Report - 59.188.15.229/webmail/

Report Overview

Visitedpublic

2025-02-06 00:43:36

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
59.188.15.229	unknown	unknown	2016-06-22	2020-06-01	13 kB	118 kB	59.188.15.229

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed
2025-02-06	medium	59.188.15.229	Sinkholed

ThreatFox

No alerts detected

JavaScript (45)

	URL	From	Size	First Seen	Last Seen
	unknown	EventHandler	9 B	2024-12-22	2025-02-06
URL IP / ASN 0.0.0.0 #0 Introduced by EventHandler Embedded false Resource Info First Seen 2024-12-22 Last Seen 2025-02-06 Times Seen 2 Size 9 B (9 bytes) MD5 0e45bd320b7a479c51edd3d577272dcd SHA1 a5e41da9d65700c5f03372b041b384f1e5c8ecf7 SHA256 4a7b41a7c4b88ec9a0165cd0f8a0ede788fbab019d2bd33a2a4c6ec097b9f2dd Format Code Loading...

	unknown	DomTimer	1.5 kB	2024-12-22	2025-02-06
URL IP / ASN 0.0.0.0 #0 Introduced by DomTimer Embedded false Resource Info First Seen 2024-12-22 Last Seen 2025-02-06 Times Seen 2 Size 1.5 kB (1464 bytes) MD5 a750ca586f9806e1f7e9e2140aeff5a2 SHA1 db5f51cc12ffe428f4965c699ba55f56d7f40d8d SHA256 ec745d374fe984b3c201a227ffc56fbbd9c2b035873c38006b7393e4c8c23ece Format Code Loading...

	unknown	Function	10 kB	2025-02-06	2025-02-06
URL IP / ASN 0.0.0.0 #0 Introduced by Function Embedded false Resource Info First Seen 2025-02-06 Last Seen 2025-02-06 Times Seen 1 Size 10 kB (10327 bytes) MD5 03919f17971b3da65204e89bd713e82c SHA1 c0c6caf9a454468131d13593781a5bc92e1c7f8a SHA256 c0b8a8f5f73fdc95a4614724d77e758e8736078a1445c789b790a67bf8cf781b Format Code Loading...

	59.188.15.229/-.._._.--.._1497580140/webmail/client/inc/startscript.js	ScriptElement	182 kB	2024-12-22	2025-02-06
URL 59.188.15.229/-.._._.--.._1497580140/webmail/client/inc/startscript.js IP / ASN 59.188.15.229 #17444 HKBN Enterprise Solutions Limited Introduced by ScriptElement Embedded false Resource Info First Seen 2024-12-22 Last Seen 2025-02-06 Times Seen 2 Size 182 kB (182530 bytes) MD5 98215cbcefcb4d302f015e63eb1cb2e6 SHA1 5bd9e4951d3f0a0a73a3974332d42fa2fadb5cf3 SHA256 aec67b597f712f30041c79b0642b9c47ef82694085913bb2513ca600f7fa20d9 Format Code Loading...

HTTP Transactions (32)

URL IP Response Size

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/index.css

59.188.15.229

200 OK

650 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/index.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2025-02-06

Last Seen2025-02-06

Times Seen1

Size650 B (650 bytes)

MD5c5f8a9ecf077bff2273f61ced54a2a2c

SHA162ce9c630932d3746cb22b24223b68ed74826151

SHA256217713ca153b9ee45c80d55f473b8cb7a24e0555be8acb456497d962308d5ff6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/index.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:08 GMT
Content-Type: text/css
Content-Length: 650
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/inc/startscript.js

59.188.15.229

200 OK

46 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/inc/startscript.js

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with very long lines (1632), with CRLF, LF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size46 kB (45628 bytes)

MD598215cbcefcb4d302f015e63eb1cb2e6

SHA15bd9e4951d3f0a0a73a3974332d42fa2fadb5cf3

SHA256aec67b597f712f30041c79b0642b9c47ef82694085913bb2513ca600f7fa20d9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/inc/startscript.js HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:08 GMT
Content-Type: application/x-javascript
Content-Encoding: gzip
Content-Length: 45628
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/favicon.gif

59.188.15.229

200 OK

177 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/favicon.gif

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeGIF image data, version 89a, 16 x 16

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size177 B (177 bytes)

MD5e53902658f26ec232ecb55a6bead199a

SHA1865a405f737da7714c687bf0da412a17f58e4630

SHA256210fb26628c5c45974da377188686241f49f897e171e12333b8a0f73c05dd1fa

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/favicon.gif HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:10 GMT
Content-Type: image/gif
Content-Length: 177
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/languages/en/data.xml

59.188.15.229

200 OK

45 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/languages/en/data.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeUnicode text, UTF-8 text, with CRLF line terminators

First Seen2025-02-06

Last Seen2025-02-06

Times Seen1

Size45 kB (44556 bytes)

MD5f98c83a01e755ba558646b19e6ac11c7

SHA16eb547a9ce48d6537dc633a231e8cf5b08fbd2d1

SHA2566cab1d6f43985c2656fe4b9f798e1e200232a09cc88ec510d410a33b9868e176

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/languages/en/data.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:10 GMT
Content-Type: text/xml
Content-Length: 44556
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/frm_login.xml

59.188.15.229

200 OK

212 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/frm_login.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size212 B (212 bytes)

MD55349fb2ee7ae9cf3b7bcc545b071900b

SHA12790ec2d6ba4cf6e743239f9f12457f9978a2806

SHA256df56e0caefd0ecad66b88d6d4bcb8928eb4285e53c72c712483c23e1f15b9c2f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/frm_login.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:11 GMT
Content-Type: text/xml
Content-Length: 212
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/frm_login.tpl

59.188.15.229

200 OK

700 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/frm_login.tpl

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size700 B (700 bytes)

MD50bbb1e8413e9285227f6fe814208866f

SHA1e44d29b63a0900bbb3355a69582c24077c6781db

SHA2566254effe9a1b3fe4427fe25b10630ce63b2cfcc0365e5d3517a7756319690d13

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/templates/frm_login.tpl HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:12 GMT
Content-Type: text/plain
Content-Length: 700
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/frm_login.css

59.188.15.229

200 OK

1.6 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/frm_login.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size1.6 kB (1626 bytes)

MD50859e76c62177e354f6507bdaa8033a9

SHA124af1606d47be7ec0be3c96a73cf51993db23af6

SHA256de164179ca88067b34bceee050bc547ad8aa70eba432e098afcbb9d414358460

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/frm_login.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:12 GMT
Content-Type: text/css
Content-Length: 1626
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_label.xml

59.188.15.229

200 OK

90 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_label.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size90 B (90 bytes)

MD52da6a2fc1e9487ca3985d5367e9cd7ea

SHA13fa5568479f8992f0724b2041ff20a44558e6412

SHA25628756608a6739e3839e1b3b20aa8d886dfbf1f4685e36bd30e66f143d642c017

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_label.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:12 GMT
Content-Type: text/xml
Content-Length: 90
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_tabs.xml

59.188.15.229

200 OK

222 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_tabs.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size222 B (222 bytes)

MD5e72ec9b043cf958b5ef0719b3467d988

SHA1164024376da8ff737fa571ace56058bd36178c43

SHA256bd8d6520492a53b8b9a42521e35b2290452106fd8ee6506e0f9e992b51bc1338

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_tabs.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:12 GMT
Content-Type: text/xml
Content-Length: 222
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_label.css

59.188.15.229

200 OK

253 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_label.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size253 B (253 bytes)

MD57d414d0fc313517bbe2ca8fb014e3356

SHA12326bc1dcee0f0ba24f681e52a02f2a511f15994

SHA256395bef70a2bddac03c733d03ca0b130d12624ab87207c469438e68a73687482e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/obj_label.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:12 GMT
Content-Type: text/css
Content-Length: 253
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_tabs.css

