| 109.120.176.38/ |  109.120.176.38 | | 553 B |
IP109.120.176.38:0
File typeHTML document, ASCII text Hashc20f081cfd4ae3c09ed4f39e96574cc5 9d9187d5eae5403704acf6e461031871c72adfa2 a093a54f20ae311492d2a6d9a7a52b2d414a3aef8c3e097aa447b2fc29853ab1
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: text/html; charset=utf-8
content-length: 553
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:39 GMT
etag: "1711657042.293175-553-1653479826"
date: Wed, 17 Apr 2024 05:32:39 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/auth/login | 109.120.176.38 | | 553 B |
URL User Request GET 109.120.176.38/auth/login IP109.120.176.38:0
File typeHTML document, ASCII text Hashc20f081cfd4ae3c09ed4f39e96574cc5 9d9187d5eae5403704acf6e461031871c72adfa2 a093a54f20ae311492d2a6d9a7a52b2d414a3aef8c3e097aa447b2fc29853ab1
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /auth/login HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: text/html; charset=utf-8
content-length: 553
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:39 GMT
etag: "1711657042.293175-553-1653479826"
date: Wed, 17 Apr 2024 05:32:39 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/index-HspOw4wU.css | 109.120.176.38 | 200 | 54 kB |
URL GET HTTP/1.1109.120.176.38/assets/index-HspOw4wU.css IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typeUnicode text, UTF-8 text, with very long lines (53920) Hashb22f1ffdf9960ac5c4eed56e44b08b54 9a350008c2853bd861cea43ef4ce1161069fc1de afd42b96efa1352bba1919367f310ce347dac97743f5380659c144e378d72879
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/index-HspOw4wU.css HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/auth/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: text/css; charset=utf-8
content-length: 53925
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:40 GMT
etag: "1711657042.293175-53925-289873715"
date: Wed, 17 Apr 2024 05:32:40 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/logo-ovWOqCdT.svg | 109.120.176.38 | 200 | 33 kB |
URL GET HTTP/1.1109.120.176.38/assets/logo-ovWOqCdT.svg IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typeSVG Scalable Vector Graphics image Hashe7a2bb050f7ec5ec2ba405400170a27d e8885544bc4907c65b2479b8a5db4d3acd0cc6b6 5c8b3ffa823046dcd23e2336195218e3ddf2823c1fe2252c4e5fa618413f5b84
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/logo-ovWOqCdT.svg HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/auth/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: image/svg+xml; charset=utf-8
content-length: 33277
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:41 GMT
etag: "1711657042.280174-33277-4066713305"
date: Wed, 17 Apr 2024 05:32:41 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/index-OsUc58zP.js | 109.120.176.38 | 200 | 2.4 MB |
URL GET HTTP/1.1109.120.176.38/assets/index-OsUc58zP.js IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typeJavaScript source, ASCII text, with very long lines (31989) Size2.4 MB (2435734 bytes) Hash83c2b2c20c28aaf35df2b9e94af1b0ba b69ae1820fad9e3a27625c550ea286e4ba456163 0125efde4bb83a58a67249bbe5e8c2db7ec26a1d6a85d3c421fdaf2d8eccad8f
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/index-OsUc58zP.js HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/auth/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: application/javascript; charset=utf-8
content-length: 2435734
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:40 GMT
etag: "1711657042.294174-2435734-4031913607"
date: Wed, 17 Apr 2024 05:32:40 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/api/logs | 109.120.176.38 | | 0 B |
IP109.120.176.38:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /api/logs HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://109.120.176.38
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: MEKhJDwdAekQ6+ZDV+5gHg==
DNT: 1
Connection: keep-alive, Upgrade
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101
sec-websocket-extensions: permessage-deflate
sec-websocket-accept: 2FB12OflPVaFZKFrfdmJOwLG/oo=
upgrade: WebSocket
connection: Upgrade
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/snake-lPgznXqp.png | 109.120.176.38 | 200 | 117 kB |
URL GET HTTP/1.1109.120.176.38/assets/snake-lPgznXqp.png IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typePNG image data, 295 x 648, 8-bit/color RGBA, non-interlaced Size117 kB (117220 bytes) Hash005a687909b2cd3b0dc757e696aedfd3 aa660a658a30e72a1b1ad0ebfb16d7a22689348e 86a203c0bec9406ec46d264ecd99a2283c4ced726cccf548b64378784626f944
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/snake-lPgznXqp.png HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/assets/index-HspOw4wU.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: image/png
content-length: 117220
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:43 GMT
etag: "1711657042.282174-117220-328933244"
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/profile-bXjbzb05.png | 109.120.176.38 | 200 | 19 kB |
URL GET HTTP/1.1109.120.176.38/assets/profile-bXjbzb05.png IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typePNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced Hash54bbebbfeb771dd609ff329099704a6a 25d25b6c2d677ca36af3d6e52e04dab752775482 4ffe10c03698b7a8c507479d78e19578610b418c76367f44c19adcb7e204a573
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/profile-bXjbzb05.png HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/assets/index-HspOw4wU.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: image/png
content-length: 18573
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:43 GMT
etag: "1711657042.282174-18573-1387995102"
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/ds-greece-eWgboWnd.ttf | 109.120.176.38 | 200 | 56 kB |
URL GET HTTP/1.1109.120.176.38/assets/ds-greece-eWgboWnd.ttf IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typeTrueType Font data, 17 tables, 1st "LTSH", 24 names, Macintosh, Copyright (c) Dubina Nikolay / D-Studio (Moscow), 2000. All rights reserved.DS GreeceRegularDubi Hash0bb345c489b1d09a276d8ae1409fe28f e5a9d7c89f7acc9a322dba8dc66b1425d8f2b481 0695b533e71e5bfb83a90e99545c83c2019395dc21b22846a485b7ec878371bd
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/ds-greece-eWgboWnd.ttf HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/assets/index-HspOw4wU.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: application/octet-stream
content-length: 55740
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:43 GMT
etag: "1711657042.282174-55740-2431328443"
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/Comfortaa-VariableFont_wght-R_5AX4pn.ttf | 109.120.176.38 | 200 | 203 kB |
URL GET HTTP/1.1109.120.176.38/assets/Comfortaa-VariableFont_wght-R_5AX4pn.ttf IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typeTrueType Font data, 20 tables, 1st "GDEF", 25 names, Microsoft, language 0x409 Size203 kB (203040 bytes) Hashb14da82fd326fb23ada0b4df443cda25 89d13684a897ae7ca4dae157eb05000db6b3e6c8 b9281be276c9f683947bb52f44f30d27dccc94e578ecec5e33c0883f01c57063
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/Comfortaa-VariableFont_wght-R_5AX4pn.ttf HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/assets/index-HspOw4wU.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: application/octet-stream
content-length: 203040
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:43 GMT
etag: "1711657042.282174-203040-601761631"
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/assets/Meduza-Xf1ectds.png | 109.120.176.38 | 200 | 583 kB |
URL GET HTTP/1.1109.120.176.38/assets/Meduza-Xf1ectds.png IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
File typePNG image data, 660 x 720, 8-bit/color RGBA, non-interlaced Size583 kB (582902 bytes) Hash7264fd364f9dff44e65dacf23348a29e b85bf9e7d40d3ea131081854ddb86603b89d9ffb ca6bbc108872be8f8954aa0aff4e488a62ddc97ac1675ca6ec2ef460f3a256de
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /assets/Meduza-Xf1ectds.png HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://109.120.176.38/assets/index-HspOw4wU.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
content-type: image/png
content-length: 582902
last-modified: Thu, 28 Mar 2024 20:17:22 GMT
cache-control: public, max-age=43200
expires: Wed, 17 Apr 2024 17:32:43 GMT
etag: "1711657042.293175-582902-795942798"
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|
| 109.120.176.38/api/logs | 109.120.176.38 | 101 | 0 B |
IP109.120.176.38:80
Requested byhttp://109.120.176.38/auth/login
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Meduza Stealer | | Quad9 DNS | malicious | Sinkholed |
GET /api/logs HTTP/1.1
Host: 109.120.176.38
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://109.120.176.38
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: MEKhJDwdAekQ6+ZDV+5gHg==
DNT: 1
Connection: keep-alive, Upgrade
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101
sec-websocket-extensions: permessage-deflate
sec-websocket-accept: 2FB12OflPVaFZKFrfdmJOwLG/oo=
upgrade: WebSocket
connection: Upgrade
date: Wed, 17 Apr 2024 05:32:43 GMT
server: hypercorn-h11
|
|