytes)

MD5afe5c85e6a34f45ba9aab2d94ce9ad14

SHA1868853a8d57b1a49c6c44f0296fbaab46d81dbf6

SHA256e0b7a1bc2e11fa2a74ec3adac9782f632325424f20d0c10e4edd89b38ed8d127

Certificate Info

IssuerGoogle Trust Services

Subjectokks01.top

FingerprintA6:DF:21:A7:FA:59:65:09:A2:08:93:AC:9A:9C:F5:FC:CD:50:10:65

ValiditySat, 05 Jul 2025 13:30:39 GMT - Fri, 03 Oct 2025 14:28:21 GMT

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	PHP webshell obfuscated by encoding of mixed hex and dec
Public Nextron YARA rules	malware	Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions.

HTTP Headers

GET /x5.txt HTTP/1.1
Host: seo.okks01.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 20 Jul 2025 16:59:51 GMT
content-type: text/plain
server: cloudflare
last-modified: Wed, 23 Oct 2024 11:28:47 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Accept-Encoding
etag: W/"6718ddef-1b14"
content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8Jv6iaOxQjm%2Fvup6ilOsQh6ijb7IdiAypC%2BhhJ8UgGgt%2BHb9lYVqHXmKmb6%2Bm0F9CvMzs0zkbgepJv%2F6lOmbWGAec1QMOoOTudpuRg%3D%3D"}]}
cf-ray: 962402ee89375687-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET seo.okks01.top/favicon.ico

172.67.132.148

404 Not Found

146 B

URL

seo.okks01.top/favicon.ico

IP / ASN

172.67.132.148

#13335 CLOUDFLARENET

Requested byhttps://seo.okks01.top/x5.txt

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-03-07

Last Seen2025-08-02

Times Seen211002

Size146 B (146 bytes)

MD58eec510e57f5f732fd2cce73df7b73ef

SHA13c0af39ecb3753c5fee3b53d063c7286019eac3b

SHA25655f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Certificate Info

IssuerGoogle Trust Services

Subjectokks01.top

FingerprintA6:DF:21:A7:FA:59:65:09:A2:08:93:AC:9A:9C:F5:FC:CD:50:10:65

ValiditySat, 05 Jul 2025 13:30:39 GMT - Fri, 03 Oct 2025 14:28:21 GMT

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: seo.okks01.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://seo.okks01.top/x5.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Sun, 20 Jul 2025 16:59:52 GMT
content-type: text/html
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: max-age=14400
cf-cache-status: MISS
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XzhCjxb0v5Bhvub1Hxufl4CF5hUXQv9VftZyQQvUNnRco0f45Fttc93pEz%2FquFGdOc%2BGc%2F6UiyQr2lid9QjyF47sTyl3%2BqwbgOAFtw%3D%3D"}]}
content-encoding: br
cf-ray: 962402f0dd335687-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2