59.188.15.229

200 OK

1.6 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_tabs.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size1.6 kB (1640 bytes)

MD50636b9d598eb20139d56bac562f0ed55

SHA12c5d47bb9583676aa3b2a437efbcf303f642f470

SHA2567b969bce992037ab679215d24c20bd6fa1d27fe964c3c500565d4f056d0a8919

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/obj_tabs.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:13 GMT
Content-Type: text/css
Content-Length: 1640
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_tabs.tpl

59.188.15.229

200 OK

132 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_tabs.tpl

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with no line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size132 B (132 bytes)

MD5b5b65ba268841bdef245b4bbb5ac9dad

SHA1250db5736b5e9ed66e2029b550dbefde8ef9dd2c

SHA256405a3d92460888bd60b15a355226a0f43847d4827d6a18d9fa6c30c19951cb31

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_tabs.tpl HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:13 GMT
Content-Type: text/plain
Content-Length: 132
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_tab.xml

59.188.15.229

200 OK

238 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_tab.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size238 B (238 bytes)

MD5add71c2baf0428a11979be999107ff99

SHA17c37a7aca5bb68c0ef3eabd3d6f4430ac3979863

SHA2562c60b0ccf27b6699a8cbfa458b768e568e12fd6a0813ca1727cabc7fb6881d6e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_tab.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:13 GMT
Content-Type: text/xml
Content-Length: 238
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_tab.tpl

59.188.15.229

200 OK

96 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_tab.tpl

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size96 B (96 bytes)

MD5411f039362e98bb9a5bc9047b14e3c55

SHA134089e348337c7c45473410c27fcee8a6138139d

SHA2567d10e494a6bcf5c9dd3adf31802f51c5458e038c9d85f5e74d0d8c8cd5a7e9dd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_tab.tpl HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:13 GMT
Content-Type: text/plain
Content-Length: 96
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_tab.css

59.188.15.229

200 OK

843 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_tab.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size843 B (843 bytes)

MD594b3c943748f0a6a000248cbbf85ec2e

SHA1c3acbd97aef1dd9e8b9a9a1a44e05d359ee47f4b

SHA25645fedaf6705756b842917268957ebce315f0f704548216dee430dde55464a2f1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/obj_tab.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:13 GMT
Content-Type: text/css
Content-Length: 843
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/frm_login_tab1.tpl

59.188.15.229

200 OK

702 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/frm_login_tab1.tpl

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size702 B (702 bytes)

MD558ce59167836b5575476dff797bfe01f

SHA1bbf1810eb1645e15bea6243b6d8ff3ffe066f8e4

SHA256a03fe2243d6a81b87cfdff9589ebdaac8d9127077559528d774aa0814d3dbabb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/templates/frm_login_tab1.tpl HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:14 GMT
Content-Type: text/plain
Content-Length: 702
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

POST 59.188.15.229/-.._._.--.._1497580140/webmail/server/webmail.php

59.188.15.229

200 OK

2.2 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/server/webmail.php

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typegzip compressed data, from Unix

First Seen2025-02-06

Last Seen2025-02-06

Times Seen1

Size2.2 kB (2190 bytes)

MD5362f06e4f949c941b0776a4fb95a4213

SHA1211fb85772cd98211a0e5a3ce8fffd0693a3a99f

SHA2560d1909340695d96313cbe0018e53bb1572eba69ff07f020c01d26a7750c35e36

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /-.._._.--.._1497580140/webmail/server/webmail.php HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/xml;charset=UTF-8
Content-Length: 192
Origin: http://59.188.15.229
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Connection: close
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:10 GMT
Content-Type: text/json
Content-Encoding: gzip
Vary: Accept-Encoding

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_password.xml

59.188.15.229

200 OK

181 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_password.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size181 B (181 bytes)

MD5db7c34a79c4d64f84a080bc6ddcb4385

SHA13ec34b0622451499c562557ea51accbfd7323eff

SHA2568844c86436f34d14e13567ffb150e1febdc4b864bab62ca8b7f05e1eff51971a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_password.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:14 GMT
Content-Type: text/xml
Content-Length: 181
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_input.css

59.188.15.229

200 OK

1.2 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_input.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size1.2 kB (1164 bytes)

MD5375050f0faa62fefb4ba1a4c6bd96675

SHA19c44e9cb305b5a5fde65ed007df8ca3f081f0888

SHA256b1cdb38708762fb84514a4b8a14ef8e4c66e126f2a3e561679165f7c527250b4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/obj_input.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:14 GMT
Content-Type: text/css
Content-Length: 1164
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_select.xml

59.188.15.229

200 OK

170 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_select.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size170 B (170 bytes)

MD5b4774e549885d113479c93887a5d4859

SHA14c9daa0c18f5e0baac978d1aa371323e0c371120

SHA256a620eed4f494f4367ae312ec4df7c3547b47d894ccc72109ab8cd1f5d0ff80db

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_select.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:15 GMT
Content-Type: text/xml
Content-Length: 170
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_select.tpl

59.188.15.229

200 OK

83 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_select.tpl

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeHTML document, ASCII text, with no line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size83 B (83 bytes)

MD5c186c661b8c2c42186534826dccb0572

SHA1fd2de6092f8bb22ac3975ba6f4e23bf602d97423

SHA256fed98985e4c48e937af5f036c9c250bb8c757ed8b3f66dde3d10d9775f68b4bb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/templates/obj_select.tpl HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:15 GMT
Content-Type: text/plain
Content-Length: 83
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_select.css

59.188.15.229

200 OK

2.2 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_select.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size2.2 kB (2180 bytes)

MD5dd46479e1550844367412cdde95dda76

SHA1cdd4c8642ff3d0ccaa8d0d4c7807beb3083dac80

SHA25668670b015509cb28e85798f07289aac9b9d7271ac33889e01fadc2b175b42fd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/obj_select.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:15 GMT
Content-Type: text/css
Content-Length: 2180
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_button.xml

59.188.15.229

200 OK

129 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_button.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size129 B (129 bytes)

MD5c6f0def7a5082918045b0c78b3dc736a

SHA11fe9d81e2f78715f47c848535ae8566f3fd8f536

SHA256aecba88cef5dd6f4f82c3e5e09b77d04df67d2d7198c7af64f644881b026a54c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_button.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:15 GMT
Content-Type: text/xml
Content-Length: 129
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_button.css

59.188.15.229

200 OK

594 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_button.css

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with CRLF line terminators

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size594 B (594 bytes)

MD542eecbe69be01e5e5434953ab50eb324

SHA1ed6f493ccfcb9061e4430a959f6f8e17d1c84dda

SHA2560c53f788297876b06dc1cf8f996d61abe49077be426366859c4c6b36104cf91e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/css/obj_button.css HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:16 GMT
Content-Type: text/css
Content-Length: 594
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/bg_main.gif

59.188.15.229

200 OK

1.1 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/bg_main.gif

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeGIF image data, version 89a, 1 x 800

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size1.1 kB (1126 bytes)

MD5709f378bef5a5545f1e0f74981c3ae79

SHA1497539f3e69fe1ce38c6c3609a4b109022ada03b

SHA25662d0d780359ad0c1455c1589084cd3981b081b926e3ec8c30a85d49807055e33

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/images/bg_main.gif HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/frm_login.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:16 GMT
Content-Type: image/gif
Content-Length: 1126
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/bg_input.gif

59.188.15.229

200 OK

43 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/bg_input.gif

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeGIF image data, version 89a, 1 x 1

First Seen2023-06-10

Last Seen2025-02-06

Times Seen5

Size43 B (43 bytes)

MD544d3785d2bad2a59b24b675073a31db5

SHA1d92e852d411c898f5d76fede8fc121e54e1992c1

SHA2563b183bd666847edb8729c7933584a175a8d533702e2a3746d11973533490d583

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/images/bg_input.gif HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_input.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:16 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/select.gif

59.188.15.229

200 OK

986 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/select.gif

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeGIF image data, version 89a, 18 x 99

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size986 B (986 bytes)

MD58edc85e721ff1328ff959fbf39fea622

SHA13f7f31a05ceb810eb9c774da720356074c9e9745

SHA256ff1e3d794114fab3e5874eb25764cc7f211a593ed1688fad1e3bc9ebf1666c6f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/images/select.gif HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_select.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:16 GMT
Content-Type: image/gif
Content-Length: 986
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/logo.gif

59.188.15.229

200 OK

3.2 kB

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/logo.gif

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeGIF image data, version 89a, 145 x 200

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size3.2 kB (3207 bytes)

MD5bd9acab966741087ddc4b36cc873005e

SHA1feffbf3f060a148d8abe033568cb1fe7c5bbedeb

SHA256b2e97826df12bdd221757668879bccb4d75e2083aa201d100c53e19aa12aefdf

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/images/logo.gif HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:16 GMT
Content-Type: image/gif
Content-Length: 3207
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/bg_button.gif

59.188.15.229

200 OK

146 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/images/bg_button.gif

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeGIF image data, version 89a, 1 x 19

First Seen2024-12-22

Last Seen2025-02-06

Times Seen2

Size146 B (146 bytes)

MD568e17720140f8d6d38b010e10334bbee

SHA1c4728ebef8bb1cc8295b5dcafc0c6007750e3ad6

SHA256fe499fdac7658af2b6b0a0256db4aa6d0bbd63e706905717da31de52cf853d16

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/skins/default/images/bg_button.gif HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/-.._._.--.._1497580140/webmail/client/skins/default/css/obj_button.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:16 GMT
Content-Type: image/gif
Content-Length: 146
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/webmail/

59.188.15.229

200 OK

1.2 kB

URL

59.188.15.229/webmail/

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (1365), with no line terminators

First Seen2025-02-06

Last Seen2025-02-06

Times Seen1

Size1.2 kB (1245 bytes)

MD5588d4b0046e62885c8e32d989a862ea2

SHA14bf53c22fef632471217c93d66fdb8b63bd5f56d

SHA256cac24a665424a90d2e4612377f2570f2e5b72677185fb939d35449e09b4d1947

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /webmail/ HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Connection: close
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:08 GMT
Content-type: text/html

GET 59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_input.xml

59.188.15.229

200 OK

165 B

URL

59.188.15.229/-.._._.--.._1497580140/webmail/client/objects/obj_input.xml

IP / ASN

59.188.15.229

#17444 HKBN Enterprise Solutions Limited

Requested byhttp://59.188.15.229/webmail/

Resource Info

File typeASCII text, with no line terminators

First Seen2025-02-06

Last Seen2025-02-06

Times Seen1

Size165 B (165 bytes)

MD534c2d380ef773adb629cb7c4c2e7a8b6

SHA11be17371be7462f8c334a3d6e19f0968ef645afa

SHA256c1783573c11c97e2bbdd92405ae093e901ed4d81f8f151febd515a1bd76b5ba2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /-.._._.--.._1497580140/webmail/client/objects/obj_input.xml HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://59.188.15.229/webmail/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: IceWarp/9.4.2
Date: Thu, 06 Feb 2025 00:43:14 GMT
Content-Type: text/xml
Content-Length: 165
Last-Modified: Fri, 16 Jun 2017 02:29:00 GMT
Expires: Fri, 16 Jun 2027 02:29:00 GMT

GET 59.188.15.229/webmail/

0.0.0.0

0 B

URL

59.188.15.229/webmail/

IP / ASN

0.0.0.0

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-02

Times Seen5606143

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /webmail/ HTTP/1.1
Host: 59.188.15.229
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache