Report - 141.98.82.232/g.php

Report Overview

Submitted URL
141.98.82.232/g.php
IP
141.98.82.232
ASN
#209588 Flyservers S.A.
Submitted
2024-04-18 11:39:15
Access
public
Website Title
141.98.82.232/g.php
Final URL
141.98.82.232/g.php
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
141.98.82.232	unknown	unknown	2021-11-25	2023-10-31	731 B	1.7 kB	141.98.82.232

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	141.98.82.232	Sinkholed
2024-04-18	medium	141.98.82.232	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

141.98.82.232/g.php

141.98.82.232

200 OK

950 B

URL User Request GET HTTP/1.1
141.98.82.232/g.php
IP
141.98.82.232:80
ASN
#209588 Flyservers S.A.

File type
JSON text data
Size
950 B (950 bytes)
Hash
c454cb648e21837c19f468cfd04d2294
9150476db3dbe80801c6734dff2078dea34a7916
b1a9dcf7b75344c684d305e32e0555c2d4cb319164fdd5c4e3ef60e16329effb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /g.php HTTP/1.1
Host: 141.98.82.232
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 11:38:49 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
X-Powered-By: PHP/5.4.16
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 950
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

141.98.82.232/favicon.ico

141.98.82.232

404 Not Found

159 B

URL GET HTTP/1.1
141.98.82.232/favicon.ico
IP
141.98.82.232:80
ASN
#209588 Flyservers S.A.

Requested by
http://141.98.82.232/g.php

File type
HTML document, ASCII text
Size
159 B (159 bytes)
Hash
d712abd92f49eebc1bc76f1220c26d16
a192d4e0b4bb9ae8745702528434272b5bc9d60b
568134f73c2f1e1fba6b9c406f4e3ce50f5eb45758ce46bab774bf603bae7ad5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 141.98.82.232
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://141.98.82.232/g.php
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Thu, 18 Apr 2024 11:38:49 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 159
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers