Report - 74.91.116.85:1337/login

Report Overview

Submitted URL
74.91.116.85:1337/login
IP
74.91.116.85
ASN
#13789 INTERNAP-BLK3
Submitted
2024-04-24 06:35:32
Access
public
Website Title
Login
Final URL
74.91.116.85:1337/login
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
74.91.116.85:1337	unknown	unknown	No data	No data	1.4 kB	8.1 kB	74.91.116.85
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-22	432 B	6.5 kB	104.17.24.14
rsms.me	102779	2010-12-05	2014-10-14	2024-04-23	415 B	6.1 kB	104.21.234.234

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	74.91.116.85	Sinkholed
2024-04-24	medium	74.91.116.85	Sinkholed
2024-04-24	medium	74.91.116.85	Sinkholed
2024-04-24	medium	74.91.116.85	Sinkholed

ThreatFox

Scan Date	Severity	Indicator	Alert
2024-04-15	medium	74.91.116.85:1337/login	Unknown malware

JavaScript (2)

	URL	Size	First Seen	Last Seen
	cdnjs.cloudflare.com/ajax/libs/animejs/2.2.0/anime.min.js	14 kB	2023-03-07	2024-05-05
Pretty URL cdnjs.cloudflare.com/ajax/libs/animejs/2.2.0/anime.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:51 Last Seen2024-05-05 18:12:53 Times Seen1582 Hash 7b7d9c2344ec7bb776c95e6d9144470f f9e83481831a2618b30e8f38471ae8d16c2a6f21 06ec6b51daffe18a33b502f14fac6674eea1490c3677a06d054635a6d78676ce Loading...

	74.91.116.85:1337/login/script.js	1.4 kB	2024-04-24	2024-04-24
Pretty URL 74.91.116.85:1337/login/script.js IP 74.91.116.85 ASN #13789 INTERNAP-BLK3 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 08:29:46 Last Seen2024-04-24 08:35:39 Times Seen4 Hash ef02febc0828525b6dd6c8da3fc736e4 5e97b42155b8b9096be8760f5d6ef11c4e4491df cd4174ba73cdfb9142b9dcd8be0b00efc5cb26107d03ee13bc09e6961b71e866 Loading...

HTTP Transactions (6)

URL IP Response Size

74.91.116.85:1337/login

74.91.116.85

2.7 kB

URL
74.91.116.85:1337/login
IP
74.91.116.85:0
ASN
#13789 INTERNAP-BLK3

File type
HTML document, ASCII text, with very long lines (334), with CRLF line terminators
Size
2.7 kB (2668 bytes)
Hash
6fac1272010eab8f06fb92b05ac864a8
c9064bc215edd315e1060cfb33bfb06f888728e3
8ee34e112c585bb39400fc9db4120ac4a1e208301052d4b566473947faa7ca7c

Detections

Analyzer	Verdict	Alert
ThreatFox	malicious	Unknown malware
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login HTTP/1.1
Host: 74.91.116.85:1337
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 06:35:07 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked

cdnjs.cloudflare.com/ajax/libs/animejs/2.2.0/anime.min.js

104.17.24.14

200 OK

5.5 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/animejs/2.2.0/anime.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
http://74.91.116.85:1337/login
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (547)
Size
5.5 kB (5533 bytes)
Hash
7b7d9c2344ec7bb776c95e6d9144470f
f9e83481831a2618b30e8f38471ae8d16c2a6f21
06ec6b51daffe18a33b502f14fac6674eea1490c3677a06d054635a6d78676ce

HTTP Headers

GET /ajax/libs/animejs/2.2.0/anime.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://74.91.116.85:1337/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 24 Apr 2024 06:35:07 GMT
content-type: application/javascript; charset=utf-8
content-length: 5533
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03d2a-3854"
last-modified: Mon, 04 May 2020 16:04:58 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 737024
expires: Mon, 14 Apr 2025 06:35:07 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lgzYA%2BNDSB19Hny9oiJab0tlshoAiOkVT%2B0RuoboJSqw4%2Fyx2HiJBIwD6Kh1OFdpy05DAv2tWEM0DE4ctsyHlukf%2Bl7EesJK94uWgQBSPGEQESr2gTA0qtuR6F4gzd6BfB8Xvj02"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8794124e08a4b529-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

74.91.116.85:1337/login/styles.css

74.91.116.85

200 OK

3.4 kB

URL GET HTTP/1.1
74.91.116.85:1337/login/styles.css
IP
74.91.116.85:1337
ASN
#13789 INTERNAP-BLK3

Requested by
http://74.91.116.85:1337/login

File type
ASCII text, with CRLF line terminators
Size
3.4 kB (3423 bytes)
Hash
53074263554578711bd432bb6d9a9e06
47be01d6db4bf645644ad1d50eb91400e07069f8
f112820b7ea1918550230cf8a9dd4ade03475cfba9731ff0b89a0d8d4865e97d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login/styles.css HTTP/1.1
Host: 74.91.116.85:1337
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://74.91.116.85:1337/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 3423
Content-Type: text/css; charset=utf-8
Last-Modified: Fri, 16 Feb 2024 05:02:57 GMT
Date: Wed, 24 Apr 2024 06:35:07 GMT

74.91.116.85:1337/login/script.js

74.91.116.85

200 OK

1.4 kB

URL GET HTTP/1.1
74.91.116.85:1337/login/script.js
IP
74.91.116.85:1337
ASN
#13789 INTERNAP-BLK3

Requested by
http://74.91.116.85:1337/login

File type
ASCII text, with CRLF line terminators
Size
1.4 kB (1364 bytes)
Hash
ef02febc0828525b6dd6c8da3fc736e4
5e97b42155b8b9096be8760f5d6ef11c4e4491df
cd4174ba73cdfb9142b9dcd8be0b00efc5cb26107d03ee13bc09e6961b71e866

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login/script.js HTTP/1.1
Host: 74.91.116.85:1337
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://74.91.116.85:1337/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 1364
Content-Type: application/javascript
Last-Modified: Fri, 16 Feb 2024 05:02:57 GMT
Date: Wed, 24 Apr 2024 06:35:07 GMT

rsms.me/inter/inter-ui.css

104.21.234.234

404 Not Found

5.1 kB

URL GET HTTP/2
rsms.me/inter/inter-ui.css
IP
104.21.234.234:443
ASN
#13335 CLOUDFLARENET

Requested by
http://74.91.116.85:1337/login
Certificate
IssuerLet's Encrypt
Subjectrsms.me
Fingerprint6C:46:89:5E:85:32:C8:EF:9E:7B:DE:40:06:38:8C:D7:84:04:DA:C8
ValidityMon, 26 Feb 2024 08:01:03 GMT - Sun, 26 May 2024 08:01:02 GMT

File type
HTML document, ASCII text, with very long lines (3909)
Size
5.1 kB (5107 bytes)
Hash
c1f9838a645648cb3b25359f7890a288
0cf12d25140e329bcb4c304feefce63f8f0ba7b3
b620507312c5e97566a3c6cfaf99144fefc18a0da7d941401dfa0f5f58fb0368

HTTP Headers

GET /inter/inter-ui.css HTTP/1.1
Host: rsms.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://74.91.116.85:1337/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Wed, 24 Apr 2024 06:35:08 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'
x-proxy-cache: MISS
x-github-request-id: 8C90:0E6F:300A1E:31388C:6628A19D
age: 170
via: 1.1 varnish
x-served-by: cache-hel1410027-HEL
x-cache: HIT
x-cache-hits: 0
x-timer: S1713940339.732498,VS0,VE2
vary: Accept-Encoding
x-fastly-request-id: 2038dffeed947f2f77e2a15d6950d3b434f654fc
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z1pjf8sVWEnuGGtnvpwHYF%2BzGGdbCiZcDjegaim4%2F1eU6dwAntGtUDk%2FmVQrDSGNTH%2BlEkQ2cSBwVEidIPSJnS%2BPc6tqJGWoWc4CVbxzp6RAFqaoJ%2Fg1cFtW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8794124f687e8d9e-HEL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

74.91.116.85:1337/favicon.ico

74.91.116.85

404 Not Found

19 B

URL GET HTTP/1.1
74.91.116.85:1337/favicon.ico
IP
74.91.116.85:1337
ASN
#13789 INTERNAP-BLK3

Requested by
http://74.91.116.85:1337/login

File type
ASCII text, with no line terminators
Size
19 B (19 bytes)
Hash
f59690a90eae5c14a87521d70441bf83
253944e2769a927cdb522a8ca0fa9da5028729bb
77ef0c0b261a6ce967e3f335a86c939f9d88a25dabec86f0b19993a438b9d081

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 74.91.116.85:1337
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://74.91.116.85:1337/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Wed, 24 Apr 2024 06:35:08 GMT
Content-Length: 19

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (6)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by