Report - 20.74.233.255:311/login

Report Overview

Submitted URL
20.74.233.255:311/login
IP
20.74.233.255
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Submitted
2024-03-28 09:56:13
Access
public
Website Title
TMA Portal
Final URL
20.74.233.255:311/login
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
26

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
20.74.233.255:311	unknown	unknown	No data	No data	4.6 kB	1.6 MB	20.74.233.255
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-03-28	481 B	2.0 kB	142.250.74.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed
2024-03-28	medium	20.74.233.255	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	20.74.233.255:311/assets/index-401abb36.js	4.0 MB	2024-03-28	2024-03-28
Pretty URL 20.74.233.255:311/assets/index-401abb36.js IP 20.74.233.255 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-28 10:56:21 Last Seen2024-03-28 10:56:21 Times Seen2 Hash 92308458c6fd320281a38bfa63257484 27dad6e09e82b1bc90e3871b98bf19c730170ed9 3d6ca9a9edbb1c27d2727ed6f3d1902f39f78aa5a3a0b0c56229842946c4aed8 Loading...

	20.74.233.255:311/assets/lightTheme-8bc3e6fd.js	102 B	2024-03-28	2024-03-28
Pretty URL 20.74.233.255:311/assets/lightTheme-8bc3e6fd.js IP 20.74.233.255 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-28 10:56:21 Last Seen2024-03-28 10:56:21 Times Seen3 Hash 17fd34f1ebba9ed94ff9f9b6ea877a67 0673f41b093d3426ec71d3e969aff5e359654e9a b23f87ae5d2db4093c0b09cf9e32a70116e3b1214bd6b5553788fab66a86feb7 Loading...

HTTP Transactions (14)

URL IP Response Size

20.74.233.255:311/login

20.74.233.255

200 OK

789 B

URL User Request GET HTTP/1.1
20.74.233.255:311/login
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

File type
HTML document, ASCII text
Size
789 B (789 bytes)
Hash
1c24f6413ca90b643dac2290b01094f5
546b24b46ec64a586102096abd187f82f5c571e3
fa50aae72ecbf0266e59a1afb4923fbd985b383bccc3c5adc1a36643b7a0e61b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "df5bc4943d7fda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:43 GMT
Content-Length: 789

20.74.233.255:311/assets/index-2f8d9165.css

20.74.233.255

200 OK

327 kB

URL GET HTTP/1.1
20.74.233.255:311/assets/index-2f8d9165.css
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
Algol 68 source, ASCII text, with very long lines (65536), with no line terminators
Size
327 kB (327144 bytes)
Hash
5971f337cafbef6819f4b80faafed339
3b7e1c3d50ac8b816e32620f7e3a7fa392343b3b
2f8d91653539271df7ac842b7feb39aaef89c7b2467a298199f51f573679e9fd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/index-2f8d9165.css HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "07b61943d7fda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:44 GMT
Content-Length: 327144

20.74.233.255:311/assets/index-401abb36.js

20.74.233.255

200 OK

1.0 MB

URL GET HTTP/1.1
20.74.233.255:311/assets/index-401abb36.js
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
JavaScript source, ASCII text, with very long lines (40391)
Size
1.0 MB (1016122 bytes)
Hash
92308458c6fd320281a38bfa63257484
27dad6e09e82b1bc90e3871b98bf19c730170ed9
3d6ca9a9edbb1c27d2727ed6f3d1902f39f78aa5a3a0b0c56229842946c4aed8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/index-401abb36.js HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "07b61943d7fda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:44 GMT
Content-Length: 1016122

fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

142.250.74.106

200 OK

1.4 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
http://20.74.233.255:311/login
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint04:B9:D9:E0:01:DB:5E:AB:5A:FF:F0:D9:ED:39:0F:C1:63:18:51:0B
ValidityMon, 26 Feb 2024 08:18:27 GMT - Mon, 20 May 2024 08:18:26 GMT

File type
gzip compressed data, max compression
Size
1.4 kB (1406 bytes)
Hash
6f4326d9462ed5425d2bb2ed3edba2d0
6a81a4b0155f16ae79938198cfcd955d07e6e5aa
f2b8175c68ef88a6a6531b8a65a54b97c768268fbcba5ad4842bc7eb9f38d225

HTTP Headers

GET /css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 28 Mar 2024 09:55:45 GMT
date: Thu, 28 Mar 2024 09:55:45 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

20.74.233.255:311/env.json

20.74.233.255

200 OK

219 B

URL GET HTTP/1.1
20.74.233.255:311/env.json
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
JSON text data
Size
219 B (219 bytes)
Hash
40f51c63af31aa2be0539c73fdde9c01
e7102875a8828d9912ac97b73ead5a9b723fc817
928d96c32be9b65a180094dab3898b59b6d0384826178c6e1d3edf496c6f2248

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /env.json HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://20.74.233.255:311/login
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "9420c9943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 219

20.74.233.255:311/env.json

20.74.233.255

200 OK

219 B

URL GET HTTP/1.1
20.74.233.255:311/env.json
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
JSON text data
Size
219 B (219 bytes)
Hash
40f51c63af31aa2be0539c73fdde9c01
e7102875a8828d9912ac97b73ead5a9b723fc817
928d96c32be9b65a180094dab3898b59b6d0384826178c6e1d3edf496c6f2248

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /env.json HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://20.74.233.255:311/login
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "9420c9943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 219

20.74.233.255:311/env.json

20.74.233.255

200 OK

219 B

URL GET HTTP/1.1
20.74.233.255:311/env.json
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
JSON text data
Size
219 B (219 bytes)
Hash
40f51c63af31aa2be0539c73fdde9c01
e7102875a8828d9912ac97b73ead5a9b723fc817
928d96c32be9b65a180094dab3898b59b6d0384826178c6e1d3edf496c6f2248

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /env.json HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://20.74.233.255:311/login
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/json
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "9420c9943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 219

20.74.233.255:311/favicon.ico

20.74.233.255

200 OK

1.2 kB

URL GET HTTP/1.1
20.74.233.255:311/favicon.ico
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
96dde889ac0e7e957dd44ec118e594d0
5b908a321e48f3ed95b4ac26a75e4645fc9dc2d8
de1eaa661b1e882f1c1e6787f9fa813e8a747943d5c84ca4907d8b1a93cb3158

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/x-icon
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "83f9c1943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 1150

20.74.233.255:311/assets/lightTheme-c6c94f69.css

20.74.233.255

200 OK

145 B

URL GET HTTP/1.1
20.74.233.255:311/assets/lightTheme-c6c94f69.css
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
ASCII text
Size
145 B (145 bytes)
Hash
c8119dd796d43123e911a9839da86792
339b5b96b19651b36205b9a0537c669f50dd3d0c
c6c94f695905589276b8d30079ef46a017095615f9dbac8faf2ab1fff0d11db8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/lightTheme-c6c94f69.css HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "73d2ba943d7fda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 145

20.74.233.255:311/apple-icon.png

20.74.233.255

200 OK

27 kB

URL GET HTTP/1.1
20.74.233.255:311/apple-icon.png
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Size
27 kB (26620 bytes)
Hash
1810f889852181f409d2949f49455b9e
67e2ef0220910dc5cc336f3032eadebf51e4a873
88b656acac1065fea598f298d26ad0d990f8826ce0f06b4d64902e48ec16fd22

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /apple-icon.png HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "97e6ae943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 26620

20.74.233.255:311/assets/lightTheme-8bc3e6fd.js

20.74.233.255

200 OK

207 B

URL GET HTTP/1.1
20.74.233.255:311/assets/lightTheme-8bc3e6fd.js
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
Java source, ASCII text
Size
207 B (207 bytes)
Hash
17fd34f1ebba9ed94ff9f9b6ea877a67
0673f41b093d3426ec71d3e969aff5e359654e9a
b23f87ae5d2db4093c0b09cf9e32a70116e3b1214bd6b5553788fab66a86feb7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/lightTheme-8bc3e6fd.js HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://20.74.233.255:311/login
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "73d2ba943d7fda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 207

20.74.233.255:311/images/tma-bg.jpg

20.74.233.255

200 OK

255 kB

URL GET HTTP/1.1
20.74.233.255:311/images/tma-bg.jpg
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=14, height=3611, bps=182, PhotometricInterpretation=RGB, manufacturer=Hasselblad, model=L1D-20c, orientation=upper-left, width=5420], progressive, precision 8, 2000x780, components 3
Size
255 kB (254992 bytes)
Hash
b20c3a362cb502de21bb85ff1a226893
98fa44f10a5d4f831c4baff971c5483f6b58eca3
1f6dbe4e4f2a135177388b9b8a1c6f292a7e60b3afa7d8021828c178517e754e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/tma-bg.jpg HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "df5bc4943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 254992

20.74.233.255:311/assets/tma-logo-2ab3e430.png

20.74.233.255

9.3 kB

URL GET
20.74.233.255:311/assets/tma-logo-2ab3e430.png
IP
20.74.233.255:0
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Size
9.3 kB (9296 bytes)
Hash
14db3e6cbe6670b4541f3151388017cf
60e027fa1a351c42e0229a647ce093c58790d06e
2ab3e430658867ca4eccb98f8c2773ef80db3c21d2b7ce46c898bf0a677149bb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/tma-logo-2ab3e430.png HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "2e97bf943d7fda1:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 9296

20.74.233.255:311/assets/lightTheme-8bc3e6fd.js

20.74.233.255

200 OK

207 B

URL GET HTTP/1.1
20.74.233.255:311/assets/lightTheme-8bc3e6fd.js
IP
20.74.233.255:311
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://20.74.233.255:311/login

File type
Java source, ASCII text
Size
207 B (207 bytes)
Hash
17fd34f1ebba9ed94ff9f9b6ea877a67
0673f41b093d3426ec71d3e969aff5e359654e9a
b23f87ae5d2db4093c0b09cf9e32a70116e3b1214bd6b5553788fab66a86feb7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/lightTheme-8bc3e6fd.js HTTP/1.1
Host: 20.74.233.255:311
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://20.74.233.255:311/assets/index-401abb36.js
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 26 Mar 2024 05:22:22 GMT
Accept-Ranges: bytes
ETag: "73d2ba943d7fda1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 09:55:46 GMT
Content-Length: 207

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by