| 216.48.180.127/mtech/isport/adpromo.php?v_id=1&clickid=662963d24fb5290001d8f41c../isport/index.php../isport/index.php |  216.48.180.127 | | 1.3 kB |
URL 216.48.180.127/mtech/isport/adpromo.php?v_id=1&clickid=662963d24fb5290001d8f41c../isport/index.php../isport/index.php IP216.48.180.127:0 ASN#132420 282, Sector 19
File typeHTML document, ASCII text Hash8a05c8f857e3a8bd17e93033d45ed4f7 4ce11c5191cf7ce7f468760de0222e34e76914fd 11b5225ac3a149163346a0b6a0c48f2ffdfc78d476ef7ea21a1c62ebb1ca3296
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/adpromo.php?v_id=1&clickid=662963d24fb5290001d8f41c../isport/index.php../isport/index.php HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Wed, 24 Apr 2024 19:56:26 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
X-Powered-By: PHP/7.3.33
Set-Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: ../isport/index.php
Content-Length: 1304
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| 216.48.180.127/mtech/isport/index.php | 216.48.180.127 | | 912 B |
URL 216.48.180.127/mtech/isport/index.php IP216.48.180.127:0 ASN#132420 282, Sector 19
File typeJavaScript source, ASCII text Hash44995766c68f32ec9ea169f4ddda7c03 34a2f16d9a9e55c19af12ed0c6161e09fa2348be 5a215ae19a8819546f3fbdb3ee68d58bb9efa6b29a3342c1f368be10f92ff1d9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/index.php HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:27 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
X-Powered-By: PHP/7.3.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 912
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| ajax.googleapis.com/ajax/libs/jquery/3.6.3/jquery.min.js |  216.58.207.202 | | 31 kB |
URL ajax.googleapis.com/ajax/libs/jquery/3.6.3/jquery.min.js IP216.58.207.202:0
File typeJavaScript source, ASCII text, with very long lines (65447) Hashcf2fbbf84281d9ecbffb4993203d543b 832a6a4e86daf38b1975d705c5de5d9e5f5844bc a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
GET /ajax/libs/jquery/3.6.3/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31191
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 05:54:14 GMT
expires: Wed, 23 Apr 2025 05:54:14 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 136933
last-modified: Wed, 11 Jan 2023 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 52.23.120.149/mobilehook/he/ | 52.23.120.149 | | 32 B |
URL 52.23.120.149/mobilehook/he/ IP52.23.120.149:0
Hash1f818133010ca388c9e65066967850f8 50df934049ec21f3b8e7c73d110276dbb7e8f540 59c7df85f809500d70e7aa8f5830cf7cdbd4c1500427117683b59b1898398f7b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mobilehook/he/ HTTP/1.1
Host: 52.23.120.149
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://216.48.180.127
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.8.0
Date: Wed, 24 Apr 2024 19:56:28 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.2.24
Access-Control-Allow-Origin: *
|
|
| 216.48.180.127/mtech/isport/getnumber.php | 216.48.180.127 | 200 OK | 7.5 kB |
URL User Request GET HTTP/1.1216.48.180.127/mtech/isport/getnumber.php IP216.48.180.127:80 ASN#132420 282, Sector 19
File typeJavaScript source, Unicode text, UTF-8 text Hash290b49850c719e1309cc24b71db7fe95 c633040b0b103a42c76068a0d30d237fe5db1ea5 de516982769d411bacfacd1f81baafb52ac43c04bdb482318fe823d0b5b605dd
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/getnumber.php HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://216.48.180.127/mtech/isport/index.php
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
X-Powered-By: PHP/7.3.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 7454
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| fonts.googleapis.com/css?family=Rajdhani:400,300,500,600,700 | 142.250.74.74 | 200 OK | 537 B |
URL GET HTTP/1.1fonts.googleapis.com/css?family=Rajdhani:400,300,500,600,700 IP142.250.74.74:80
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
Hasha4e66b6d4d703e6e460019cc63794c15 fa4b823a508b7137eebc192df6598ffc32e98267 d8fcbc87d388619aacb6b1016b2f09423686a31d0bfab9a6dd3d4f8a31801797
GET /css?family=Rajdhani:400,300,500,600,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Wed, 24 Apr 2024 19:56:29 GMT
Date: Wed, 24 Apr 2024 19:56:29 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
|
|
| fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic | 142.250.74.74 | 200 OK | 2.3 kB |
URL GET HTTP/1.1fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic IP142.250.74.74:80
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeASCII text, with very long lines (1572) Hash175ec1a2a700f7f89f8239be9a511290 1aad0ecdfcb3b9f5525e4232fad274d2ee4d0797 d6abeeec8987657db6240c3f23d932481ea04f606a923d19e45cbc91b4569599
GET /css?family=Open+Sans:400,300,300italic,400italic,600,600italic,700,700italic,800,800italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Wed, 24 Apr 2024 19:56:29 GMT
Date: Wed, 24 Apr 2024 19:56:29 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin-allow-popups
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
|
|
