Report - 18.236.82.135:22533/login/

Report Overview

Submitted URL
18.236.82.135:22533/login/
IP
18.236.82.135
ASN
#16509 AMAZON-02
Submitted
2024-04-23 06:34:22
Access
public
Website Title
L3MON Manager
Final URL
18.236.82.135:22533/login/
Tags
botpanel malware
urlquery detections
Malware - Botnet panel

Detections

urlquery
21
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
18.236.82.135:22533	unknown	unknown	No data	No data	4.1 kB	1.1 MB	18.236.82.135
www.googletagmanager.com	75	2011-11-11	2013-05-22	2024-04-22	425 B	93 kB	142.250.74.168
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-23	468 B	25 kB	142.250.74.106
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-22	1.0 kB	48 kB	216.58.207.227

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	18.236.82.135:22533/js/semantic.min.js	276 kB	2023-03-08	2024-05-01
Pretty URL 18.236.82.135:22533/js/semantic.min.js IP 18.236.82.135 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 00:37:18 Last Seen2024-05-01 13:46:25 Times Seen144 Hash 5e7273015cebd8d647f801625b68783c 3d1f50123702e8d7353d98f04b5d819ed50be836 0a04a8582f70e7036623568df1d20c2bee833de95412dbc3afe05cda6ff4371f Loading...

	18.236.82.135:22533/js/snackbar.min.js	3.4 kB	2023-03-07	2024-04-29
Pretty URL 18.236.82.135:22533/js/snackbar.min.js IP 18.236.82.135 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:45 Last Seen2024-04-29 18:12:18 Times Seen121 Hash 3331bae64bb768b66ff42d3cdf84b9d4 310c07435fb42b09af3ffe6fa2a86c8dcf3037ea 8394b5e437c5fd4a50d0c3ce8fa00a062859959b041c2feabd96c7848d65a1a3 Loading...

	18.236.82.135:22533/js/main.js	1.2 kB	2023-05-10	2024-04-29
Pretty URL 18.236.82.135:22533/js/main.js IP 18.236.82.135 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-10 11:06:04 Last Seen2024-04-29 18:12:18 Times Seen37 Hash 6c3dc22930cc1ef3dc4b5dfbf2dffaad 627bdeb526a505cb45cea6e507466f79b6e8c838 75bea9d908ddb42abc52f07b0b0102df35d646ebe989d7d228a6e2f5216f2bb1 Loading...

	18.236.82.135:22533/login/	0 B	2023-03-07	2024-05-03
Pretty URL 18.236.82.135:22533/login/ IP 18.236.82.135 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-03 21:32:54 Times Seen37315883 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	18.236.82.135:22533/login/	0 B	2023-03-07	2024-05-03
Pretty URL 18.236.82.135:22533/login/ IP 18.236.82.135 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-03 21:32:54 Times Seen37315883 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	www.googletagmanager.com/gtag/js?id=G-W6SP16VJD5	266 kB	2024-04-23	2024-04-23
Pretty URL www.googletagmanager.com/gtag/js?id=G-W6SP16VJD5 IP 142.250.74.168 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-23 08:34:28 Last Seen2024-04-23 08:34:28 Times Seen2 Hash e7424ed3a21e31917e6cf077364a6464 204eb39640bef694c97bc40808c979144d801d25 aad434bc5c0bbd618a055589064e8d5038603f7dcbb69f8aadf44c8ef1db553c Loading...

	18.236.82.135:22533/js/jquery-3.4.1.min.js	88 kB	2023-03-07	2024-05-03
Pretty URL 18.236.82.135:22533/js/jquery-3.4.1.min.js IP 18.236.82.135 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-05-03 21:27:40 Times Seen96800 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

HTTP Transactions (15)

URL IP Response Size

18.236.82.135:22533/login/

18.236.82.135

200 OK

3.8 kB

URL User Request GET HTTP/1.1
18.236.82.135:22533/login/
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

File type
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
3.8 kB (3815 bytes)
Hash
c8c28a5e74b8eda62974098361bd42a6
2f127b5661451de77aa0708c265aa2f97a76152e
20541ee95d4907fa3558f427286edae24fd42a752dbfe8dfa640c9037fd3b770

HTTP Headers

GET /login/ HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 3815
ETag: W/"ee7-LxJ7VmFFHed6oHCMJlqi+Xp2FS4"
Date: Tue, 23 Apr 2024 06:36:51 GMT
Connection: keep-alive

www.googletagmanager.com/gtag/js?id=G-W6SP16VJD5

142.250.74.168

200 OK

93 kB

URL GET HTTP/2
www.googletagmanager.com/gtag/js?id=G-W6SP16VJD5
IP
142.250.74.168:443
ASN
#15169 GOOGLE

Requested by
http://18.236.82.135:22533/login/
Certificate
IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint1E:33:2E:4B:C3:51:05:B7:73:DC:21:BF:3E:02:B3:16:D8:0B:AB:BB
ValidityMon, 18 Mar 2024 19:37:14 GMT - Mon, 10 Jun 2024 19:37:13 GMT

