| cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/intlTelInput.min.js |  104.17.24.14 | 200 OK | 8.9 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/intlTelInput.min.js IP104.17.24.14:443
Requested byhttp://159.223.66.188/login CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (26997) Hashf38113141ba37f6d39da0f22fb96702a bec789ca106293f96d2cf31285236398776b911e 64cb11eb2a5237cbe1e05ccf25acefeed578f32d1a6923d58de35c8a0145e8cd
GET /ajax/libs/intl-tel-input/17.0.8/js/intlTelInput.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 25 Apr 2024 09:17:41 GMT
content-type: application/javascript; charset=utf-8
content-length: 8889
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5f902e0e-72d9"
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1254127
expires: Tue, 15 Apr 2025 09:17:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IJkIybhU%2BrkO1TvS5vbU62QhAL25FQs9LSWx06NIuz7I9%2FLE8eJgjP7Oo5mvHcrlieqZMaL080Y2KjynOHBjIStBOGIfZQRy85JI1bajLdBcZJ1mscYpO4ymWJRuOj5fM4cJ2AQA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 879d3dcb8c98568f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/select2/4.0.9/js/select2.min.js | 104.17.24.14 | 200 OK | 16 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/select2/4.0.9/js/select2.min.js IP104.17.24.14:443
Requested byhttp://159.223.66.188/login CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (64132) Hasheefa8c8fe31d8d376c221869e52957e8 5f5dd1daab6ae5f75db43296ff20e5f159dcc255 0fce1e5c583c735582696477bec14d42051e60c74680e5d4b3b757c8c6f1ef40
GET /ajax/libs/select2/4.0.9/js/select2.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://159.223.66.188
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 25 Apr 2024 09:17:41 GMT
content-type: application/javascript; charset=utf-8
content-length: 16303
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fcb-111d7"
last-modified: Mon, 04 May 2020 16:16:11 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 7381021
expires: Tue, 15 Apr 2025 09:17:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=05spmWBD85I57teUY02bUC9%2BzcE%2Bq7iaXT5e4PxHg1xFDkzGSTb1dOLH%2FMwZ%2B3c8cnXNfFIHkKkYJNOV5VyCzMaQQY2s4%2F7DPanctusFGSaTuUk1IKq33IjVzkZ5nYw3%2BuvzLT%2F8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 879d3dcb8d830b45-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/intlTelInput.css | 104.17.24.14 | 200 OK | 2.0 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/intlTelInput.css IP104.17.24.14:443
Requested byhttp://159.223.66.188/login CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
Hasha69aa970266649e0b08c2cb4bc166568 d9314a52085a2bb6d284421bb18a4c546ecb73d4 ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491
GET /ajax/libs/intl-tel-input/17.0.8/css/intlTelInput.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 25 Apr 2024 09:17:41 GMT
content-type: text/css; charset=utf-8
content-length: 1970
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5f902e0e-62a6"
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 838872
expires: Tue, 15 Apr 2025 09:17:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GzybjBqlUk%2F2F41ncThYbyT%2FTnJhPF1eWTezH8bIf9xNIlBYSBJa%2Bz%2FdzMJ00Qu%2FmX7Ci%2BYUzQvMnD0priTPtLI5nfURvTy%2FcZch65otWWQmfRHAo7i7wS9n9IXOhE1z%2BI5fykos"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 879d3dcb8c9b568f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| |  159.223.66.188 | 200 OK | 12 kB |
URL User Request GET HTTP/1.1IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (363), with CRLF, LF line terminators Hash978ad484acc3d9166546dc1984c695a2 36f12886214f72f936f353e263cca8c49727b0a5 ec04b6107e0ca229c2e6b4e7be27d221958244d00f0e960c3c8a39675f8816e2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:40 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; expires=Thu, 25-Apr-2024 19:17:40 GMT; Max-Age=36000; path=/
safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D; expires=Thu, 25-Apr-2024 19:17:40 GMT; Max-Age=36000; path=/; httponly
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
|
|
| 159.223.66.188/dist/frontend/css/app.css?_ver=3.1.1 | 159.223.66.188 | 200 OK | 30 kB |
URL GET HTTP/1.1159.223.66.188/dist/frontend/css/app.css?_ver=3.1.1 IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeassembler source, Unicode text, UTF-8 text, with very long lines (372) Hash4e9b767d78f4924202aa6b4e0af68ecd f3f89afd801f37a7c6384232459558c19d6b4df9 9e1e9e42940bea31ef5627f1a01478e78c589c8b3dbd7c12dc04649b4e11838e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /dist/frontend/css/app.css?_ver=3.1.1 HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Wed, 24 Apr 2024 14:49:24 GMT
ETag: "39b51-616d8c6d63b04-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 29498
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/daterange/daterangepicker.css | 159.223.66.188 | 200 OK | 1.7 kB |
URL GET HTTP/1.1159.223.66.188/libs/daterange/daterangepicker.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
Hashc9d158725fa8ab9e6f813f164027abe6 e1085f9ea620f7bd212e0c89e554d269333df30a fd69c2a932067e5697ca16542107bf3b883068c44db4ddfdac730a21e29b3777
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/daterange/daterangepicker.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "20d2-5f6cc07adfe54-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1689
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/carousel-2/owl.carousel.css | 159.223.66.188 | 200 OK | 1.4 kB |
URL GET HTTP/1.1159.223.66.188/libs/carousel-2/owl.carousel.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
Hashc8322bd5bffc8e2856f2cbcd03c61d18 a2fa945f9ac01fa3191a950c3f2cce188f50c4ef aaf08be6ae4ed211293a6d4280e2d052e1f332eb0066a0dc0192fd8a3a9f39d2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/carousel-2/owl.carousel.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "1288-5f6cc07ad8153-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1387
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/flags/css/flag-icon.min.css | 159.223.66.188 | 200 OK | 2.8 kB |
URL GET HTTP/1.1159.223.66.188/libs/flags/css/flag-icon.min.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeASCII text, with very long lines (33818), with no line terminators Hash3ec51e5e797a0b68940179e636a6bdac 77f99ae4e9c00c2dd0c52d0720d5b16d8b8661f7 3645cc7cf729a22877ff158372b25c017efca47a5fc31921363d1b01ff00313b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/flags/css/flag-icon.min.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "841a-5f6cc07adfe54-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2802
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/lazy-load/intersection-observer.js | 159.223.66.188 | 200 OK | 6.3 kB |
URL GET HTTP/1.1159.223.66.188/libs/lazy-load/intersection-observer.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text Hash6cd24d578e1b6be5ec3864f32ec6e4e8 b40328ee03d8fd0a6627f75a0446ad96becef6e0 51707b58bbec62b8ba51360216e55f57968674aafccd46f8642ff25fbb1c9310
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/lazy-load/intersection-observer.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "567a-5f6cc07af9494-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 6314
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/lazy-load/lazyload.min.js | 159.223.66.188 | 200 OK | 2.1 kB |
URL GET HTTP/1.1159.223.66.188/libs/lazy-load/lazyload.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (5543) Hash81a54a116c4b5f257f0c296bb023e915 23167641c90ec1587c30c71625cedaa7f5701a1e 1e3bbf2a6d9503811213baca9f5e309618ca968136199ca532a0a5167c0b0f1c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/lazy-load/lazyload.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "15d1-5f6cc07af9494-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2145