| 216.48.180.127/mtech/isport/css/font-awesome.min.css | 216.48.180.127 | 200 OK | 28 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/css/font-awesome.min.css IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeASCII text, with very long lines (27303) Hash4fbd15cb6047af93373f4f895639c8bf 12d6861075de8e293265ff6ff03b1f3adcb44c76 ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/css/font-awesome.min.css HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:55 GMT
ETag: "6b4a-5fc6b0d277f24"
Accept-Ranges: bytes
Content-Length: 27466
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
|
|
| 216.48.180.127/mtech/isport/js/Chart.js | 216.48.180.127 | 404 Not Found | 222 B |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/Chart.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeHTML document, ASCII text Hashd2850c7c1905bc1d9c0822f598e50ab5 adbed83f754f4712e97cc586e02f0d24245649d7 35d7cc9254cbad0138e614650e90a9a87d576404304f8e0b69e153de92fae6ad
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/Chart.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Content-Length: 222
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 216.48.180.127/mtech/isport/css/jquery-ui.css | 216.48.180.127 | 200 OK | 31 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/css/jquery-ui.css IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeASCII text, with very long lines (544) Hashc80bce83e56fa3da57c2ccdc861c2f15 799220f1305922239ef6cd46069d35fe09568411 238943fbb10e3b682852275fd5874f41160b68717f54e23624333b86ded6ffaa
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/css/jquery-ui.css HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:55 GMT
ETag: "7a5c-5fc6b0d27830c"
Accept-Ranges: bytes
Content-Length: 31324
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
|
|
| 216.48.180.127/mtech/isport/css/style.css | 216.48.180.127 | 200 OK | 35 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/css/style.css IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeassembler source, ASCII text Hashd2f7100cdb6121953643b1d0ddedff47 7bdd311fff20960100203003d439435699838bc0 35d22438bbc8b24551f32efd5e1582ccad4d18a3ba7ae9363ca3c2e67174d479
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/css/style.css HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:55 GMT
ETag: "88fd-5fc6b0d27830c"
Accept-Ranges: bytes
Content-Length: 35069
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
|
|
| 216.48.180.127/mtech/isport/js/bootstrap.min.js | 216.48.180.127 | 200 OK | 36 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/bootstrap.min.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with very long lines (32025) Hash8c237312864d2e4c4f03544cd4f9b195 253711c6d825de55a8360552573be950da180614 d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/bootstrap.min.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "8c6f-5fc6b0d32f123"
Accept-Ranges: bytes
Content-Length: 35951
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/js/jquery-2.1.4.min.js | 216.48.180.127 | 200 OK | 84 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/jquery-2.1.4.min.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with very long lines (32025) Hashf9c7afd05729f10f55b689f36bb20172 43dc554608df885a59ddeece1598c6ace434d747 f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/jquery-2.1.4.min.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "14979-5fc6b0d32fcdc"
Accept-Ranges: bytes
Content-Length: 84345
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/js/bigSlide.js | 216.48.180.127 | 200 OK | 6.9 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/bigSlide.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text Hashd57b6adb70ac99a1bd846414e152a24b 7283e447019257758fe37af42737a7e9d22354a1 ae5bff5b333e0ddfb0d6c8b9a98224a34bf7137f7ae5e238c4b174772dce3e1a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/bigSlide.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "1b01-5fc6b0d32ed3b"
Accept-Ranges: bytes
Content-Length: 6913
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/js/move-top.js | 216.48.180.127 | 200 OK | 1.3 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/move-top.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with very long lines (1091) Hash0ca97ca5c84470b7cafef45dec8b3fdf 93b215e6e38d0e529066afe70919c24c2a298359 71fd00a24dd9afa4ca22f2c8713cf7b4c22dd71ce29e19326597cd6859350930
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/move-top.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "532-5fc6b0d3300c4"
Accept-Ranges: bytes
Content-Length: 1330
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/js/easing.js | 216.48.180.127 | 200 OK | 4.8 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/easing.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
Hash6ee8b009ab1e71a1380c69e81339f4c5 aa9cdef82dcddebe9a7fb2f65ea38bbf70fddf60 6c26533254dc21fba188b69b81300ecd94c1bef2dda72b9dbb750111973ed31b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/easing.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "1297-5fc6b0d32f50b"
Accept-Ranges: bytes
Content-Length: 4759
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/css/bootstrap.min.css | 216.48.180.127 | 200 OK | 144 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/css/bootstrap.min.css IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeASCII text, with very long lines (377) Size144 kB (144101 bytes) Hashdfcb593396499cc5416b099b5dc7fd5d b2540d57768363f757649cfea04daaaf3825e544 98fd1ab74b6b8de547afb05092865e6a288ede3cde12bce5fc843f736d3d4d1f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/css/bootstrap.min.css HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:55 GMT
ETag: "232e5-5fc6b0d277f24"
Accept-Ranges: bytes
Content-Length: 144101
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
|
|
| 216.48.180.127/mtech/isport/js/jquery.nicescroll.js | 216.48.180.127 | 200 OK | 59 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/jquery.nicescroll.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with very long lines (1025) Hashc9844213bc1d3c39dc674b8b5c8b6651 39276c585e597a1a14500bf1dd98ffafe19c1eba bf74a158de705b69d257c2dd77a67b240950ff88dd563b0e8455126b404b6221
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/jquery.nicescroll.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "e7e4-5fc6b0d3300c4"
Accept-Ranges: bytes
Content-Length: 59364
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/js/scripts.js | 216.48.180.127 | 200 OK | 656 B |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/scripts.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text Hash0a36be50db2ed0f65079c89369695ef7 a15cf05718e2ed1024a2ee6c51b0c8cf77b9dbaf 893d9df12f3a181f5233d12ba3fb8d9e8e7552f4cf8fb08d895cc702f27f5d00
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/scripts.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "290-5fc6b0d331064"
Accept-Ranges: bytes
Content-Length: 656
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/html5.7gportals.com_files/css3-animate-it.js.download | 216.48.180.127 | 200 OK | 17 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/html5.7gportals.com_files/css3-animate-it.js.download IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with CRLF line terminators Hashf8c4d2c145f88b13777269be8ce8ce12 afdf210120f8492394d7665d9451d5037b6a291b 0051ea77a718b7f658a54a0f572989d43afb8cc8ab8eb769eee38e48573d79f4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/html5.7gportals.com_files/css3-animate-it.js.download HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "42d2-5fc6b0d2c4dbd"
Accept-Ranges: bytes
Content-Length: 17106
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/html5.7gportals.com_files/app.js.download | 216.48.180.127 | 200 OK | 205 B |
URL GET HTTP/1.1216.48.180.127/mtech/isport/html5.7gportals.com_files/app.js.download IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with CRLF line terminators Hashef959820ba4e1c4300333015e3cb4194 192cc2d690fb1825771c361fe47a97dfb092c050 5b950ddd4efef061a5c2a20980295153f8a9fc4167924574b319aaff18f251e2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/html5.7gportals.com_files/app.js.download HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "cd-5fc6b0d2c45ed"
Accept-Ranges: bytes
Content-Length: 205
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 216.48.180.127/mtech/isport/js/Chart.js | 216.48.180.127 | 404 Not Found | 222 B |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/Chart.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeHTML document, ASCII text Hashd2850c7c1905bc1d9c0822f598e50ab5 adbed83f754f4712e97cc586e02f0d24245649d7 35d7cc9254cbad0138e614650e90a9a87d576404304f8e0b69e153de92fae6ad
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/Chart.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Content-Length: 222
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| 216.48.180.127/mtech/isport/js/jquery-ui.js | 216.48.180.127 | 200 OK | 450 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/js/jquery-ui.js IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJavaScript source, ASCII text, with very long lines (840) Size450 kB (450163 bytes) Hashd843cc8006d8999a4bcbf62fee6233d3 253aae035400f57bd9993864b3d3c1f7ba97d60f 3ec07ee5912c0650f1f458bf1977356d9982ef0110cd92b86ccfd5c0d9b52fa7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/js/jquery-ui.js HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:30 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "6de73-5fc6b0d330c7c"
Accept-Ranges: bytes
Content-Length: 450163
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| fonts.gstatic.com/s/rajdhani/v15/LDI2apCSOBg7S-QT7pb0EPOreec.woff2 | 216.58.207.227 | 200 OK | 15 kB |
URL GET HTTP/1.1fonts.gstatic.com/s/rajdhani/v15/LDI2apCSOBg7S-QT7pb0EPOreec.woff2 IP216.58.207.227:80
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeWeb Open Font Format (Version 2), TrueType, length 15084, version 1.0 Hash98d75ef6878aa0544049b77bed867541 e7d0d08b1ced5e6c424aa7efb0ea5c11276e4cf5 23afdb9b5b89b878fab04d80cc30bf41bb4f3f7e8be88e5f16a7cc7671cdb2dc
GET /s/rajdhani/v15/LDI2apCSOBg7S-QT7pb0EPOreec.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://216.48.180.127
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15084
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 23 Apr 2024 08:47:07 GMT
Expires: Wed, 23 Apr 2025 08:47:07 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 27 Apr 2022 15:47:20 GMT
Content-Type: font/woff2
Age: 126564
|
|
| fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 | 216.58.207.227 | 200 OK | 48 kB |
URL GET HTTP/1.1fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 IP216.58.207.227:80
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeWeb Open Font Format (Version 2), TrueType, length 48236, version 1.0 Hash015c126a3520c9a8f6a27979d0266e96 2acf956561d44434a6d84204670cf849d3215d5f 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://216.48.180.127
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 48236
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 18 Apr 2024 02:53:24 GMT
Expires: Fri, 18 Apr 2025 02:53:24 GMT
Cache-Control: public, max-age=31536000
Age: 579787
Last-Modified: Thu, 14 Dec 2023 02:08:40 GMT
Content-Type: font/woff2
|
|
| fonts.gstatic.com/s/rajdhani/v15/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/1.1fonts.gstatic.com/s/rajdhani/v15/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 IP216.58.207.227:80
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeWeb Open Font Format (Version 2), TrueType, length 15732, version 1.0 Hashad9c55ecf03998391f7149c29543452a dcd4cf87ae721dd01a6ee29be033c7d70f9c198d 433a7007e4747a02a790167a6efa2625855f013970ba49b9b739a5d3db8b2601
GET /s/rajdhani/v15/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://216.48.180.127
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15732
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sun, 21 Apr 2024 20:38:01 GMT
Expires: Mon, 21 Apr 2025 20:38:01 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 27 Apr 2022 16:21:09 GMT
Content-Type: font/woff2
Age: 256710
|
|
| 216.48.180.127/mtech/isport/images/gamesbanner2.jpg | 216.48.180.127 | 200 OK | 256 kB |
URL GET HTTP/1.1216.48.180.127/mtech/isport/images/gamesbanner2.jpg IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe Photoshop CC 2015 (Windows), datetime=2018-04-26T17:50:19+05:30], baseline, precision 8, 890x500, components 3 Size256 kB (256005 bytes) Hash60c1f135c8fd38dd055f2e00871746d9 74c93b54680b7b27976f8038587b10c5bdd4d3e5 5ae31583199d511fde5904a0c1f1c9a153e4c2865249881b478e88af28593443
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mtech/isport/images/gamesbanner2.jpg HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 19:56:31 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Last-Modified: Wed, 24 May 2023 06:59:56 GMT
ETag: "3e805-5fc6b0d32aad1"
Accept-Ranges: bytes
Content-Length: 256005
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/jpeg
|
|
| 216.48.180.127/favicon.ico | 216.48.180.127 | 404 Not Found | 209 B |
URL GET HTTP/1.1216.48.180.127/favicon.ico IP216.48.180.127:80 ASN#132420 282, Sector 19
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php
File typeHTML document, ASCII text Hash18ffb59b61525f781cf9251045be575d bd7318b00b15b7a1c8a48524419fa2e5c27a5b6d b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 216.48.180.127
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/mtech/isport/getnumber.php
Cookie: PHPSESSID=uo5pv7efjcup8f4tqu3p0tt4ec
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 19:56:31 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.3.33
Content-Length: 209
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| fonts.googleapis.com/css?family=Bitter | 142.250.74.74 | 200 OK | 1.7 kB |
URL GET HTTP/2fonts.googleapis.com/css?family=Bitter IP142.250.74.74:443
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2 ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT
File typeASCII text, with very long lines (1780), with no line terminators Hash2a186e6fb707da95842e5ed42da834f1 28492d3b23c360c9bbe39ddb79e5cb81095f42f6 b71382939ee98e6ae640bce8f4283e5491d7dc105a465551ed5d300b6293042e
GET /css?family=Bitter HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 24 Apr 2024 19:56:29 GMT
date: Wed, 24 Apr 2024 19:56:29 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Rajdhani | 142.250.74.74 | 200 OK | 1.1 kB |
URL GET HTTP/2fonts.googleapis.com/css?family=Rajdhani IP142.250.74.74:443
Requested byhttp://216.48.180.127/mtech/isport/getnumber.php CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2 ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT
File typeASCII text, with very long lines (1101), with no line terminators Hash108b15fa2f13cf19879bd0b549391fdf 71951bc7db5b8117516768318d74bdf5be1533fb 966720d8153a35ee63f322024a587ea3448d93db65d2e384c2229c87aff5a3d3
GET /css?family=Rajdhani HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://216.48.180.127/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 24 Apr 2024 19:56:29 GMT
date: Wed, 24 Apr 2024 19:56:29 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|