File type
JavaScript source, ASCII text, with very long lines (3034)
Size
93 kB (92760 bytes)
Hash
e7424ed3a21e31917e6cf077364a6464
204eb39640bef694c97bc40808c979144d801d25
aad434bc5c0bbd618a055589064e8d5038603f7dcbb69f8aadf44c8ef1db553c

HTTP Headers

GET /gtag/js?id=G-W6SP16VJD5 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 23 Apr 2024 06:33:56 GMT
expires: Tue, 23 Apr 2024 06:33:56 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 92760
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

18.236.82.135:22533/css/snackbar.min.css

18.236.82.135

200 OK

1.3 kB

URL GET HTTP/1.1
18.236.82.135:22533/css/snackbar.min.css
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
ASCII text, with very long lines (1279), with no line terminators
Size
1.3 kB (1279 bytes)
Hash
4220368aced9a5ce011f2ce9bd8b1035
a410e3754656f7dfc63749cfcf0bae3b62ca93ae
a9fb1d56a55e28f572e7c1f1f6a0889fc36c761d93535ca2704ec1e441e2f92b

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /css/snackbar.min.css HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"4ff-1708fd72c24"
Content-Type: text/css; charset=UTF-8
Content-Length: 1279
Date: Tue, 23 Apr 2024 06:36:52 GMT
Connection: keep-alive

18.236.82.135:22533/css/custom.css

18.236.82.135

200 OK

685 B

URL GET HTTP/1.1
18.236.82.135:22533/css/custom.css
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
assembler source, ASCII text
Size
685 B (685 bytes)
Hash
4e7f887c5d4f30ecc94b7a59270280c6
f57a3eb7894cc6cb4a9ec1c7fbbd18a22cdd4bb0
386bae14885723ea44232a92cf67c328dc541928afb042326885bf0fec1b8984

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /css/custom.css HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"2ad-1708fd72c20"
Content-Type: text/css; charset=UTF-8
Content-Length: 685
Date: Tue, 23 Apr 2024 06:36:52 GMT
Connection: keep-alive

18.236.82.135:22533/js/snackbar.min.js

18.236.82.135

200 OK

3.4 kB

URL GET HTTP/1.1
18.236.82.135:22533/js/snackbar.min.js
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
JavaScript source, ASCII text, with very long lines (1083)
Size
3.4 kB (3386 bytes)
Hash
3331bae64bb768b66ff42d3cdf84b9d4
310c07435fb42b09af3ffe6fa2a86c8dcf3037ea
8394b5e437c5fd4a50d0c3ce8fa00a062859959b041c2feabd96c7848d65a1a3

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /js/snackbar.min.js HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"d3a-1708fd72c30"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 3386
Date: Tue, 23 Apr 2024 06:36:52 GMT
Connection: keep-alive

18.236.82.135:22533/js/main.js

18.236.82.135

200 OK

1.2 kB

URL GET HTTP/1.1
18.236.82.135:22533/js/main.js
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
ASCII text, with CRLF line terminators
Size
1.2 kB (1233 bytes)
Hash
6c3dc22930cc1ef3dc4b5dfbf2dffaad
627bdeb526a505cb45cea6e507466f79b6e8c838
75bea9d908ddb42abc52f07b0b0102df35d646ebe989d7d228a6e2f5216f2bb1

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /js/main.js HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"4d1-1708fd72c30"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 1233
Date: Tue, 23 Apr 2024 06:36:52 GMT
Connection: keep-alive

18.236.82.135:22533/js/jquery-3.4.1.min.js

18.236.82.135

200 OK

88 kB

URL GET HTTP/1.1
18.236.82.135:22533/js/jquery-3.4.1.min.js
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
88 kB (88145 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /js/jquery-3.4.1.min.js HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"15851-1708fd72c30"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 88145
Date: Tue, 23 Apr 2024 06:36:52 GMT
Connection: keep-alive

18.236.82.135:22533/css/semantic.min.css

18.236.82.135

200 OK

628 kB

URL GET HTTP/1.1
18.236.82.135:22533/css/semantic.min.css
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
ASCII text, with very long lines (59894)
Size
628 kB (628536 bytes)
Hash
d4bf675e63729054e6efe9bde86a761e
c41b559e345ce6988e259c8529b864d10c7160e4
5177ac8b16de2e407f518c554f3ba3fe0837f8b333830026837cc3f82e190124

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /css/semantic.min.css HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"99738-1708fd72c24"
Content-Type: text/css; charset=UTF-8
Content-Length: 628536
Date: Tue, 23 Apr 2024 06:36:51 GMT
Connection: keep-alive

