| |  110.16.192.42 | 200 | 145 B |
URL User Request GET HTTP/1.1IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hashdca33d79e50624118086e38d6f06474d f77dbf575df9d76c5c06e861651654c090e7df96 05b793fb24af6aad057ea4eaebfa26c14ced0e694e7bb243ef80ed6f2931f541
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:32 GMT
Content-Type: text/html
Content-Length: 145
Connection: close
Location: https://110.16.192.42:8888/login
|
|
| mitmdetection.services.mozilla.com/ |  54.230.111.70 | | 0 B |
URL mitmdetection.services.mozilla.com/ IP54.230.111.70:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD / HTTP/1.1
Host: mitmdetection.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
content-type: application/xml
date: Fri, 29 Mar 2024 09:34:29 GMT
server: AmazonS3
x-cache: Error from cloudfront
via: 1.1 5916f6b8d469d1bee1e905ff13761ebc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: SerWdvqLYIDSsluIwJR4JbYk__m9I54POBwD5RNlypw6KsqzxcBBPw==
X-Firefox-Spdy: h2
|
|
| | 110.16.192.42 | 200 | 4.5 kB |
URL User Request GET HTTP/1.1IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (305) Hash9cff8d4f639ab916dee55dd6c0f04af0 80deef2e94bd35cba1081254ab456d357f469832 fc371be7e61e0884a0f84011f52642e3c0a40c03c6dbcb57857ea5395b19e272
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:35 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC; Path=/; HttpOnly
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Content-Language: en-US
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/static/css/verify.css | 110.16.192.42 | 200 | 3.4 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/css/verify.css IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeUnicode text, UTF-8 text, with very long lines (2295) Hash5a32562d775f24fd956412145427fd74 6a9cf9c09aea6055eeebd9f990584ed520182940 a02ae5e45a96c61b4dd3daddf0bc4f158b43c8c945c3f3b5654d5b2115a89e9c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/css/verify.css HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:36 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/static/img/logo.svg | 110.16.192.42 | 200 | 8.9 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/img/logo.svg IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeSVG Scalable Vector Graphics image Hash6f52658e506b15636856c0f683a5d826 be89bdfe446a4ae56a6c702891bee10b44c7c0ca 8cd85f8c0cabad524c8f32f58accbb522c7d14522fc3442deb676cfeadc498f7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/img/logo.svg HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:36 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/static/js/jquery-3.5.1.js | 110.16.192.42 | 200 | 84 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/js/jquery-3.5.1.js IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeJavaScript source, ASCII text Hash23c7c5d2d1317508e807a6c7f777d6ed ad16c4a132ad2a03b4951185fed46d55397b5e88 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/jquery-3.5.1.js HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:36 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/static/js/ase.js | 110.16.192.42 | 200 | 456 B |
URL GET HTTP/1.1110.16.192.42:8888/static/js/ase.js IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
Hash0fef088c562099ce6ab48b148d89eda3 f6bf7d93de93b32cdb1b5637d4124e9b8f14baff b1851a6f99105b4ce29c87b3bc6c4fb0e700036c407c489961d619dd2a7e0a7d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/ase.js HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:36 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 456
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
|
|
| 110.16.192.42:8888/static/js/verify.js | 110.16.192.42 | 200 | 5.9 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/js/verify.js IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeJavaScript source, Unicode text, UTF-8 text Hash9dcdc9aeee4b651dd88fb6affc3caf28 5b0df370fc87aa8f5f383037142754ef32ceda40 ec73ad7542838d3eb107c5cb96f6eb8e5a3afd9b4d2cf1d808e25c71c2df4a7a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/verify.js HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:37 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/static/js/jsencrypt.js | 110.16.192.42 | 200 | 35 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/js/jsencrypt.js IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeJavaScript source, ASCII text, with very long lines (828) Hash5eb0b9040a89b3aaae0e1002fc1248ac 5ee4f52d9359a5722034bd186cb422e085ae28b1 6b4baa96849c24b4626d412a3127b85ed6f44d8b613ad91ef708246216e97924
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/jsencrypt.js HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:36 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/static/js/crypto-js.js | 110.16.192.42 | 200 | 31 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/js/crypto-js.js IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (756) Hash60ab5dbd46dfa34dfef3c1548a22a978 3dd73b6f13dc818a3a9c5c7424c1c4a9649b00a2 c6826494432163d74fd27e78ad011a13d55e4670441cd49fc9f1e52a4afd28d9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/js/crypto-js.js HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:36 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|
| 110.16.192.42:8888/rsa/key | 110.16.192.42 | 200 | 216 B |
URL GET HTTP/1.1110.16.192.42:8888/rsa/key IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeASCII text, with no line terminators Hash31ae15a15abbedcd2c84f063faa86b6c 4e3b61ad6270b0e20464122c5311640ce850d1bb 055e866ee7d199c12c504071db34a0075581a3a2d2dfb4d4e27c144f3ca173a0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /rsa/key HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:37 GMT
Content-Type: text/plain;charset=UTF-8
Content-Length: 216
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
|
|
| 110.16.192.42:8888/static/img/favicon.ico | 110.16.192.42 | 200 | 7.1 kB |
URL GET HTTP/1.1110.16.192.42:8888/static/img/favicon.ico IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 64x63, components 3 Hash59ff62c34095140da4781646f6aa2115 3dea238f3324029cbf1511e95b2c7a31b5759819 d119b48a764c83f23d8fb28c17b93eb3ec63191dbd31e7de6364c8c365a17e7f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/img/favicon.ico HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:38 GMT
Content-Type: image/x-icon
Content-Length: 7149
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
|
|
| 110.16.192.42:8888/mycaptcha/captcha/get | 110.16.192.42 | 200 | 178 kB |
URL POST HTTP/1.1110.16.192.42:8888/mycaptcha/captcha/get IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
Size178 kB (178088 bytes) Hash7b2bdda2bcfb9b446e9b6eab0427db3f f2b99b1ef3f0c56a3294c5df8b878e039783f701 0ca4e1df7fdb98fe95f3c42fa5ab5243826b81ac2ace4c7f833c90d640b143ca
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /mycaptcha/captcha/get HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=UTF-8
Content-Length: 106
Origin: https://110.16.192.42:8888
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:37 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
|
|
| 110.16.192.42:8888/static/img/login-bg.jpg | 110.16.192.42 | 200 | 1.0 MB |
URL GET HTTP/1.1110.16.192.42:8888/static/img/login-bg.jpg IP110.16.192.42:8888 ASN#4837 CHINA UNICOM China169 Backbone
Requested byhttps://110.16.192.42:8888/login CertificateIssuerspe Subject110.16.192.42 Fingerprint5F:0C:5E:AD:5D:AE:26:12:1B:97:B8:90:89:B9:B0:DE:56:7D:A8:9E ValidityTue, 11 Jul 2023 01:02:49 GMT - Wed, 10 Jul 2024 01:02:49 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 1920x600, components 3 Size1.0 MB (1013906 bytes) Hashaed8f477f3236c25cba5acf557c0e341 85cb756e930796917d229d8aadb2df7e98dc3a2f 1c9fa62bb86e1d0e79b25f2b2cdfecdc4825d198f3d76deb7d636d3f87ac67e2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /static/img/login-bg.jpg HTTP/1.1
Host: 110.16.192.42:8888
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://110.16.192.42:8888/login
Cookie: JSESSIONID=DA6AC0B9CD4F930F697B44FDBFD631DC
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Server: nginx/1.21.6
Date: Fri, 29 Mar 2024 09:34:37 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, PUT
Access-Control-Max-Age: 3600
Vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Last-Modified: Tue, 26 Mar 2024 01:27:00 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: ALLOWALL
Content-Encoding: gzip
|
|