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/bootbox/bootbox.min.js | 159.223.66.188 | 200 OK | 4.8 kB |
URL GET HTTP/1.1159.223.66.188/libs/bootbox/bootbox.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (14835) Hash5adcfeca2088981ad5801a42b6c1f7d4 b31cb587ca8cf3551a73ff2dd0fc2517d8e97126 9e0b55b66621ac077d76a28c00e399121a40302b7213ee58aaf16550f6cfe113
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/bootbox/bootbox.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "3a36-5f6cc07ad42d3-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4806
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/lodash.min.js | 159.223.66.188 | 200 OK | 24 kB |
URL GET HTTP/1.1159.223.66.188/libs/lodash.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (4233) Hashbc0594c54450e8ac689739b6b198067a 32f09ec3ec0950f47a35fc0d656559d5b164dacd 55e35a1415438685f71fe809dfb0e94ff9d3b994dd8d8ae8f7206bb878d59a84
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/lodash.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "11e2d-5f6cc07afd314-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 24411
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/custom-css | 159.223.66.188 | 200 OK | 2.0 kB |
URL GET HTTP/1.1159.223.66.188/custom-css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeASCII text, with very long lines (376) Hash696ac2c672f2c1126745a4ac73d58a35 52c810234c88e7e8f1f18bbbd55a4065635d213d baab61111ccbdc410c22cd500c99802b9492047eaad1d0030a266373311ba635
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /custom-css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6InhtY1Y2OU5iRDh5SG03RFJMeUxUYXc9PSIsInZhbHVlIjoic0drK1kyVGZwSjYveXljU3hTa1UzSU9XWXhaSkhEYkh5ZEE4cDV6Qjl6bTV0cC9EajlkbkVOUnErbEZwMXlkZ1NONitkZ094RzBwTzhIQllySkRxRk5YalVCdlVhcmNneFFhTThHNnNuRWpFRjNsYlpvZXNJbEQxbTZxNHNTck4iLCJtYWMiOiI3YmQ4ODA3ZDZiYjU1MDExYjUzNTYzM2YyMGIxZTQzNzAxNGQ5NjJlMTI1NGYxNzAxMWE5OGU2MDJiZDQ0NThlIn0%3D; expires=Thu, 25-Apr-2024 19:17:41 GMT; Max-Age=36000; path=/
safwabusiness_session=eyJpdiI6InJWQzBsbWNVZExSTzVONVREWEFjMlE9PSIsInZhbHVlIjoiTFlHdFdNcERFTHlmR0lpNkE0YU81YUgxYXFOS1I4dTlJeE56c1VkZnI3MlNOOHVYc3ladjhTdkxWNkpFc3ZNRFF2REJIYk9BL2t5U1ptblhBeldENlZuS09pQzIxTVpUNGhBOEU4TFRDTUhWd2JPc0FqSWNxOG1uTVljUGhjQkoiLCJtYWMiOiJjMWIzZDhiZThiOWFiYTEzZTk0MDBkZTA4ZmI3M2I3YjNmNjZmMzQxODgwMGZkYTNhMmY2ZDcyMTE1N2ZiZTEyIn0%3D; expires=Thu, 25-Apr-2024 19:17:41 GMT; Max-Age=36000; path=/; httponly
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/css; charset=UTF-8
|
|
| 159.223.66.188/libs/daterange/moment.min.js | 159.223.66.188 | 200 OK | 17 kB |
URL GET HTTP/1.1159.223.66.188/libs/daterange/moment.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (32013) Hashaeb7908241d9f6d5a45e504cc4f2ec15 32fdf6730be34538e09378ec6cc55229d9a70151 d618d4869738e0dc22360f0ec0cbb6433257843f24723fac240dda0906685238
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/daterange/moment.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "c909-5f6cc07adfe54-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17024
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/carousel-2/owl.carousel.min.js | 159.223.66.188 | 200 OK | 21 kB |
URL GET HTTP/1.1159.223.66.188/libs/carousel-2/owl.carousel.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text Hashdcde228408c2ed5976a9a2efc6492d25 0210954c724b41ada73c560a58feea154203fc52 4d257a499c8d70413814a20e01caf769b9992e0f5ce1867434950edbf19da797
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/carousel-2/owl.carousel.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "1ac8f-5f6cc07ad8153-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20851
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/select2/js/select2.min.js | 159.223.66.188 | 200 OK | 19 kB |
URL GET HTTP/1.1159.223.66.188/libs/select2/js/select2.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (64217), with no line terminators Hashcd5f56bf4f27be8b44077a76c0e59e13 9dc4305ad5b546e1328ed4aea346a934f96c4b7e d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/select2/js/select2.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "10964-5f6cc07afe2b4-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 19405
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/js/functions.js?_ver=3.1.1 | 159.223.66.188 | 200 OK | 2.9 kB |
URL GET HTTP/1.1159.223.66.188/js/functions.js?_ver=3.1.1 IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text Hashd5aef3b344e9c7dd344c030a9dbf3ec4 9c9d4a7df4c948fc8736424c8bbeb8154721d91d d6bad5180e0e720435868a48ae5323944e9284f963222119c3fdb34a416428c0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/functions.js?_ver=3.1.1 HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Wed, 24 Apr 2024 14:49:24 GMT
ETag: "25ac-616d8c6d64aa4-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2902
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/pusher.min.js | 159.223.66.188 | 200 OK | 16 kB |
URL GET HTTP/1.1159.223.66.188/libs/pusher.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (32023) Hash4f5e12b07d479f4fd76507d07cd335f2 c04f363a990fc731b3ed563388eb8810d6f76477 49d8840799acd94d7246d1224afaba67b47346bd9583c86e77ddfdf9207129ad
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/pusher.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "f135-5f6cc07afd314-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 15656
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/js/cookie.js?_ver=3.1.1 | 159.223.66.188 | 200 OK | 245 B |
URL GET HTTP/1.1159.223.66.188/js/cookie.js?_ver=3.1.1 IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text Hash644d9eb7d288455810e7219c6ba252b0 014c688a98fee9a4e0289fd931ebf752e892be80 28c1527080ba5f3536d8966aa86f26a604a276881e063eb31081afe33c7d5641
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/cookie.js?_ver=3.1.1 HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:45 GMT
ETag: "1e1-5f6cc07aa83b2-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 245
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/jquery-3.3.1.min.js | 159.223.66.188 | 200 OK | 30 kB |
URL GET HTTP/1.1159.223.66.188/libs/jquery-3.3.1.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (65451) Hasha09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/jquery-3.3.1.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "1538f-5f6cc07af9494-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 30307
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/dist/frontend/css/notification.css | 159.223.66.188 | 200 OK | 1.7 kB |
URL GET HTTP/1.1159.223.66.188/dist/frontend/css/notification.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeASCII text, with very long lines (9373) Hash2be69b4af5dc1a53a9436ce6985f7880 b54a05ed475fd161660f1a5a64ff9966c1cdaa8f eb50a88c727c73f275aeb77c946b68bd188ed0f6dfd63561c5809697053095a9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /dist/frontend/css/notification.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:45 GMT
ETag: "249e-5f6cc07a9f712-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1687
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/vue/vue.min.js | 159.223.66.188 | 200 OK | 34 kB |
URL GET HTTP/1.1159.223.66.188/libs/vue/vue.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (65449) Hash6c81f02ad0bf8e12a66c18cab188d029 abd239f02966b2d324b0512c203bdbaf82a4ed7a 9e0156dd49c03744e79bbea60eebbbb94b5811c1b71b91f5fb38a8270dedfbaf
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/vue/vue.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "16de6-5f6cc07b07ef5-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 34060
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/font-awesome/css/font-awesome.css | 159.223.66.188 | 200 OK | 7.4 kB |
URL GET HTTP/1.1159.223.66.188/libs/font-awesome/css/font-awesome.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typetroff or preprocessor input, ASCII text, with very long lines (372) Hashc495654869785bc3df60216616814ad1 0140952c64e3f2b74ef64e050f2fe86eab6624c8 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/font-awesome/css/font-awesome.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:44 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "9226-5f6cc07ae9a94-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 7439
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/daterange/daterangepicker.min.js | 159.223.66.188 | 200 OK | 12 kB |
URL GET HTTP/1.1159.223.66.188/libs/daterange/daterangepicker.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text Hash036db6afec77f0767e8103caa99ff68c bf80d2f09707b121b915b25dc9fce0dbeec5ea62 4e210578d6fd2c4f2afddd91b6ef7f514dff0d6481370199a217e9fbc1aafe02
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/daterange/daterangepicker.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "10267-5f6cc07adfe54-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 11802
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/js/home.js?_ver=3.1.1 | 159.223.66.188 | 200 OK | 7.4 kB |
URL GET HTTP/1.1159.223.66.188/js/home.js?_ver=3.1.1 IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text Hash84bec5d7b220a4ea302121d4b9f086f6 b6fb4bcc70bd5606d02ea2d87965ec20a24ba9d5 c0c6c077ad7fd56b703414f299bc5e4adae3ba6123f637544ecf9efc6ba6c4fe
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/home.js?_ver=3.1.1 HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:44 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sat, 21 Oct 2023 21:36:14 GMT
ETag: "c622-60840c74db16b-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 7389
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/bootstrap/js/bootstrap.bundle.min.js | 159.223.66.188 | 200 OK | 22 kB |
URL GET HTTP/1.1159.223.66.188/libs/bootstrap/js/bootstrap.bundle.min.js IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeJavaScript source, ASCII text, with very long lines (65297) Hasha454220fc07088bf1fdd19313b6bfd50 265a733cb7fbc481fd2510a659a85ad55c93c895 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/bootstrap/js/bootstrap.bundle.min.js HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "1332b-5f6cc07ad6213-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 22295
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
|
|
| 159.223.66.188/libs/select2/css/select2.min.css | 159.223.66.188 | 200 OK | 2.0 kB |
URL GET HTTP/1.1159.223.66.188/libs/select2/css/select2.min.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeASCII text, with very long lines (15179) Hashaf22a7e2bfec4d2a82c4dde613a52fb1 0262303d6ae851521ba206fdb6c5d0578f06b4f4 31e49ff119a0ddbe6a2c59628e7a7193a97e20992247dd7ffd818f0ab0a6a205
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/select2/css/select2.min.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:44 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "3b4c-5f6cc07afd314-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2005
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/icofont/icofont.min.css | 159.223.66.188 | 200 OK | 17 kB |
URL GET HTTP/1.1159.223.66.188/libs/icofont/icofont.min.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeASCII text, with very long lines (65364) Hashbc3386881ee767bbb22f98017933f769 4cddc09e849cb1dc3c773ec0fc1f355ce56aa518 c5ad8b399b615ecfc8f63628c1bad71cf11477002a51390fd1dcca1f2b34381e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/icofont/icofont.min.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:44 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "16830-5f6cc07af84f4-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 16852
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/bootstrap/css/bootstrap.css | 159.223.66.188 | 200 OK | 25 kB |
URL GET HTTP/1.1159.223.66.188/libs/bootstrap/css/bootstrap.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeASCII text, with very long lines (570) Hashbd551f56ce2be3eba2812e605ab4f5b2 94d6450720dd8deb413760cc9184204b46802e9c 35fbb6dc3891aacaf1ffa07abec2344fdbc454aab533a2a03bcf93577eb7837b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/bootstrap/css/bootstrap.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "2ef5c-5f6cc07ad5273-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 25436
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
|
|
| 159.223.66.188/libs/ionicons/css/ionicons.min.css | 159.223.66.188 | 200 OK | 8.0 kB |
URL GET HTTP/1.1159.223.66.188/libs/ionicons/css/ionicons.min.css IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeUnicode text, UTF-8 text, with very long lines (46127) Hash46d54dadac7946c9950dd89063ce9599 27e388ec021194bf04ebe968f0359afcb728a018 0e952925f22101a93c5054b96ea0088544cc81fcbd2600c9e148e5589a78f219
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/ionicons/css/ionicons.min.css HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:45 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "b5fc-5f6cc07af84f4-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 8029
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
|
|
| www.googletagmanager.com/gtm.js?id=GTM-5MZM3L5 |  142.250.74.168 | 200 OK | 75 kB |
URL GET HTTP/2www.googletagmanager.com/gtm.js?id=GTM-5MZM3L5 IP142.250.74.168:443
Requested byhttp://159.223.66.188/login CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com Fingerprint1E:33:2E:4B:C3:51:05:B7:73:DC:21:BF:3E:02:B3:16:D8:0B:AB:BB ValidityMon, 18 Mar 2024 19:37:14 GMT - Mon, 10 Jun 2024 19:37:13 GMT
File typeJavaScript source, ASCII text, with very long lines (2212) Hashac3081d197dcc26d3b417a638941b818 d648e81fd8e5b1e0e73a63f05ff3c236db0a392d dcce1498c148c24ce4000a0057ace2e674809f30057a167daf766f09e8bcacf5
GET /gtm.js?id=GTM-5MZM3L5 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 25 Apr 2024 09:17:46 GMT
expires: Thu, 25 Apr 2024 09:17:46 GMT
cache-control: private, max-age=900
last-modified: Thu, 25 Apr 2024 09:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75431
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/tajawal/v9/Iura6YBj_oCad4k1nzGBCw.woff2 | 216.58.207.227 | 200 OK | 10 kB |
URL GET HTTP/2fonts.gstatic.com/s/tajawal/v9/Iura6YBj_oCad4k1nzGBCw.woff2 IP216.58.207.227:443
Requested byhttp://159.223.66.188/login CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 10256, version 1.0 Hashf18eb7346bae415c6367ed0907125227 a9e8e937c5afc2f9feb46bfcb8fa854728a494a8 b081f7bf790678b56a2c0502651d6873cbabc09e78fe40655df15f918b1e369b
GET /s/tajawal/v9/Iura6YBj_oCad4k1nzGBCw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://159.223.66.188
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 10256
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:42:44 GMT
expires: Fri, 25 Apr 2025 02:42:44 GMT
cache-control: public, max-age=31536000
age: 23702
last-modified: Wed, 27 Apr 2022 16:06:52 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2 | 216.58.207.227 | 200 OK | 9.9 kB |
URL GET HTTP/2fonts.gstatic.com/s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2 IP216.58.207.227:443
Requested byhttp://159.223.66.188/login CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74 ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 9900, version 1.0 Hash7256be46335261573e1ab1dc7f6539f0 abeac1b7890a903ac951c522bc9b3039ec6fa1f8 9986de5db80ec050300f1cea25d651a5779ae62b91a39b5667ac23d0c7668cbb
GET /s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://159.223.66.188
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9900
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 08:39:04 GMT
expires: Wed, 23 Apr 2025 08:39:04 GMT
cache-control: public, max-age=31536000
age: 175122
last-modified: Wed, 27 Apr 2022 16:01:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/img/flags.png | 104.17.24.14 | | 71 kB |
URL GET cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/img/flags.png IP104.17.24.14:0
Requested byhttp://159.223.66.188/login CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typePNG image data, 5652 x 15, 8-bit/color RGBA, non-interlaced Hash416250f60d785a2e02f17e054d2e4e44 21572c9751e5a3dc20395befa0fcb349c32c4811 0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55
GET /ajax/libs/intl-tel-input/17.0.8/img/flags.png HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/css/intlTelInput.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 25 Apr 2024 09:17:46 GMT
content-type: image/png; charset=utf-8
content-length: 70862
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5f902e0e-114c9"
last-modified: Wed, 21 Oct 2020 12:48:14 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 3057916
expires: Tue, 15 Apr 2025 09:17:46 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JGIP4wIjNJg0phDpUOUoF0mct5HgNdBNUywHBcwCneskBRk1E8JX0hjfb0bgciIjSCpvuXPPFsNDshkiw67c%2FGeqnO4NVIDJ6EZkrTKlM%2Fa76YEvDdVfMbnaEprwuOj4OONGhW%2F5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 879d3dee3ff356c0-OSL
alt-svc: h3=":443"; ma=86400
|
|
| 159.223.66.188/uploads/0000/1/2024/04/16/icons8-visa-64-1.png | 159.223.66.188 | 200 OK | 885 B |
URL GET HTTP/1.1159.223.66.188/uploads/0000/1/2024/04/16/icons8-visa-64-1.png IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typePNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced Hash91d82ad0ead9a9edb5087dfbd876f2a2 c13128287035095c15ba953636fc88f2cf35eec2 99f64029167080e5e76f25a7cf9ff24cd87a6e7a4eaa4cfd5099ee34bf3c062b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /uploads/0000/1/2024/04/16/icons8-visa-64-1.png HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 16 Apr 2024 04:32:28 GMT
ETag: "375-6162f39bc1d3e"
Accept-Ranges: bytes
Content-Length: 885
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png
|
|
| 159.223.66.188/uploads/0000/1/2024/04/16/icons8-credit-card-amazon-pay-64.png | 159.223.66.188 | 200 OK | 1.1 kB |
URL GET HTTP/1.1159.223.66.188/uploads/0000/1/2024/04/16/icons8-credit-card-amazon-pay-64.png IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typePNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced Hash6e3ad2b675aeeecf4f9cdea29fb26477 ec225cfc2965a14892d2f0c06042021d6e011752 a4a792a3169998e0459f5991ddd88b40465385b01b5b96b244b8cd8c4fc76dd6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /uploads/0000/1/2024/04/16/icons8-credit-card-amazon-pay-64.png HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 16 Apr 2024 04:49:35 GMT
ETag: "43a-6162f76f75b8d"
Accept-Ranges: bytes
Content-Length: 1082
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png
|
|
| 159.223.66.188/images/ico_close.svg | 159.223.66.188 | 200 OK | 729 B |
URL GET HTTP/1.1159.223.66.188/images/ico_close.svg IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeSVG Scalable Vector Graphics image Hashf66a59e8d5ec71516684550672cac11b 110cac20029bf156ed22cbf5eeb8074d67012cc1 a089cc59ecc3f8115f4e031eff8326ec91b2751d3e5478af5e0b16cea5d5d04c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /images/ico_close.svg HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:45 GMT
ETag: "2d9-5f6cc07aa3592"
Accept-Ranges: bytes
Content-Length: 729
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/svg+xml
|
|
| www.googletagmanager.com/gtag/js?id=G-KJZ2PKR3XS&l=dataLayer&cx=c | 142.250.74.168 | 200 OK | 94 kB |
URL GET HTTP/3www.googletagmanager.com/gtag/js?id=G-KJZ2PKR3XS&l=dataLayer&cx=c IP142.250.74.168:443
Requested byhttp://159.223.66.188/login CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com Fingerprint1E:33:2E:4B:C3:51:05:B7:73:DC:21:BF:3E:02:B3:16:D8:0B:AB:BB ValidityMon, 18 Mar 2024 19:37:14 GMT - Mon, 10 Jun 2024 19:37:13 GMT
