Report - 131.221.130.157/

Report Overview

Submitted URL
131.221.130.157/
IP
131.221.130.157
ASN
#264417 Megalink Telecom
Submitted
2024-04-24 22:00:11
Access
public
Website Title
F673AV9
Final URL
131.221.130.157/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
14

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
131.221.130.157	unknown	unknown	No data	No data	2.7 kB	34 kB	131.221.130.157

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	131.221.130.157	Sinkholed
2024-04-24	medium	131.221.130.157	Sinkholed
2024-04-24	medium	131.221.130.157	Sinkholed
2024-04-24	medium	131.221.130.157	Sinkholed
2024-04-24	medium	131.221.130.157	Sinkholed
2024-04-24	medium	131.221.130.157	Sinkholed
2024-04-24	medium	131.221.130.157	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	unknown	10 B	2023-04-14	2024-05-03
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-04-14 03:10:52 Last Seen2024-05-03 12:36:59 Times Seen238 Hash 0b6f5131dcaf08d7e5ac9ba60e6f65bf 093b40f6556058f55ad1f602887287509cc13252 56d4da56009228d4ed8b99fcf27210260946c13b86e011929f3527a76c69f2b5 Loading...

	131.221.130.157/	0 B	2023-03-07	2024-05-04
Pretty URL 131.221.130.157/ IP 131.221.130.157 ASN #264417 Megalink Telecom Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 21:58:36 Times Seen37347310 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	131.221.130.157/js/sha256.min.js	6.7 kB	2023-03-07	2024-05-03
Pretty URL 131.221.130.157/js/sha256.min.js IP 131.221.130.157 ASN #264417 Megalink Telecom Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 14:05:18 Last Seen2024-05-03 00:00:43 Times Seen304 Hash e3c5b316cc9c75fbd34fe8d09a8cbc50 ea8710b3f039c06b85cafee16d8ad22f0d979983 8573c19f77e0201cb67ba075c1f766de392659eccc5bee96ccec8822cc59c243 Loading...

	131.221.130.157/	0 B	2023-03-07	2024-05-04
Pretty URL 131.221.130.157/ IP 131.221.130.157 ASN #264417 Megalink Telecom Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 21:58:36 Times Seen37347310 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (7)

URL IP Response Size

131.221.130.157/

131.221.130.157

200 OK

7.6 kB

URL User Request GET HTTP/1.1
131.221.130.157/
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

File type
HTML document, Unicode text, UTF-8 text
Size
7.6 kB (7562 bytes)
Hash
fdc98a113d9a4af662861f4763e8d79e
0c6dacb78ebc732ca7d62497d487d70d0de339de
5c02fd541af01faa1dc70af4dd74527fc672446f50c475b6230d4d4e5f313d9c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: 
Content-Type: text/html; charset=gb2312
Accept-Ranges: bytes
Connection: close
Cache-Control: no-cache,no-store
Content-Length: 7562
Set-Cookie: _TESTCOOKIESUPPORT=1; PATH=/; HttpOnly
X-Frame-Options: SAMEORIGIN

131.221.130.157/skin/priorgreen/css/login.css

131.221.130.157

200 OK

9.9 kB

URL GET HTTP/1.1
131.221.130.157/skin/priorgreen/css/login.css
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

Requested by
http://131.221.130.157/

File type
assembler source, ASCII text, with CRLF line terminators
Size
9.9 kB (9858 bytes)
Hash
cff0f44ae6210e2d10115862c6678af3
36b4bf829a9c9c4b68311ce1a3937cf9fd879aec
7558e06ca6e922f86e5ddb46df8a0d2c8212a75a93dd8d59d5274aa0b446883c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /skin/priorgreen/css/login.css HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://131.221.130.157/
Cookie: _TESTCOOKIESUPPORT=1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: 
Content-Type: text/css
Accept-Ranges: bytes
Connection: close
Content-Length: 9858

131.221.130.157/js/sha256.min.js

131.221.130.157

200 OK

6.7 kB

URL GET HTTP/1.1
131.221.130.157/js/sha256.min.js
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

Requested by
http://131.221.130.157/

File type
JavaScript source, ASCII text, with very long lines (6741), with no line terminators
Size
6.7 kB (6741 bytes)
Hash
e3c5b316cc9c75fbd34fe8d09a8cbc50
ea8710b3f039c06b85cafee16d8ad22f0d979983
8573c19f77e0201cb67ba075c1f766de392659eccc5bee96ccec8822cc59c243

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/sha256.min.js HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://131.221.130.157/
Cookie: _TESTCOOKIESUPPORT=1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: 
Content-Type: application/x-javascript
Accept-Ranges: bytes
Connection: close
Content-Length: 6741

131.221.130.157/css/styleen.css

131.221.130.157

200 OK

1.3 kB

URL GET HTTP/1.1
131.221.130.157/css/styleen.css
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

Requested by
http://131.221.130.157/

File type
ASCII text, with CRLF line terminators
Size
1.3 kB (1291 bytes)
Hash
01ee351c68af64ca35f4b536656455b0
b076f93794605890954273c50576bee56040aa5d
8061f9d39ac1a3f716faab884f0035bcd932dc1cc0505fb1cb79cf095f1ab99b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/styleen.css HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://131.221.130.157/
Cookie: _TESTCOOKIESUPPORT=1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: 
Content-Type: text/css
Accept-Ranges: bytes
Connection: close
Content-Length: 1291

131.221.130.157/skin/priorgreen/img/banner.gif

131.221.130.157

200 OK

7.1 kB

URL GET HTTP/1.1
131.221.130.157/skin/priorgreen/img/banner.gif
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

Requested by
http://131.221.130.157/

File type
GIF image data, version 89a, 778 x 60
Size
7.1 kB (7106 bytes)
Hash
03d602bb92ed46b38a852750fad224f2
2f5c714100a56157cd3382901190e620d2d7d761
a495d952c09ca67c707757f2194ea69b83568f48bed3a94ec7d29a4391b1703b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /skin/priorgreen/img/banner.gif HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://131.221.130.157/skin/priorgreen/css/login.css
Cookie: _TESTCOOKIESUPPORT=1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: 
Content-Type: image/gif
Accept-Ranges: bytes
Connection: close
Content-Length: 7106

131.221.130.157/img/pop_up.gif

131.221.130.157

404 Not Found

391 B

URL GET HTTP/1.1
131.221.130.157/img/pop_up.gif
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

Requested by
http://131.221.130.157/

File type
HTML document, ASCII text, with very long lines (406), with no line terminators
Size
391 B (391 bytes)
Hash
55c383d487d1ac88180445cb0d4e3007
6e0c5666b0e88e05e1f2b7d0186d453b14614d65
30cd5ae193b76a08161e2ac2ca420a04beb22845d822d3280c8483683b7ac800

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/pop_up.gif HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://131.221.130.157/
Cookie: _TESTCOOKIESUPPORT=1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: 
Content-Type: text/html; charset=gb2312
Accept-Ranges: bytes
Connection: close
Cache-Control: no-cache,no-store

131.221.130.157/favicon.ico

131.221.130.157

404 Not Found

391 B

URL GET HTTP/1.1
131.221.130.157/favicon.ico
IP
131.221.130.157:80
ASN
#264417 Megalink Telecom

Requested by
http://131.221.130.157/

File type
HTML document, ASCII text, with very long lines (406), with no line terminators
Size
391 B (391 bytes)
Hash
55c383d487d1ac88180445cb0d4e3007
6e0c5666b0e88e05e1f2b7d0186d453b14614d65
30cd5ae193b76a08161e2ac2ca420a04beb22845d822d3280c8483683b7ac800

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 131.221.130.157
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://131.221.130.157/
Cookie: _TESTCOOKIESUPPORT=1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: 
Content-Type: text/html; charset=gb2312
Accept-Ranges: bytes
Connection: close
Cache-Control: no-cache,no-store

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (7)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP