Report - 38.18.231.74/workstation/adm.php

Report Overview

Submitted URL
38.18.231.74/workstation/adm.php
IP
38.18.231.74
ASN
#397423 TIER-NET
Submitted
2024-04-26 08:35:30
Access
public
Website Title
U-Panel | 2.9
Final URL
38.18.231.74/workstation/adm.php
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
24

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
38.18.231.74	unknown	unknown	No data	No data	5.1 kB	224 kB	38.18.231.74

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed
2024-04-26	medium	38.18.231.74	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	38.18.231.74/workstation/js/main.js	2.5 kB	2023-03-07	2024-04-30
Pretty URL 38.18.231.74/workstation/js/main.js IP 38.18.231.74 ASN #397423 TIER-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:28:30 Last Seen2024-04-30 10:39:16 Times Seen38 Hash 4c88796bd8879febb4924513a18d804e 9efb5f2ed6a8cc40a58896609f6992d709f7f60f 9e4ba8ff7e82c30802a576bbd57f4e3df31708dfaea857c3f61bb3cf462722f2 Loading...

	38.18.231.74/workstation/bower_components/jquery/dist/jquery.min.js	88 kB	2023-03-07	2024-05-06
Pretty URL 38.18.231.74/workstation/bower_components/jquery/dist/jquery.min.js IP 38.18.231.74 ASN #397423 TIER-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-05-06 14:01:24 Times Seen97125 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

	38.18.231.74/workstation/bower_components/remarkable-bootstrap-notify/dist/bootstrap-notify.min.js	8.1 kB	2023-03-07	2024-05-03
Pretty URL 38.18.231.74/workstation/bower_components/remarkable-bootstrap-notify/dist/bootstrap-notify.min.js IP 38.18.231.74 ASN #397423 TIER-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:28:30 Last Seen2024-05-03 22:47:47 Times Seen215 Hash 35eb2c2185524eecb2b772b667552014 a9edf0014d98a9cb514c61b34d2a4babb4a1d4c9 2db9de4f5fc27837d4295df39d94c34ccc336c31d02322f7f7cad69ae8e338da Loading...

	38.18.231.74/workstation/js/login.js	499 B	2023-03-07	2024-04-30
Pretty URL 38.18.231.74/workstation/js/login.js IP 38.18.231.74 ASN #397423 TIER-NET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 18:28:30 Last Seen2024-04-30 10:39:16 Times Seen61 Hash e29f9c478aa4211af376fc86861cb284 a081f58f840705f13d47b27bb5401617b6e81975 b513569cd5254fa5786b931d0080e05a67e05e8c5945b318fc2d56079371ba47 Loading...

HTTP Transactions (12)

URL IP Response Size

38.18.231.74/workstation/adm.php

38.18.231.74

904 B

URL User Request GET
38.18.231.74/workstation/adm.php
IP
38.18.231.74:0
ASN
#397423 TIER-NET

File type
HTML document, ASCII text
Size
904 B (904 bytes)
Hash
aec30911b0754db9e03baf47df005684
8dcaa8b7bd8a622c81dd86125fdd454a35052a8f
7fa06d86a1eb81c1a1dac53afd9e5346811c62162d536b8da0b67c35f75aab7d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/adm.php HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:05 GMT
Server: Apache/2.4.18 (Ubuntu)
Set-Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 904
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

38.18.231.74/workstation/bower_components/font-awesome/css/font-awesome.min.css

38.18.231.74

404 Not Found

274 B

URL GET HTTP/1.1
38.18.231.74/workstation/bower_components/font-awesome/css/font-awesome.min.css
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
HTML document, ASCII text
Size
274 B (274 bytes)
Hash
47a320e548dddfdf3040e04a198e079e
d71d3d56725291eec68431a80442075d15f4216b
5a4b781d6b0b70205334ae73a5f7fa01ba9565da88ad69e64aeaa17526c985f3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/bower_components/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 274
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

38.18.231.74/workstation/bower_components/animate.css/animate.min.css

38.18.231.74

200 OK

4.3 kB

URL GET HTTP/1.1
38.18.231.74/workstation/bower_components/animate.css/animate.min.css
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
ASCII text, with very long lines (57919)
Size
4.3 kB (4259 bytes)
Hash
bc1a6a99c43f5ccc97d2d350bde13f74
29a6f54569c193ffd6116f03be3eb42359c60eb7
3c770e90f98eb21b0c042fafb49755af93306fbaf42e449524f94fae9fc83295

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/bower_components/animate.css/animate.min.css HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:23 GMT
ETag: "e311-5f5e7851bdec0-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4259
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

38.18.231.74/workstation/js/main.js

38.18.231.74

200 OK

998 B

URL GET HTTP/1.1
38.18.231.74/workstation/js/main.js
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
JavaScript source, ASCII text
Size
998 B (998 bytes)
Hash
4c88796bd8879febb4924513a18d804e
9efb5f2ed6a8cc40a58896609f6992d709f7f60f
9e4ba8ff7e82c30802a576bbd57f4e3df31708dfaea857c3f61bb3cf462722f2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/js/main.js HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:50 GMT
ETag: "9da-5f5e786b7db80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 998
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript

38.18.231.74/workstation/node_modules/bootstrap-notify/bootstrap-notify.min.js

38.18.231.74

404 Not Found

274 B

URL GET HTTP/1.1
38.18.231.74/workstation/node_modules/bootstrap-notify/bootstrap-notify.min.js
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
HTML document, ASCII text
Size
274 B (274 bytes)
Hash
47a320e548dddfdf3040e04a198e079e
d71d3d56725291eec68431a80442075d15f4216b
5a4b781d6b0b70205334ae73a5f7fa01ba9565da88ad69e64aeaa17526c985f3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/node_modules/bootstrap-notify/bootstrap-notify.min.js HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 274
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

38.18.231.74/workstation/bower_components/remarkable-bootstrap-notify/dist/bootstrap-notify.min.js

38.18.231.74

200 OK

2.7 kB

URL GET HTTP/1.1
38.18.231.74/workstation/bower_components/remarkable-bootstrap-notify/dist/bootstrap-notify.min.js
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
JavaScript source, ASCII text, with very long lines (7883)
Size
2.7 kB (2651 bytes)
Hash
35eb2c2185524eecb2b772b667552014
a9edf0014d98a9cb514c61b34d2a4babb4a1d4c9
2db9de4f5fc27837d4295df39d94c34ccc336c31d02322f7f7cad69ae8e338da

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/bower_components/remarkable-bootstrap-notify/dist/bootstrap-notify.min.js HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:50 GMT
ETag: "1fba-5f5e786b7db80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2651
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

38.18.231.74/workstation/js/login.js

38.18.231.74

200 OK

257 B

URL GET HTTP/1.1
38.18.231.74/workstation/js/login.js
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
ASCII text
Size
257 B (257 bytes)
Hash
e29f9c478aa4211af376fc86861cb284
a081f58f840705f13d47b27bb5401617b6e81975
b513569cd5254fa5786b931d0080e05a67e05e8c5945b318fc2d56079371ba47

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/js/login.js HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:50 GMT
ETag: "1f3-5f5e786b7db80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 257
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

38.18.231.74/workstation/css/main.css

38.18.231.74

200 OK

175 B

URL GET HTTP/1.1
38.18.231.74/workstation/css/main.css
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
ASCII text
Size
175 B (175 bytes)
Hash
045f2d94c28b3c073a55d64d42ad3cc0
486067d51e3a604b712f2348b09d9ac3b21ac026
4d7f17c85fc247337a7d70f3993fa104a10f019a5af5131d0a30a55287a0320f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/css/main.css HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:50 GMT
ETag: "c9-5f5e786b7db80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 175
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

38.18.231.74/workstation/bower_components/bootstrap/dist/css/bootstrap.min.css

38.18.231.74

200 OK

21 kB

URL GET HTTP/1.1
38.18.231.74/workstation/bower_components/bootstrap/dist/css/bootstrap.min.css
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
ASCII text, with very long lines (65325)
Size
21 kB (20560 bytes)
Hash
450fc463b8b1a349df717056fbb3e078
895125a4522a3b10ee7ada06ee6503587cbf95c5
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/bower_components/bootstrap/dist/css/bootstrap.min.css HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:29 GMT
ETag: "235ed-5f5e785776c40-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20560
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

38.18.231.74/workstation/bower_components/jquery/dist/jquery.min.js

38.18.231.74

200 OK

31 kB

URL GET HTTP/1.1
38.18.231.74/workstation/bower_components/jquery/dist/jquery.min.js
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
31 kB (30677 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/bower_components/jquery/dist/jquery.min.js HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:38 GMT
ETag: "15851-5f5e78600c080-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 30677
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript

38.18.231.74/workstation/node_modules/bootstrap-notify/bootstrap-notify.min.js

38.18.231.74

404 Not Found

274 B

URL GET HTTP/1.1
38.18.231.74/workstation/node_modules/bootstrap-notify/bootstrap-notify.min.js
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
HTML document, ASCII text
Size
274 B (274 bytes)
Hash
47a320e548dddfdf3040e04a198e079e
d71d3d56725291eec68431a80442075d15f4216b
5a4b781d6b0b70205334ae73a5f7fa01ba9565da88ad69e64aeaa17526c985f3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/node_modules/bootstrap-notify/bootstrap-notify.min.js HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 274
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

38.18.231.74/workstation/favicon.png

38.18.231.74

200 OK

159 kB

URL GET HTTP/1.1
38.18.231.74/workstation/favicon.png
IP
38.18.231.74:80
ASN
#397423 TIER-NET

Requested by
http://38.18.231.74/workstation/adm.php

File type
PNG image data, 2400 x 2400, 8-bit/color RGBA, non-interlaced
Size
159 kB (158609 bytes)
Hash
bc9ec1ce2b3b187e1c784bdf453c5f74
14e373989429a64e604d8a8f0109410b27a8278c
b8dd4e5e40971531462e67f59f5b5a38217da56859711bd99311a21b8e940324

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /workstation/favicon.png HTTP/1.1
Host: 38.18.231.74
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://38.18.231.74/workstation/adm.php
Cookie: PHPSESSID=n4g6s9c6npaem0jquie4tkqo81
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 26 Apr 2024 08:35:06 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 02 Mar 2023 09:33:22 GMT
ETag: "26b91-5f5e7850c9c80"
Accept-Ranges: bytes
Content-Length: 158609
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (12)

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections