Report - 2.180.9.57

Report Overview

Submitted URL
2.180.9.57
IP
2.180.9.57
ASN
#58224 Iran Telecommunication Company PJS
Submitted
2024-04-18 11:31:14
Access
public
Website Title
IVSWeb 2.0 - Welcome
Final URL
2.180.9.57/new/index.jsp
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
34

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
2.180.9.57	unknown	unknown	No data	No data	5.8 kB	565 kB	2.180.9.57

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed
2024-04-18	medium	2.180.9.57	Sinkholed

ThreatFox

No alerts detected

JavaScript (9)

	URL	Size	First Seen	Last Seen
	2.180.9.57/js/m.js	100 kB	2023-03-07	2024-04-28
Pretty URL 2.180.9.57/js/m.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:35 Last Seen2024-04-28 13:31:39 Times Seen371 Hash fbb15ef6f3c4a51e9a0c446a99f550ef f76a66eaabd7e72715b707a10263b69beeece6d7 9cc28daef337bbb9937bdb6f4db9cb4b5ee60664a755caab8d828efb9ba5e0d6 Loading...

	2.180.9.57/js/jquery-1.7.2.min.js	95 kB	2023-03-07	2024-05-01
Pretty URL 2.180.9.57/js/jquery-1.7.2.min.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:23 Last Seen2024-05-01 10:16:17 Times Seen13878 Hash b8d64d0bc142b3f670cc0611b0aebcae abcd2ba13348f178b17141b445bc99f1917d47af 47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4 Loading...

	2.180.9.57/js/pop.js	4.7 kB	2023-03-07	2024-04-28
Pretty URL 2.180.9.57/js/pop.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:35 Last Seen2024-04-28 13:31:39 Times Seen379 Hash 9b5c6b11838aef66aea355e650fd4027 6e5283e72fee0d620df0f1fba8a04782b4904211 f59035098deae83b7cd7d767ecf7627d8e3f3f55ae50331a16e01b4bc8ca8455 Loading...

	2.180.9.57/new/index.jsp	0 B	2023-03-07	2024-05-01
Pretty URL 2.180.9.57/new/index.jsp IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-01 11:42:30 Times Seen37243280 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	2.180.9.57/js/httpconnect.js	3.7 kB	2023-03-07	2024-04-28
Pretty URL 2.180.9.57/js/httpconnect.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:35 Last Seen2024-04-28 13:31:39 Times Seen522 Hash 327725d66a1f6f69eaf77a0c4647db64 d919794aae170c761481571b6207089a3555c827 aec270310d0b4fdb103a491f16d56e0a6b90594861ee88c2197c0a446524258c Loading...

	2.180.9.57/js/json_sans_eval.js	8.3 kB	2023-03-07	2024-04-28
Pretty URL 2.180.9.57/js/json_sans_eval.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:35 Last Seen2024-04-28 13:31:39 Times Seen522 Hash 36ff5136abf4856e52e56b0034ee52de 31580de1b6c344cfd00694a78cc464a5a56c10c9 7c7580e4aac9951d8e16f34145d1a13b856ea7afa359818bfb3ea915e083f8b3 Loading...

	2.180.9.57/js/command.js	105 kB	2023-06-04	2024-04-28
Pretty URL 2.180.9.57/js/command.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-04 23:13:36 Last Seen2024-04-28 13:31:39 Times Seen192 Hash c6d853f8092b80b36c3bb4b08c12be56 e0d7219fae1310c531c210b98f67465406e8cf5f eef89bf34fb87a815291933e671ff5cb2ae8eb7fdedca4d1347c23555cbf203e Loading...

	2.180.9.57/js/clientinfo.js	1.9 kB	2023-03-07	2024-04-28
Pretty URL 2.180.9.57/js/clientinfo.js IP 2.180.9.57 ASN #58224 Iran Telecommunication Company PJS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:38:35 Last Seen2024-04-28 13:31:39 Times Seen570 Hash bd9df9b8102d15e45a04ff3b3f142276 42472d66459158c51c7b837347b16933ec5953fe c1669da73990221c64c19c23289bceb3de21944457c739533663edd2b2adf68f Loading...

	unknown	10 B	2023-06-04	2024-04-28
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-06-04 23:13:36 Last Seen2024-04-28 13:31:39 Times Seen236 Hash 3bdba6405cd32cd8005b8c50648bcbfc eecb03d99ce47ea01362b29d8924e2333e90e4c2 b26bd6c3ccd6687f288f808c5888a95fce2710ca89d63eddefb371eee9bb05e2 Loading...

HTTP Transactions (17)

URL IP Response Size

2.180.9.57/

2.180.9.57

553 B

URL
2.180.9.57/
IP
2.180.9.57:0
ASN
#58224 Iran Telecommunication Company PJS

File type
HTML document, ASCII text
Size
553 B (553 bytes)
Hash
7942183a52f0409cce40a64dd89bf226
66efe13092d3cc05d645daaf3b9561729ad6586f
912e44802398a0ee1c6062c40e8f28f6b3cdb3985ecc987835d5ccd41e1f7e9a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 553
Content-Type: text/html;charset=UTF-8
ETag: W/"E4E2B3488F026888-index"
Last-Modified: Thu, 18 Apr 2024 14:35:21 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/css/login.css

2.180.9.57

200 OK

2.1 kB

URL GET HTTP/1.1
2.180.9.57/css/login.css
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
2.1 kB (2072 bytes)
Hash
ee0851fb7aef840f2d49b735c92ee9f0
bc0f4c09f87951675f08a40023422ca42531ee06
3a74a9ff6c035cae6483e2f64b0e5875f89fc525f9bc9c40ecee4a40a51cf98a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/login.css HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 2072
Content-Type: text/css
ETag: W/"E4E2B3488F026888-login"
Last-Modified: Thu, 18 Apr 2024 14:35:21 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/clientinfo.js

2.180.9.57

200 OK

1.9 kB

URL GET HTTP/1.1
2.180.9.57/js/clientinfo.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
1.9 kB (1878 bytes)
Hash
bd9df9b8102d15e45a04ff3b3f142276
42472d66459158c51c7b837347b16933ec5953fe
c1669da73990221c64c19c23289bceb3de21944457c739533663edd2b2adf68f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/clientinfo.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 1878
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-clientinfo"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/new/index.jsp

2.180.9.57

200 OK

3.7 kB

URL User Request GET HTTP/1.1
2.180.9.57/new/index.jsp
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

File type
HTML document, ASCII text
Size
3.7 kB (3708 bytes)
Hash
c4e7159bd3401e5204a3cfc66cb7ce44
9cb0e0e7392f5b51ba39cf4cea9373939fb4e99e
3d5251d235c0445b18278255a4a18ae96676c95dde6130e0cbf11005ee46b44a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /new/index.jsp HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://2.180.9.57/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 3708
Content-Type: text/html;charset=UTF-8
ETag: W/"E4E2B3488F026888-index"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/css/login.css

2.180.9.57

200 OK

2.1 kB

URL GET HTTP/1.1
2.180.9.57/css/login.css
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
2.1 kB (2072 bytes)
Hash
ee0851fb7aef840f2d49b735c92ee9f0
bc0f4c09f87951675f08a40023422ca42531ee06
3a74a9ff6c035cae6483e2f64b0e5875f89fc525f9bc9c40ecee4a40a51cf98a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/login.css HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 2072
Content-Type: text/css
ETag: W/"E4E2B3488F026888-login"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/httpconnect.js

2.180.9.57

200 OK

3.7 kB

URL GET HTTP/1.1
2.180.9.57/js/httpconnect.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
3.7 kB (3677 bytes)
Hash
327725d66a1f6f69eaf77a0c4647db64
d919794aae170c761481571b6207089a3555c827
aec270310d0b4fdb103a491f16d56e0a6b90594861ee88c2197c0a446524258c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/httpconnect.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 3677
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-httpconnect"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/json_sans_eval.js

2.180.9.57

200 OK

8.3 kB

URL GET HTTP/1.1
2.180.9.57/js/json_sans_eval.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
JavaScript source, ASCII text
Size
8.3 kB (8277 bytes)
Hash
36ff5136abf4856e52e56b0034ee52de
31580de1b6c344cfd00694a78cc464a5a56c10c9
7c7580e4aac9951d8e16f34145d1a13b856ea7afa359818bfb3ea915e083f8b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/json_sans_eval.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 8277
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-json_sans_eval"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/clientinfo.js

2.180.9.57

200 OK

1.9 kB

URL GET HTTP/1.1
2.180.9.57/js/clientinfo.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
1.9 kB (1878 bytes)
Hash
bd9df9b8102d15e45a04ff3b3f142276
42472d66459158c51c7b837347b16933ec5953fe
c1669da73990221c64c19c23289bceb3de21944457c739533663edd2b2adf68f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/clientinfo.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 1878
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-clientinfo"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/pop.js

2.180.9.57

200 OK

4.7 kB

URL GET HTTP/1.1
2.180.9.57/js/pop.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
4.7 kB (4650 bytes)
Hash
9b5c6b11838aef66aea355e650fd4027
6e5283e72fee0d620df0f1fba8a04782b4904211
f59035098deae83b7cd7d767ecf7627d8e3f3f55ae50331a16e01b4bc8ca8455

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/pop.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 4650
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-pop"
Last-Modified: Thu, 18 Apr 2024 14:35:23 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/m.js

2.180.9.57

200 OK

100 kB

URL GET HTTP/1.1
2.180.9.57/js/m.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
JavaScript source, ASCII text, with CRLF, CR line terminators
Size
100 kB (100027 bytes)
Hash
fbb15ef6f3c4a51e9a0c446a99f550ef
f76a66eaabd7e72715b707a10263b69beeece6d7
9cc28daef337bbb9937bdb6f4db9cb4b5ee60664a755caab8d828efb9ba5e0d6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/m.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 100027
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-m"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/command.js

2.180.9.57

200 OK

105 kB

URL GET HTTP/1.1
2.180.9.57/js/command.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
Unicode text, UTF-8 text, with very long lines (395), with CRLF line terminators
Size
105 kB (104688 bytes)
Hash
d59cbc1c694e59836ab032ec314810ef
e90b6ffc1e2546dd1277303dc728c0e202fd5895
29f15cc37329e857fb8d6f0aeb97b022e41315cc6731e8a6494eeb1e10edc428

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/command.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 104688
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-command"
Last-Modified: Thu, 18 Apr 2024 14:35:22 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/js/jquery-1.7.2.min.js

2.180.9.57

200 OK

95 kB

URL GET HTTP/1.1
2.180.9.57/js/jquery-1.7.2.min.js
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (32769)
Size
95 kB (94840 bytes)
Hash
b8d64d0bc142b3f670cc0611b0aebcae
abcd2ba13348f178b17141b445bc99f1917d47af
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/jquery-1.7.2.min.js HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 94840
Content-Type: application/javascript
ETag: W/"E4E2B3488F026888-jquery-1.7.2.min"
Last-Modified: Thu, 18 Apr 2024 14:35:23 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/old/l_bt.png

2.180.9.57

200 OK

637 B

URL GET HTTP/1.1
2.180.9.57/old/l_bt.png
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
PNG image data, 72 x 23, 8-bit/color RGB, non-interlaced
Size
637 B (637 bytes)
Hash
6ec0a2fd1e9f11fe7d94b5ffa33ca93b
8536d9c9da491c2a4293d23bc0f84ae49f4ffe9f
845f4ebbe0d8b692261ffa4737b6513f6f281ca129bdb98f327207a8e70b6271

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /old/l_bt.png HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/css/login.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 637
Content-Type: image/png
ETag: W/"E4E2B3488F026888-l_bt"
Last-Modified: Thu, 18 Apr 2024 14:35:23 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/image/l_bgx.png

2.180.9.57

200 OK

32 kB

URL GET HTTP/1.1
2.180.9.57/image/l_bgx.png
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
PNG image data, 515 x 215, 8-bit colormap, non-interlaced
Size
32 kB (32218 bytes)
Hash
957aa8fededa0b4b88f6488b86939365
644bdc67bf2b3dc24d9a0f4dee38baa1d04ecce1
685bf89c1fef68d3b123176836b776190d7cf312ce4b7f507facab83a25617aa

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /image/l_bgx.png HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/css/login.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 32218
Content-Type: image/png
ETag: W/"E4E2B3488F026888-l_bgx"
Last-Modified: Thu, 18 Apr 2024 14:35:23 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/image/l_bg.jpg

2.180.9.57

200 OK

35 kB

URL GET HTTP/1.1
2.180.9.57/image/l_bg.jpg
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1440x421, components 3
Size
35 kB (35023 bytes)
Hash
c4834bd9949d9eeb1a5be10d23f97585
d527651537712547fea5bbe14570903017075505
1178c30e273261d89ec1f261a89a1ed902e5831556dc7575f4ebc3c62da03607

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /image/l_bg.jpg HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/css/login.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 35023
Content-Type: image/jpeg
ETag: W/"E4E2B3488F026888-l_bg"
Last-Modified: Thu, 18 Apr 2024 14:35:23 GMT
Server: WCY_WEBServer/2.0

2.180.9.57/favicon.ico

2.180.9.57

404 NOT FOUND

9 B

URL GET HTTP/1.1
2.180.9.57/favicon.ico
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
ASCII text, with no line terminators
Size
9 B (9 bytes)
Hash
ec65a3dc9c958c8350012207a7e11c7d
b18ee9a29706a8b7352fdcf012f02c77cbdd08e1
d262339346a267abf5207c549ae7a9c792fcbf1055be3dc5753dcda7176304e6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/new/index.jsp
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 NOT FOUND
Content-Length: 9
Content-Type: text/html
Server: WCY_WEBServer/2.0

2.180.9.57/image/loginmain.jpg

2.180.9.57

200 OK

165 kB

URL GET HTTP/1.1
2.180.9.57/image/loginmain.jpg
IP
2.180.9.57:80
ASN
#58224 Iran Telecommunication Company PJS

Requested by
http://2.180.9.57/new/index.jsp

File type
JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=900, bps=0, PhotometricInterpretation=RGB, orientation=upper-left, width=1440], baseline, precision 8, 1440x900, components 3
Size
165 kB (165340 bytes)
Hash
6bc39cd6b127a1645e8b6db18eb8f1ab
6f51ddcb98a671f38796260a0aee660b56113d20
65ac6086cd1853c1efca176835cbc9b8ef88200c45866b0470f4264c8264f8c3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /image/loginmain.jpg HTTP/1.1
Host: 2.180.9.57
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://2.180.9.57/css/login.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 165340
Content-Type: image/jpeg
ETag: W/"E4E2B3488F026888-loginmain"
Last-Modified: Thu, 18 Apr 2024 14:35:23 GMT
Server: WCY_WEBServer/2.0

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (9)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML