Report - 115.126.6.16/login

Report Overview

Submitted URL
115.126.6.16/login
IP
115.126.6.16
ASN
#38186 Forewin Telecom Group Limited, ISP at
Submitted
2024-05-07 11:46:14
Access
public
Website Title
登录
Final URL
115.126.6.16/login#/login
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
28

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
115.126.6.16	unknown	unknown	No data	No data	4.9 kB	839 kB	115.126.6.16

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed
2024-05-07	medium	115.126.6.16	Sinkholed

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	115.126.6.16/static/js/manifest.f7b3364de16d34248d55.js	5.6 kB	2024-05-07	2024-05-07
Pretty URL 115.126.6.16/static/js/manifest.f7b3364de16d34248d55.js IP 115.126.6.16 ASN #38186 Forewin Telecom Group Limited, ISP at Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 13:46:21 Last Seen2024-05-07 13:46:21 Times Seen2 Hash 93bc8e128f6f65636c91303ae16c417a 20cdcde267c4eed4608f022a6b035e9f678dd8ef 4355c5c32a575325af17060a0dadc7b1fb0dc400bd787f53fd61991c895b3ae5 Loading...

	115.126.6.16/static/js/vendor.7df09357cd59b356e3c1.js	896 kB	2024-02-18	2024-05-07
Pretty URL 115.126.6.16/static/js/vendor.7df09357cd59b356e3c1.js IP 115.126.6.16 ASN #38186 Forewin Telecom Group Limited, ISP at Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-18 20:35:40 Last Seen2024-05-07 13:46:21 Times Seen4 Hash 2a19ddfadfd9504646bf08121659420a d22d24f72cac868b5a6b3c6ab6a751046053099e a08f017688e119122e461705e543cd860327da42f7db3570fb889c613753c356 Loading...

	115.126.6.16/static/js/app.c81fdbf133104a422682.js	204 kB	2024-05-07	2024-05-07
Pretty URL 115.126.6.16/static/js/app.c81fdbf133104a422682.js IP 115.126.6.16 ASN #38186 Forewin Telecom Group Limited, ISP at Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 13:46:21 Last Seen2024-05-07 13:46:21 Times Seen2 Hash 4b55e9993c60714784e9920203cb2469 59d135cc1b82cb5bf8d37fa405808b73dece5958 f77cc1f546cedbe2aa78868b6a115dc21c5bb89ee6c463f724cd5b7c417a6395 Loading...

	unknown	54 B	2023-04-12	2024-05-19
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-12 08:25:39 Last Seen2024-05-19 08:14:45 Times Seen9833 Hash fcaea4b8885ca5c1fb3ddd5c490da5c6 35745f87b37210d992a9ed534a593ae500b7adaa 934c2008743c36db746a9d6ebd9f1b84ff11477edc55fbf7b599bbfa687f7272 Loading...

	115.126.6.16/static/js/119.38a353c80908ec38583b.js	844 B	2024-05-07	2024-05-07
Pretty URL 115.126.6.16/static/js/119.38a353c80908ec38583b.js IP 115.126.6.16 ASN #38186 Forewin Telecom Group Limited, ISP at Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 13:46:21 Last Seen2024-05-07 13:46:21 Times Seen2 Hash 59d93170ac476b8075bfb98542a2c64a 9e483d33f444d397e1bb151b0a71a3a06c843ca7 f9a6425ed4d145372f3a964d53b256a87bfeb0c33a9217887276501b7d92adb9 Loading...

	115.126.6.16/static/js/6.701db473af17552f97df.js	365 kB	2024-05-07	2024-05-07
Pretty URL 115.126.6.16/static/js/6.701db473af17552f97df.js IP 115.126.6.16 ASN #38186 Forewin Telecom Group Limited, ISP at Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 13:46:21 Last Seen2024-05-07 13:46:21 Times Seen2 Hash 7043310a28042fabb86e0a114a46996f e897de74215a8975d536b92d8f78d06ac7a62e99 f9f4f8d910abaa8ee919583ca75d7589b00d6192bde9459f4476ba0eaec04a54 Loading...

	115.126.6.16/login	22 B	2023-03-13	2024-05-07
Pretty URL 115.126.6.16/login IP 115.126.6.16 ASN #38186 Forewin Telecom Group Limited, ISP at Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:56:27 Last Seen2024-05-07 13:46:21 Times Seen19 Hash 4115cbae590d65f7f307e7172f1b1eae d9f2a9393367c18c97829d7cd77543dbb3531e86 cfa4859c5afd93e6e5f70bf5dcd3c0698130a1f0a79b47bb09688682ce6fe790 Loading...

HTTP Transactions (14)

URL IP Response Size

115.126.6.16/login

115.126.6.16

1.7 kB

URL User Request GET
115.126.6.16/login
IP
115.126.6.16:0
ASN
#38186 Forewin Telecom Group Limited, ISP at

File type
HTML document, Unicode text, UTF-8 text, with very long lines (492)
Size
1.7 kB (1720 bytes)
Hash
06e34ff7881723f0f3f9c7d2bcfab509
f9153b92c45fa0620f00901249f3d3295209af60
9112a728750779a624723bf12beb30b9164f6eae76ea9702b65c3473d35516f7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:48 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 1720
Last-Modified: Fri, 01 Mar 2024 02:49:47 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082348
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e1424b-6b8"
Accept-Ranges: bytes

115.126.6.16/static/css/oem.css

115.126.6.16

200 OK

0 B

URL GET HTTP/1.1
115.126.6.16/static/css/oem.css
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/css/oem.css HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:48 GMT
Content-Type: text/css
Content-Length: 0
Last-Modified: Mon, 05 Jun 2023 07:46:49 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082348
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "647d92e9-0"
Accept-Ranges: bytes

115.126.6.16/static/css/app.7a4ca0659015f97d58ee5a112ad1ba61.css

115.126.6.16

200 OK

99 kB

URL GET HTTP/1.1
115.126.6.16/static/css/app.7a4ca0659015f97d58ee5a112ad1ba61.css
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
Unicode text, UTF-8 text, with very long lines (65520), with no line terminators
Size
99 kB (98666 bytes)
Hash
2bf243140b770aae443fd00b4e1270b9
ca0b5893e83b755c9e1c0b379066cd344afe34de
ee9586b3a5048ba2ee0fe57279aacddd745fa85c32667d402142672e5657bcb9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/css/app.7a4ca0659015f97d58ee5a112ad1ba61.css HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:48 GMT
Content-Type: text/css
Content-Length: 98666
Last-Modified: Mon, 26 Feb 2024 02:46:58 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082348
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65dbfba2-1816a"
Content-Encoding: gzip

115.126.6.16/static/js/app.c81fdbf133104a422682.js

115.126.6.16

200 OK

51 kB

URL GET HTTP/1.1
115.126.6.16/static/js/app.c81fdbf133104a422682.js
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (65474), with no line terminators
Size
51 kB (51197 bytes)
Hash
4b55e9993c60714784e9920203cb2469
59d135cc1b82cb5bf8d37fa405808b73dece5958
f77cc1f546cedbe2aa78868b6a115dc21c5bb89ee6c463f724cd5b7c417a6395

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/app.c81fdbf133104a422682.js HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:48 GMT
Content-Type: application/javascript
Content-Length: 51197
Last-Modified: Thu, 29 Feb 2024 08:31:52 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082348
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e040f8-c7fd"
Content-Encoding: gzip

115.126.6.16/static/js/manifest.f7b3364de16d34248d55.js

115.126.6.16

200 OK

3.3 kB

URL GET HTTP/1.1
115.126.6.16/static/js/manifest.f7b3364de16d34248d55.js
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JavaScript source, ASCII text, with very long lines (5642), with no line terminators
Size
3.3 kB (3318 bytes)
Hash
93bc8e128f6f65636c91303ae16c417a
20cdcde267c4eed4608f022a6b035e9f678dd8ef
4355c5c32a575325af17060a0dadc7b1fb0dc400bd787f53fd61991c895b3ae5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/manifest.f7b3364de16d34248d55.js HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:49 GMT
Content-Type: application/javascript
Content-Length: 3318
Last-Modified: Fri, 01 Mar 2024 02:49:47 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082349
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e1424b-cf6"
Content-Encoding: gzip

115.126.6.16/static/js/vendor.7df09357cd59b356e3c1.js

115.126.6.16

200 OK

292 kB

URL GET HTTP/1.1
115.126.6.16/static/js/vendor.7df09357cd59b356e3c1.js
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JavaScript source, ASCII text, with very long lines (58624)
Size
292 kB (291664 bytes)
Hash
2a19ddfadfd9504646bf08121659420a
d22d24f72cac868b5a6b3c6ab6a751046053099e
a08f017688e119122e461705e543cd860327da42f7db3570fb889c613753c356

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/vendor.7df09357cd59b356e3c1.js HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:48 GMT
Content-Type: application/javascript
Content-Length: 291664
Last-Modified: Thu, 29 Feb 2024 08:31:52 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082348
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e040f8-47350"
Content-Encoding: gzip

115.126.6.16/favicon64.ico

115.126.6.16

302 Moved Temporarily

138 B

URL GET HTTP/1.1
115.126.6.16/favicon64.ico
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
HTML document, ASCII text, with CRLF line terminators
Size
138 B (138 bytes)
Hash
588bc2b71d7cb991e160df632be532f2
2a7fa5bff034be5cb7d0f8f4ffbf10e04f199b17
c46dcd0813d69a390ffe9c2d1ac68556eba4307f58b1e61433120fee36d6244e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon64.ico HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Date: Tue, 07 May 2024 11:45:50 GMT
Content-Type: text/html
Content-Length: 138
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082350
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
Location: /login

115.126.6.16/login

115.126.6.16

1.7 kB

URL User Request GET
115.126.6.16/login
IP
115.126.6.16:0
ASN
#38186 Forewin Telecom Group Limited, ISP at

File type
HTML document, Unicode text, UTF-8 text, with very long lines (492)
Size
1.7 kB (1720 bytes)
Hash
06e34ff7881723f0f3f9c7d2bcfab509
f9153b92c45fa0620f00901249f3d3295209af60
9112a728750779a624723bf12beb30b9164f6eae76ea9702b65c3473d35516f7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://115.126.6.16/login
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:50 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 1720
Last-Modified: Fri, 01 Mar 2024 02:49:47 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082350
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e1424b-6b8"
Accept-Ranges: bytes

115.126.6.16/static/i18n/zh-CN.json

115.126.6.16

200 OK

262 kB

URL GET HTTP/1.1
115.126.6.16/static/i18n/zh-CN.json
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JSON text data
Size
262 kB (261714 bytes)
Hash
270dea958025699f1587d5b3a0f98b49
965c0094f4a85899a6520898057a47a5cfa6b494
70e98b53181a40c80727d6280e10984cc449ee2cc4cc7e1bd3d7b99a4b581800

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/i18n/zh-CN.json HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:50 GMT
Content-Type: application/json
Content-Length: 261714
Last-Modified: Fri, 01 Mar 2024 02:49:47 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082350
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e1424b-3fe52"
Accept-Ranges: bytes

115.126.6.16/static/js/119.38a353c80908ec38583b.js

115.126.6.16

200 OK

488 B

URL GET HTTP/1.1
115.126.6.16/static/js/119.38a353c80908ec38583b.js
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JavaScript source, ASCII text, with very long lines (844), with no line terminators
Size
488 B (488 bytes)
Hash
59d93170ac476b8075bfb98542a2c64a
9e483d33f444d397e1bb151b0a71a3a06c843ca7
f9a6425ed4d145372f3a964d53b256a87bfeb0c33a9217887276501b7d92adb9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/119.38a353c80908ec38583b.js HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:51 GMT
Content-Type: application/javascript
Content-Length: 488
Last-Modified: Thu, 29 Feb 2024 08:31:52 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082351
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e040f8-1e8"
Content-Encoding: gzip

115.126.6.16/static/js/first.json

115.126.6.16

200 OK

799 B

URL GET HTTP/1.1
115.126.6.16/static/js/first.json
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JSON text data
Size
799 B (799 bytes)
Hash
ee647994907cd5618e2363d68a0e3f0c
5dfb04b3ce7ea339633c3267e64d356862fe32ed
bf6845f80bcc706825a0e9fca95e791085d23e86433332a3ab23b42628ecf4fd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/first.json HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:53 GMT
Content-Type: application/json
Content-Length: 799
Last-Modified: Tue, 05 Mar 2024 02:41:13 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082353
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e68649-31f"
Accept-Ranges: bytes

115.126.6.16/static/js/6.701db473af17552f97df.js

115.126.6.16

200 OK

116 kB

URL GET HTTP/1.1
115.126.6.16/static/js/6.701db473af17552f97df.js
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (65516), with no line terminators
Size
116 kB (116084 bytes)
Hash
7043310a28042fabb86e0a114a46996f
e897de74215a8975d536b92d8f78d06ac7a62e99
f9f4f8d910abaa8ee919583ca75d7589b00d6192bde9459f4476ba0eaec04a54

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/6.701db473af17552f97df.js HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:53 GMT
Content-Type: application/javascript
Content-Length: 116084
Last-Modified: Thu, 29 Feb 2024 08:31:52 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082353
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e040f8-1c574"
Content-Encoding: gzip

115.126.6.16/static/js/first.json

115.126.6.16

200 OK

799 B

URL GET HTTP/1.1
115.126.6.16/static/js/first.json
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
JSON text data
Size
799 B (799 bytes)
Hash
ee647994907cd5618e2363d68a0e3f0c
5dfb04b3ce7ea339633c3267e64d356862fe32ed
bf6845f80bcc706825a0e9fca95e791085d23e86433332a3ab23b42628ecf4fd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/first.json HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:55 GMT
Content-Type: application/json
Content-Length: 799
Last-Modified: Tue, 05 Mar 2024 02:41:13 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082355
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "65e68649-31f"
Accept-Ranges: bytes

115.126.6.16/static/img/logo_FE_PC_zh.46d5744.svg

115.126.6.16

200 OK

4.6 kB

URL GET HTTP/1.1
115.126.6.16/static/img/logo_FE_PC_zh.46d5744.svg
IP
115.126.6.16:80
ASN
#38186 Forewin Telecom Group Limited, ISP at

Requested by
http://115.126.6.16/login

File type
SVG Scalable Vector Graphics image
Size
4.6 kB (4559 bytes)
Hash
cfcadf6acb5d54a2652d3f0667491369
c22b4407482867b1996d77d8a5bb599b5d945c7e
11160cf6526885ef373be4d8753993bb31f1a2f1d9ec160308347707efff6fb8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/img/logo_FE_PC_zh.46d5744.svg HTTP/1.1
Host: 115.126.6.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://115.126.6.16/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 11:45:55 GMT
Content-Type: image/svg+xml
Content-Length: 4559
Last-Modified: Mon, 05 Jun 2023 07:46:49 GMT
Connection: close
Server: Nginx
Expires: 0
Pragma: no-cache
Cache-Control: no-cache
X-LANG: 1
X-Timezone: 0800
X-Timestamp: 1715082355
X-Arch: x86
X-Sysbit: x64
X-Enterprise: 0
X-Support-i18n: 0
X-Support-wifi: 0
X-Default-IP: 0
ETag: "647d92e9-11cf"
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL User Request GET

IP

ASN

File type

Size

Hash

Detections