| 15.204.232.110:8080/login |  15.204.232.110 | 200 OK | 6.5 kB |
URL User Request GET HTTP/1.115.204.232.110:8080/login IP15.204.232.110:8080
File typeHTML document, ASCII text, with very long lines (333) Hashad72f31b724faf2d8426b071bcc19e65 3d55d48ad1ca7a2da7227e80053380336614b99f b3d967c932f18f8b4d6293c93ccb2ec67f701708b8b80127cc5876fb96170038
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 01 Oct 2024 04:48:08 GMT
ETag: W/"1979-192466839d6"
Content-Type: text/html; charset=UTF-8
Content-Length: 6521
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| cdn.jsdelivr.net/npm/sweetalert2@11 | 151.101.65.229 | 200 OK | 18 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/sweetalert2@11 IP151.101.65.229:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGlobalSign nv-sa Subjectjsdelivr.net Fingerprint6C:45:F5:9E:D3:37:60:0B:9C:A8:28:29:A4:E6:41:33:BB:2E:76:5C ValidityTue, 30 Jul 2024 15:36:05 GMT - Sun, 31 Aug 2025 15:36:04 GMT
File typeJavaScript source, ASCII text, with very long lines (46717) Hash6c0330d159d6024aa63cb37ecc794017 792948b232bca583e2a8b2eb9a673386be2095e7 d66e2a55bb1d712535f6dba55536de4117a0d018d9896eb219f7e796bfcd26ee
GET /npm/sweetalert2@11 HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 11.14.5
x-jsd-version-type: version
etag: W/"1153a-eSlIsjK8pYPiqLLrmmczhr4glec"
content-encoding: br
accept-ranges: bytes
date: Fri, 08 Nov 2024 12:39:31 GMT
age: 20195
x-served-by: cache-fra-eddf8230029-FRA, cache-hel1410025-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 18376
X-Firefox-Spdy: h2
|
|
| 15.204.232.110:8080/assets/js/font.js | 15.204.232.110 | 200 OK | 11 kB |
URL GET HTTP/1.115.204.232.110:8080/assets/js/font.js IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
File typeJavaScript source, ASCII text, with very long lines (11322), with no line terminators Hash9a91910a836554431d487d3a587e840a 218ba1c81b531e2c1730b1f511368f9d31cdec56 c9a3d179bfed32846024ccba2747d360ea292c74ee721f1924feb2bc4d6844f0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/js/font.js HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Mon, 15 Jul 2024 16:09:33 GMT
ETag: W/"2c3a-190b7280d83"
Content-Length: 11322
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| 15.204.232.110:8080/assets/js/script.js?v=11 | 15.204.232.110 | 200 OK | 3.5 kB |
URL GET HTTP/1.115.204.232.110:8080/assets/js/script.js?v=11 IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
Hashcf62e104ccebf05f6c479f94f393f3c3 4c75ce06560455f6353fd34a58300b1ca62619c3 8fa3ee02c628dd09775672068b6239f2f60f0b3a7824e9780a85025949de1f64
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/js/script.js?v=11 HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Wed, 23 Oct 2024 02:21:01 GMT
ETag: W/"dbe-192b72d70a9"
Content-Type: application/javascript; charset=UTF-8
Content-Length: 3518
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| 15.204.232.110:8080/assets/css/nav.css?v=3 | 15.204.232.110 | 200 OK | 1.4 kB |
URL GET HTTP/1.115.204.232.110:8080/assets/css/nav.css?v=3 IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
Hashe15e56e6cbf5fba6a1e2e808690af43a d57c53b1be12cad2db111614e86f12be90e12898 8fee3233781c1cef6ca718f2edc0a86a6064b0885cbcb1e29862e26ad49ff99d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/css/nav.css?v=3 HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Mon, 15 Jul 2024 16:09:33 GMT
ETag: W/"593-190b7280d83"
Content-Type: text/css; charset=UTF-8
Content-Length: 1427
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| 15.204.232.110:8080/assets/js/easteregg.min.js | 15.204.232.110 | 200 OK | 442 B |
URL GET HTTP/1.115.204.232.110:8080/assets/js/easteregg.min.js IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
File typeASCII text, with very long lines (442), with no line terminators Hash5fb51f180b5f9b9af9c30b3df7cc1015 85871f8d5874472572f48fcf37617921840304b9 39d7c7ac65d9e4421322a5ab7e0cd2fcead337da3c66749c65aa7f4bab785dad
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/js/easteregg.min.js HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Content-Type: application/javascript
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Mon, 15 Jul 2024 16:09:33 GMT
ETag: W/"1ba-190b7280d83"
Content-Length: 442
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| fonts.googleapis.com/css2?family=Inter&display=swap | 142.250.74.106 | 200 OK | 2.1 kB |
URL GET HTTP/2fonts.googleapis.com/css2?family=Inter&display=swap IP142.250.74.106:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint74:3D:68:F7:64:93:DF:41:12:95:A6:69:57:38:7A:AF:75:38:44:2D ValidityMon, 07 Oct 2024 08:25:41 GMT - Mon, 30 Dec 2024 08:25:40 GMT
File typegzip compressed data, max compression Hash1ce0b1b8689ede92cb8cffd2ce426cc2 48fd18467f0b4212b5f3e1f987e617c8a9ba345b 51ab570c4c022be47ebb6ef1dfe0fdec30ae6cbcfc20c921a3fcf6d88af1f278
GET /css2?family=Inter&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 08 Nov 2024 12:39:31 GMT
date: Fri, 08 Nov 2024 12:39:31 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 15.204.232.110:8080/assets/css/style.css | 15.204.232.110 | 200 OK | 1.8 kB |
URL GET HTTP/1.115.204.232.110:8080/assets/css/style.css IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
Hasha92ec9b54d9e1de35dacdac9ffbf5196 9075612300a6339371cb47581e965d1c616fa8ad a86338081e5ba630b64ba27e36e0052908885e5af6adace25b468880e4d58c8d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/css/style.css HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Mon, 15 Jul 2024 16:09:33 GMT
ETag: W/"722-190b7280d83"
Content-Type: text/css; charset=UTF-8
Content-Length: 1826
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| fonts.gstatic.com/s/inter/v18/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfAZ9hiA.woff2 | 142.250.74.163 | 200 OK | 24 kB |
URL GET HTTP/2fonts.gstatic.com/s/inter/v18/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfAZ9hiA.woff2 IP142.250.74.163:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subject*.gstatic.com FingerprintB0:78:E3:AA:FC:0D:C3:F5:76:B8:38:C6:A8:8D:AB:A8:9C:C3:FE:C9 ValidityMon, 07 Oct 2024 08:25:40 GMT - Mon, 30 Dec 2024 08:25:39 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 23692, version 1.0 Hashf837d382a885a07c34a3d4bf4f49373d 68ddceef1d164a48d9d01d4a74f26b7897323229 dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33
GET /s/inter/v18/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfAZ9hiA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://15.204.232.110:8080
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23692
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 02 Nov 2024 05:38:05 GMT
expires: Sun, 02 Nov 2025 05:38:05 GMT
cache-control: public, max-age=31536000
age: 543686
last-modified: Mon, 29 Jul 2024 22:45:22 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-N0LG27M8L8 | 142.250.74.136 | 200 OK | 134 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=G-N0LG27M8L8 IP142.250.74.136:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subject*.google-analytics.com Fingerprint4E:4C:D9:C3:F2:89:66:5F:0F:4D:32:39:FA:F7:AC:3F:3E:19:DE:D8 ValidityMon, 07 Oct 2024 08:23:31 GMT - Mon, 30 Dec 2024 08:23:30 GMT
File typeJavaScript source, ASCII text, with very long lines (16634) Size134 kB (133510 bytes) Hash013ac55e4b6d37e9d00149108900d98b 5c24a4df4e15910fc7cde177b78864e3be6d5c91 307495143697c7053357ff43d2912423276aeb8b7c446d65898cdf746fe44a3a
GET /gtag/js?id=G-N0LG27M8L8 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 08 Nov 2024 12:39:31 GMT
expires: Fri, 08 Nov 2024 12:39:31 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
server: Google Tag Manager
content-length: 133510
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 15.204.232.110:8080/assets/json/ads.json | 15.204.232.110 | 200 OK | 136 B |
URL GET HTTP/1.115.204.232.110:8080/assets/json/ads.json IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
Hashf34c0f5d03442d82f692333847261ac4 f8483ca3138317878f36b84ef21d9df5f7695679 d9b168a1444b2f074318793f2b93848b946e85154661b62c55d2adc70734d7fb
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/json/ads.json HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://15.204.232.110:8080/login
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 01 Nov 2024 04:35:01 GMT
ETag: W/"88-192e60159d8"
Content-Type: application/json; charset=UTF-8
Content-Length: 136
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| ka-f.fontawesome.com/releases/v6.4.2/webfonts/free-fa-solid-900.woff2 |  104.21.26.223 | 200 OK | 150 kB |
URL GET HTTP/2ka-f.fontawesome.com/releases/v6.4.2/webfonts/free-fa-solid-900.woff2 IP104.21.26.223:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subjectka-f.fontawesome.com Fingerprint1D:F4:C2:80:E2:C1:83:ED:04:04:57:D9:9B:F0:63:F4:BF:F7:E1:A0 ValiditySun, 27 Oct 2024 18:52:20 GMT - Sat, 25 Jan 2025 18:52:19 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 150020, version 772.1280 Size150 kB (150020 bytes) Hasha8dcee416ebfe6e615e5902a49500e48 fdd900a478670cc2ef2f7e9a57a32f78dc8eff52 d3e9a900f61c6811de529e4227226b898ce88b65a66347d0088a2da3af5e60b5
GET /releases/v6.4.2/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://15.204.232.110:8080
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 08 Nov 2024 12:39:31 GMT
content-type: font/woff2
content-length: 150020
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Tue, 01 Aug 2023 19:25:32 GMT
etag: "a8dcee416ebfe6e615e5902a49500e48"
x-amz-server-side-encryption: AES256
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 4nRdzZZqXP-M7Oa-826M5a9d0HLSQxPv8ZsLM7FQHmsTIVTpKJ5Mfw==
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9UxZYIlmA%2F4zYbJHcMK5gcNFKk3wRQRYH4AY9IMTHRuXmSai4A59FyblFp7wCk6edSTehiRsTd%2FM0jUN981mDTGbE%2FsUsKX6AEV61zkj5eTo%2B1blwDomdlbwJGcHzrSxGhxaLE8cKg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8df5a0583c33b4f9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=19357&sent=39&recv=19&lost=0&retrans=0&sent_bytes=34093&recv_bytes=1748&delivery_rate=1062122&cwnd=255&unsent_bytes=0&cid=a3d93b3612d2ff91&ts=331&x=0"
X-Firefox-Spdy: h2
|
|
| 15.204.232.110:8080/img/favicon.ico | 15.204.232.110 | 200 OK | 5.4 kB |
URL GET HTTP/1.115.204.232.110:8080/img/favicon.ico IP15.204.232.110:8080
Requested byhttp://15.204.232.110:8080/login
File typeMS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel Hashf3418a443e7d841097c714d69ec4bcb8 49263695f6b0cdd72f45cf1b775e660fdc36c606 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/favicon.ico HTTP/1.1
Host: 15.204.232.110:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://15.204.232.110:8080/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 03 Sep 2024 16:19:02 GMT
ETag: W/"1536-191b8aeb0f4"
Content-Type: image/x-icon
Content-Length: 5430
Date: Fri, 08 Nov 2024 12:39:31 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-shims.min.css?token=8e467ad554 | 104.21.26.223 | 200 OK | 13 kB |
URL GET HTTP/2ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-shims.min.css?token=8e467ad554 IP104.21.26.223:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subjectka-f.fontawesome.com Fingerprint1D:F4:C2:80:E2:C1:83:ED:04:04:57:D9:9B:F0:63:F4:BF:F7:E1:A0 ValiditySun, 27 Oct 2024 18:52:20 GMT - Sat, 25 Jan 2025 18:52:19 GMT
File typegzip compressed data, from Unix Hash771da440ce7b80720bb30dc10b105ce3 a24176ddd6591c690475169d9aab40a1ae74cd43 93df696032c1ac3313ddc09b35c1803592bdc7da47f133487a3fb1d6bce20912
GET /releases/v6.4.2/css/free-v4-shims.min.css?token=8e467ad554 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://15.204.232.110:8080/
Origin: http://15.204.232.110:8080
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Nov 2024 12:39:31 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
etag: W/"da06df503ced6ee507b5fb4fa0999f74"
x-amz-server-side-encryption: AES256
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: RyaZY6SP93pOf2eoKNzBI_if2JYPkPBZ3ChPZMXCXygUtrrhjcGh1w==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aVStOtRC4f1IYQlqnqR83F8GyecvTHQkJSsOxZrVTUZmjXIOIW4rFT33JxIKmGedHP6PZhy0XIbr15GaUohUfhuwtaxnPcUv8WEWdzzFsQUtP6KvhtyE549GxV8bSsVq%2Fkx1F1ZBag%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8df5a056c976b4f9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16528&sent=27&recv=14&lost=0&retrans=0&sent_bytes=26925&recv_bytes=1582&delivery_rate=262683&cwnd=253&unsent_bytes=0&cid=a3d93b3612d2ff91&ts=110&x=0"
X-Firefox-Spdy: h2
|
|
| ka-f.fontawesome.com/releases/v6.4.2/css/free.min.css?token=8e467ad554 | 104.21.26.223 | 200 OK | 31 kB |
URL GET HTTP/2ka-f.fontawesome.com/releases/v6.4.2/css/free.min.css?token=8e467ad554 IP104.21.26.223:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subjectka-f.fontawesome.com Fingerprint1D:F4:C2:80:E2:C1:83:ED:04:04:57:D9:9B:F0:63:F4:BF:F7:E1:A0 ValiditySun, 27 Oct 2024 18:52:20 GMT - Sat, 25 Jan 2025 18:52:19 GMT
File typegzip compressed data, from Unix Hash9a8ec636f96ce3cd600c2600fffe2631 f318c98f0de850ef7234e5e7f63318b40c3b78c2 ed25cb7a82d5448c4b7e20ca8f61049df7e0ed2df3858459c5619354125aacc2
GET /releases/v6.4.2/css/free.min.css?token=8e467ad554 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://15.204.232.110:8080/
Origin: http://15.204.232.110:8080
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Nov 2024 12:39:31 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
etag: W/"ae737a19e46fd502ba9cbe9e33213861"
x-amz-server-side-encryption: AES256
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: _rQ8-cUpFXYPgYhv6V-E1e3LpP5QRALgiVvX8NyucGf3yosMcxrhVg==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s5e5vMTwhgqP9afUhSuPZjfDlyA3BHtpdoOuANILPCk%2FEIxE%2Bd4Vu0oooxiTCjrYnLxzlLQiHzz85O3BwQodtabs92ie4vbRiB%2BooplKsEcUhimUGbwbEF0VW%2FJllxTAFK%2BqB2o8SQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8df5a056c972b4f9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16528&sent=8&recv=14&lost=0&retrans=0&sent_bytes=3273&recv_bytes=1582&delivery_rate=262683&cwnd=253&unsent_bytes=0&cid=a3d93b3612d2ff91&ts=109&x=0"
X-Firefox-Spdy: h2
|
|
| ka-f.fontawesome.com/releases/v6.4.2/css/free-v5-font-face.min.css?token=8e467ad554 | 104.21.26.223 | 200 OK | 823 B |
URL GET HTTP/2ka-f.fontawesome.com/releases/v6.4.2/css/free-v5-font-face.min.css?token=8e467ad554 IP104.21.26.223:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subjectka-f.fontawesome.com Fingerprint1D:F4:C2:80:E2:C1:83:ED:04:04:57:D9:9B:F0:63:F4:BF:F7:E1:A0 ValiditySun, 27 Oct 2024 18:52:20 GMT - Sat, 25 Jan 2025 18:52:19 GMT
File typeASCII text, with very long lines (845), with no line terminators Hash60f771d70194eee2f6ca53f652629c57 80569fe18344d0c3f526479a886fba91d2de0aca 64d1a9645b5b437137ca6c04f5aa6bedd4fe5d102c592894411232a7121e7b02
GET /releases/v6.4.2/css/free-v5-font-face.min.css?token=8e467ad554 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://15.204.232.110:8080/
Origin: http://15.204.232.110:8080
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Nov 2024 12:39:31 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
etag: W/"dbf296002d53e56d340b105d9d764940"
x-amz-server-side-encryption: AES256
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: IbauSDFcKA9ZPp75Zg-DbykdTUtgAisWxADPRgpOfeaeVEbIVp7Bzw==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zoQsQPYpf1DHVAzin0sbdsa6QjfnOESewB3qxJ5va9UVnzyIIEO9iBv1R%2Bc5LgyeksDqU7AjJEkkk0ddIMi5qaq8CJKX5oYYzr%2BlHRvuEGeqsoW%2BmIHkQxqAHQZ%2BIA0MepSk89PMvw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8df5a056c986b4f9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16528&sent=33&recv=14&lost=0&retrans=0&sent_bytes=31979&recv_bytes=1582&delivery_rate=262683&cwnd=253&unsent_bytes=0&cid=a3d93b3612d2ff91&ts=114&x=0"
X-Firefox-Spdy: h2
|
|
| ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-font-face.min.css?token=8e467ad554 | 104.21.26.223 | 200 OK | 1.8 kB |
URL GET HTTP/2ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-font-face.min.css?token=8e467ad554 IP104.21.26.223:443
Requested byhttp://15.204.232.110:8080/login CertificateIssuerGoogle Trust Services Subjectka-f.fontawesome.com Fingerprint1D:F4:C2:80:E2:C1:83:ED:04:04:57:D9:9B:F0:63:F4:BF:F7:E1:A0 ValiditySun, 27 Oct 2024 18:52:20 GMT - Sat, 25 Jan 2025 18:52:19 GMT
File typeASCII text, with very long lines (1803), with no line terminators Hashe222c7d81e67e7d64f8e1e2c2bf5b558 05f52e4d94bf5f8a4f874589b2c66f3d40b64ce6 35f3c6cee4d181081c6e1c723440924507201b46e4d5aa80a63fe29f7d8c748a
GET /releases/v6.4.2/css/free-v4-font-face.min.css?token=8e467ad554 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://15.204.232.110:8080/
Origin: http://15.204.232.110:8080
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 08 Nov 2024 12:39:31 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
etag: W/"9b853b50f37dd0ca770ce0f294d427df"
x-amz-server-side-encryption: AES256
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 501ad2910f631f0520a6d389d6f053e8.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 20SrUcxjz61HJxRKLJIM2p2rNt7MmWk44RqOvn342rn-qtOu7xYGsA==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bM32yUNc5I8nXiXzyIURs8ISWz7rHa63c%2F12GHVuDfSrnVqldpN40Os0KQ3XjKBZkesZhF4l8VJ7OoHWbLGHHAsIgjFco9r99236g17IoodSF38BnSblBD6kFURdfCfz14MbKYzkcA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8df5a056c980b4f9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16528&sent=36&recv=14&lost=0&retrans=0&sent_bytes=32842&recv_bytes=1582&delivery_rate=262683&cwnd=253&unsent_bytes=0&cid=a3d93b3612d2ff91&ts=123&x=0"
X-Firefox-Spdy: h2
|
|