Report - 44.203.4.206:443/login

Report Overview

Submitted URL
44.203.4.206:443/login
IP
44.203.4.206
ASN
#14618 AMAZON-AES
Submitted
2024-04-17 23:38:48
Access
public
Website Title
Cardinal Wizard
Final URL
44.203.4.206:443/login
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
44.203.4.206:443	unknown	unknown	No data	No data	1.5 kB	209 kB	44.203.4.206
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-17	469 B	7.7 kB	104.17.24.14
cdn.jsdelivr.net	439	2012-05-16	2012-09-30	2024-04-17	953 B	52 kB	151.101.65.229
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-17	444 B	25 kB	151.101.66.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	44.203.4.206	Sinkholed
2024-04-17	medium	44.203.4.206	Sinkholed
2024-04-17	medium	44.203.4.206	Sinkholed
2024-04-17	medium	44.203.4.206	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js	78 kB	2023-03-07	2024-04-29
Pretty URL cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js IP 151.101.65.229 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:26 Last Seen2024-04-29 18:22:06 Times Seen8952 Hash 7ccd9d390d31af98110f74f842ea9b32 a85e681624c91a106a514c31eacf80de817b2cc3 f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3 Loading...

	code.jquery.com/jquery-3.3.1.slim.min.js	70 kB	2023-03-07	2024-04-30
Pretty URL code.jquery.com/jquery-3.3.1.slim.min.js IP 151.101.66.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:54 Last Seen2024-04-30 18:41:39 Times Seen8450 Hash 99b0a83cf1b0b1e2cb16041520e87641 bc5836992c0b260496ba520fe1336d499bf06eb7 dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Loading...

	cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js	21 kB	2023-03-07	2024-04-30
Pretty URL cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:27 Last Seen2024-04-30 19:37:46 Times Seen16834 Hash 56456db9d72a4b380ed3cb63095e6022 6dbce88aee15b42f29083df7a07513cf3b486ba0 66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2 Loading...

HTTP Transactions (8)

URL IP Response Size

44.203.4.206:443/login

44.203.4.206

200 OK

2.9 kB

URL User Request GET HTTP/1.1
44.203.4.206:443/login
IP
44.203.4.206:443
ASN
#14618 AMAZON-AES

File type
HTML document, ASCII text
Size
2.9 kB (2891 bytes)
Hash
8fa21791e8f036d46b680b95b41f373c
2435bffb2c62fe8126147f3f7ee38c8db9043870
643d9a16defea5206fa0d9563ee8b9678c4c5d974f47693be1da0bda822a6973

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /login HTTP/1.1
Host: 44.203.4.206:443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Werkzeug/3.0.2 Python/3.9.16
Date: Wed, 17 Apr 2024 23:38:23 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2891
Connection: close

cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js

104.17.24.14

200 OK

6.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
http://44.203.4.206:443/login
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (20831)
Size
6.6 kB (6646 bytes)
Hash
56456db9d72a4b380ed3cb63095e6022
6dbce88aee15b42f29083df7a07513cf3b486ba0
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2

HTTP Headers

GET /ajax/libs/popper.js/1.14.7/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://44.203.4.206:443
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 17 Apr 2024 23:38:23 GMT
content-type: application/javascript; charset=utf-8
content-length: 6646
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-520c"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 578619
expires: Mon, 07 Apr 2025 23:38:23 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dKmrJ8BZCEMvTkirxf6Fv7CSekQEbarTtZ2W2oHMpAdSYcvo8DaHGVjZgVK13Vkl%2BXxgwSxLRokRHVVMmMAiwbp0GglCufwLBdRLzFK1RHpDzjdp3T%2B%2Buz3hZhxXfg0FCjLVL4mW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87603f98298c712e-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js

151.101.65.229

200 OK

24 kB

URL GET HTTP/2
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js
IP
151.101.65.229:443
ASN
#54113 FASTLY

Requested by
http://44.203.4.206:443/login
Certificate
IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09
ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT

File type
JavaScript source, ASCII text, with very long lines (65299)
Size
24 kB (24376 bytes)
Hash
7ccd9d390d31af98110f74f842ea9b32
a85e681624c91a106a514c31eacf80de817b2cc3
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3

HTTP Headers

GET /npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://44.203.4.206:443
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 5.1.3
x-jsd-version-type: version
etag: W/"13131-qF5oFiTJGhBqUUwx6s+A3oF7LMM"
content-encoding: br
accept-ranges: bytes
date: Wed, 17 Apr 2024 23:38:23 GMT
age: 28936444
x-served-by: cache-fra-eddf8230075-FRA, cache-hel1410028-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 24376
X-Firefox-Spdy: h2

cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css

151.101.65.229

200 OK

26 kB

URL GET HTTP/2
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css
IP
151.101.65.229:443
ASN
#54113 FASTLY

Requested by
http://44.203.4.206:443/login
Certificate
IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09
ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT

File type
Unicode text, UTF-8 text, with very long lines (65306)
Size
26 kB (26333 bytes)
Hash
94994c66fec8c3468b269dc0cc242151
ec16bd19bf4ae9bc2e2336ac409a503bbbdaacad
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab

HTTP Headers

GET /npm/bootstrap@5.1.3/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://44.203.4.206:443
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 5.1.3
x-jsd-version-type: version
etag: W/"28021-7Ba9Gb9K6bwuIzasQJpQO7varK0"
content-encoding: br
accept-ranges: bytes
date: Wed, 17 Apr 2024 23:38:23 GMT
age: 156845
x-served-by: cache-fra-etou8220101-FRA, cache-hel1410028-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 26333
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.3.1.slim.min.js

151.101.66.137

200 OK

24 kB

URL GET HTTP/2
code.jquery.com/jquery-3.3.1.slim.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
http://44.203.4.206:443/login
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65247)
Size
24 kB (24038 bytes)
Hash
99b0a83cf1b0b1e2cb16041520e87641
bc5836992c0b260496ba520fe1336d499bf06eb7
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

HTTP Headers

GET /jquery-3.3.1.slim.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://44.203.4.206:443
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-1111d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Wed, 17 Apr 2024 23:38:23 GMT
age: 18596503
x-served-by: cache-lga21982-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 97, 113248
x-timer: S1713397103.445452,VS0,VE0
vary: Accept-Encoding
content-length: 24038
X-Firefox-Spdy: h2

44.203.4.206:443/static/styles/login.css

44.203.4.206

200 OK

78 B

URL GET HTTP/1.1
44.203.4.206:443/static/styles/login.css
IP
44.203.4.206:443
ASN
#14618 AMAZON-AES

Requested by
http://44.203.4.206:443/login

File type
ASCII text
Size
78 B (78 bytes)
Hash
c1f1f43595322f3f955f08c38944ffb8
0464d9d2abb8c139157a310e8555b7af329dfee1
c7f2ce10c50e4df6480b63fa895cffb2de4e3f12580338a201613502b4c0ca9b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/styles/login.css HTTP/1.1
Host: 44.203.4.206:443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Werkzeug/3.0.2 Python/3.9.16
Content-Disposition: inline; filename=login.css
Content-Type: text/css; charset=utf-8
Content-Length: 78
Last-Modified: Tue, 22 Feb 2022 09:12:14 GMT
Cache-Control: no-cache
ETag: "1645521134.0-78-3587248871"
Date: Wed, 17 Apr 2024 23:38:23 GMT, Wed, 17 Apr 2024 23:38:23 GMT
Connection: close

44.203.4.206:443/favicon.ico

44.203.4.206

404 NOT FOUND

0 B

URL GET HTTP/1.1
44.203.4.206:443/favicon.ico
IP
44.203.4.206:443
ASN
#14618 AMAZON-AES

Requested by
http://44.203.4.206:443/login

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 44.203.4.206:443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 NOT FOUND
Server: Werkzeug/3.0.2 Python/3.9.16
Date: Wed, 17 Apr 2024 23:38:23 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: close

44.203.4.206:443/static/CardinalWizard.png

44.203.4.206

200 OK

205 kB

URL GET HTTP/1.1
44.203.4.206:443/static/CardinalWizard.png
IP
44.203.4.206:443
ASN
#14618 AMAZON-AES

Requested by
http://44.203.4.206:443/login

File type
PNG image data, 1999 x 1999, 8-bit/color RGBA, non-interlaced
Size
205 kB (205171 bytes)
Hash
28b6f038b9ad4f68afd8da0194c4929d
d4d9b98460861a1ae8cfeda36f2e794e0c2ba72d
8669be078ef95c62bedf23aea7e813bb0b849ec86464e3a09a566d033be40305

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/CardinalWizard.png HTTP/1.1
Host: 44.203.4.206:443
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://44.203.4.206:443/login
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: Werkzeug/3.0.2 Python/3.9.16
Content-Disposition: inline; filename=CardinalWizard.png
Content-Type: image/png
Content-Length: 205171
Last-Modified: Fri, 11 Feb 2022 14:15:44 GMT
Cache-Control: no-cache
ETag: "1644588944.0-205171-4185199494"
Date: Wed, 17 Apr 2024 23:38:23 GMT, Wed, 17 Apr 2024 23:38:23 GMT
Connection: close

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (8)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type