18.236.82.135:22533/js/semantic.min.js

18.236.82.135

200 OK

276 kB

URL GET HTTP/1.1
18.236.82.135:22533/js/semantic.min.js
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
JavaScript source, ASCII text, with very long lines (65316)
Size
276 kB (275730 bytes)
Hash
5e7273015cebd8d647f801625b68783c
3d1f50123702e8d7353d98f04b5d819ed50be836
0a04a8582f70e7036623568df1d20c2bee833de95412dbc3afe05cda6ff4371f

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /js/semantic.min.js HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"43512-1708fd72c30"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 275730
Date: Tue, 23 Apr 2024 06:36:52 GMT
Connection: keep-alive

18.236.82.135:22533/logo.png

18.236.82.135

200 OK

4.0 kB

URL GET HTTP/1.1
18.236.82.135:22533/logo.png
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
PNG image data, 298 x 100, 8-bit/color RGBA, non-interlaced
Size
4.0 kB (3972 bytes)
Hash
a3537929c1ed046f93df0ce80fa6ba16
5460805d1393a68c1b823e5faae2dfc1242ed3d5
a4bd5a6140b726dca0b97a2b6f4f7d3166a5e0e98d33f065e689922f33e144f6

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /logo.png HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"f84-1708fd72c30"
Content-Type: image/png
Content-Length: 3972
Date: Tue, 23 Apr 2024 06:36:53 GMT
Connection: keep-alive

fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin

142.250.74.106

200 OK

24 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
http://18.236.82.135:22533/login/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
gzip compressed data, max compression
Size
24 kB (24028 bytes)
Hash
8e256c110a33d2ff35a8925f8b9e839c
9b54937af8d1f802099040e5e2f97694fe8457b2
abc5c6f89d9effb306ab6aec4487067fed588333d1a0b52794a24c84ce74f9f1

HTTP Headers

GET /css?family=Lato:400,700,400italic,700italic&subset=latin HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 23 Apr 2024 06:33:57 GMT
date: Tue, 23 Apr 2024 06:33:57 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

216.58.207.227

200 OK

23 kB

URL GET HTTP/2
fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://18.236.82.135:22533/login/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 23040, version 1.0
Size
23 kB (23040 bytes)
Hash
de69cf9e514df447d1b0bb16f49d2457
2ac78601179c3a63ba3f3f3081556b12ddcaf655
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

HTTP Headers

GET /s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.236.82.135:22533
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23040
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 02:02:48 GMT
expires: Wed, 23 Apr 2025 02:02:48 GMT
cache-control: public, max-age=31536000
age: 16269
last-modified: Tue, 02 May 2023 15:07:25 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

18.236.82.135:22533/css/themes/default/assets/fonts/icons.woff2

18.236.82.135

200 OK

40 kB

URL GET HTTP/1.1
18.236.82.135:22533/css/themes/default/assets/fonts/icons.woff2
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
Web Open Font Format (Version 2), TrueType, length 40148, version 1.0
Size
40 kB (40148 bytes)
Hash
0ab54153eeeca0ce03978cc463b257f7
6ec6d36cb2464b4e821cfabb532f310bd342601c
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /css/themes/default/assets/fonts/icons.woff2 HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/css/semantic.min.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 29 Feb 2020 07:26:48 GMT
ETag: W/"9cd4-1708fd72c2c"
Content-Type: font/woff2
Content-Length: 40148
Date: Tue, 23 Apr 2024 06:36:53 GMT
Connection: keep-alive

18.236.82.135:22533/favicon.ico

18.236.82.135

404 Not Found

150 B

URL GET HTTP/1.1
18.236.82.135:22533/favicon.ico
IP
18.236.82.135:22533
ASN
#16509 AMAZON-02

Requested by
http://18.236.82.135:22533/login/

File type
HTML document, ASCII text
Size
150 B (150 bytes)
Hash
84241342d84ac29592a5d9516f8edf7f
03c53980e18e17625f439c20e7d438f066202428
6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 18.236.82.135:22533
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.236.82.135:22533/login/
Cookie: _ga_W6SP16VJD5=GS1.1.1713854037.1.0.1713854037.0.0.0; _ga=GA1.1.737015178.1713854038
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
X-Powered-By: Express
Content-Security-Policy: default-src 'none'
X-Content-Type-Options: nosniff
Content-Type: text/html; charset=utf-8
Content-Length: 150
Date: Tue, 23 Apr 2024 06:36:53 GMT
Connection: keep-alive

fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

216.58.207.227

200 OK

24 kB

URL GET HTTP/2
fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://18.236.82.135:22533/login/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 23580, version 1.0
Size
24 kB (23580 bytes)
Hash
e1b3b5908c9cf23dfb2b9c52b9a023ab
fcd4136085f2a03481d9958cc6793a5ed98e714c
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

HTTP Headers

GET /s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.236.82.135:22533
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23580
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 17:21:46 GMT
expires: Fri, 18 Apr 2025 17:21:46 GMT
cache-control: public, max-age=31536000
age: 393131
last-modified: Tue, 02 May 2023 15:17:22 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (15)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP