| GET xtv.ooo:8080/sanushop/12345678/384011 |  172.67.70.208 | 302 Found | 0 B |
URL User Request GET HTTP/1.1xtv.ooo:8080/sanushop/12345678/384011 IP172.67.70.208:8080
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sanushop/12345678/384011 HTTP/1.1
Host: xtv.ooo:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Wed, 11 Dec 2024 23:52:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Location: http://95.214.234.140:8080/live/play/TWpnd2NXSnlVRlZIVlZoWGVXRTRjbXBoWkVjemNHRXdTM2hCTkN0WmVGZE1WV3gyUnpOd1ltSXZPRDA9/384011
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VfcdMUeDjkl0LBemOAiYkyJgWNHtJh6NWbNoXMJKD9ULIFxG76KFfETge7%2Fe2F3jJYkoQFcAxZNP47tbMnGZpOB1zb%2B8XYf9vxbkjVKGbPglPLLZ2Xmjm8jbf6Fy6A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8f09630bf90956bf-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=453&min_rtt=453&rtt_var=226&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=409&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
| GET 95.214.234.140:8080/live/play/TWpnd2NXSnlVRlZIVlZoWGVXRTRjbXBoWkVjemNHRXdTM2hCTkN0WmVGZE1WV3gyUnpOd1ltSXZPRDA9/384011 |  95.214.234.140 | 200 OK | 6.5 MB |
URL User Request GET HTTP/1.195.214.234.140:8080/live/play/TWpnd2NXSnlVRlZIVlZoWGVXRTRjbXBoWkVjemNHRXdTM2hCTkN0WmVGZE1WV3gyUnpOd1ltSXZPRDA9/384011 IP95.214.234.140:8080 ASN#30860 Virtual Systems LLC
Size6.5 MB (6489428 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /live/play/TWpnd2NXSnlVRlZIVlZoWGVXRTRjbXBoWkVjemNHRXdTM2hCTkN0WmVGZE1WV3gyUnpOd1ltSXZPRDA9/384011 HTTP/1.1
Host: 95.214.234.140:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 11 Dec 2024 23:52:11 GMT
Content-Type: video/mp2t
Connection: close
Access-Control-Allow-Origin: *
|
172.67.70.208