File typeJavaScript source, ASCII text, with very long lines (3034) Hash1a25294394baee880753efb0e4f8b535 8bb8aade60b1602cc6fc9434ee92ea0c8c5d9520 4a07299a9559144a034298ca6aab7bc97ad7c4dec279d1acbc50f8a5c52dd7c8
GET /gtag/js?id=G-KJZ2PKR3XS&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 25 Apr 2024 09:17:46 GMT
expires: Thu, 25 Apr 2024 09:17:46 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 93630
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| 159.223.66.188/libs/flags/flags/4x3/gb.svg | 159.223.66.188 | 200 OK | 837 B |
URL GET HTTP/1.1159.223.66.188/libs/flags/flags/4x3/gb.svg IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeSVG Scalable Vector Graphics image Hash4f1b7af5c0bae6aae85c3e7ba9401a85 6976d9789c9079e1956dd08b9b1ae41b80657a70 98078f535d5a883d0257113024edc6a8d6f17e85a981342662d33ae47497380a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/flags/flags/4x3/gb.svg HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/libs/flags/css/flag-icon.min.css
Cookie: XSRF-TOKEN=eyJpdiI6InhtY1Y2OU5iRDh5SG03RFJMeUxUYXc9PSIsInZhbHVlIjoic0drK1kyVGZwSjYveXljU3hTa1UzSU9XWXhaSkhEYkh5ZEE4cDV6Qjl6bTV0cC9EajlkbkVOUnErbEZwMXlkZ1NONitkZ094RzBwTzhIQllySkRxRk5YalVCdlVhcmNneFFhTThHNnNuRWpFRjNsYlpvZXNJbEQxbTZxNHNTck4iLCJtYWMiOiI3YmQ4ODA3ZDZiYjU1MDExYjUzNTYzM2YyMGIxZTQzNzAxNGQ5NjJlMTI1NGYxNzAxMWE5OGU2MDJiZDQ0NThlIn0%3D; safwabusiness_session=eyJpdiI6InJWQzBsbWNVZExSTzVONVREWEFjMlE9PSIsInZhbHVlIjoiTFlHdFdNcERFTHlmR0lpNkE0YU81YUgxYXFOS1I4dTlJeE56c1VkZnI3MlNOOHVYc3ladjhTdkxWNkpFc3ZNRFF2REJIYk9BL2t5U1ptblhBeldENlZuS09pQzIxTVpUNGhBOEU4TFRDTUhWd2JPc0FqSWNxOG1uTVljUGhjQkoiLCJtYWMiOiJjMWIzZDhiZThiOWFiYTEzZTk0MDBkZTA4ZmI3M2I3YjNmNjZmMzQxODgwMGZkYTNhMmY2ZDcyMTE1N2ZiZTEyIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "345-5f6cc07ae7b54"
Accept-Ranges: bytes
Content-Length: 837
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/svg+xml
|
|
| 159.223.66.188/uploads/0000/1/2024/04/16/icons8-master-card-64.png | 159.223.66.188 | 200 OK | 3.4 kB |
URL GET HTTP/1.1159.223.66.188/uploads/0000/1/2024/04/16/icons8-master-card-64.png IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typePNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced Hashb7c67049f9eb8f883cbdce8e09da665f 793b4fc622d62658ef4304de14c93d5df23de641 f31bce2806c445af82c36f9d3238460c396f2e8710db962d80ef0b4ed3c2e34f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /uploads/0000/1/2024/04/16/icons8-master-card-64.png HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:47 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 16 Apr 2024 04:46:40 GMT
ETag: "d2c-6162f6c831297"
Accept-Ranges: bytes
Content-Length: 3372
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: image/png
|
|
| 159.223.66.188/uploads/demo/general/favicon.png | 159.223.66.188 | 200 OK | 7.3 kB |
URL GET HTTP/1.1159.223.66.188/uploads/demo/general/favicon.png IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeMS Windows icon resource - 1 icon, 42x41, 32 bits/pixel Hash2da6307c060a9f25b0f47cb7fd2b248f c6b7fc2aed76e0de2bd38c7763ab638632e3401d 6ee32e51f881e789664a49a9f122b6d06049f0341bb3c0755661f80ed2a7ca54
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /uploads/demo/general/favicon.png HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6InhtY1Y2OU5iRDh5SG03RFJMeUxUYXc9PSIsInZhbHVlIjoic0drK1kyVGZwSjYveXljU3hTa1UzSU9XWXhaSkhEYkh5ZEE4cDV6Qjl6bTV0cC9EajlkbkVOUnErbEZwMXlkZ1NONitkZ094RzBwTzhIQllySkRxRk5YalVCdlVhcmNneFFhTThHNnNuRWpFRjNsYlpvZXNJbEQxbTZxNHNTck4iLCJtYWMiOiI3YmQ4ODA3ZDZiYjU1MDExYjUzNTYzM2YyMGIxZTQzNzAxNGQ5NjJlMTI1NGYxNzAxMWE5OGU2MDJiZDQ0NThlIn0%3D; safwabusiness_session=eyJpdiI6InJWQzBsbWNVZExSTzVONVREWEFjMlE9PSIsInZhbHVlIjoiTFlHdFdNcERFTHlmR0lpNkE0YU81YUgxYXFOS1I4dTlJeE56c1VkZnI3MlNOOHVYc3ladjhTdkxWNkpFc3ZNRFF2REJIYk9BL2t5U1ptblhBeldENlZuS09pQzIxTVpUNGhBOEU4TFRDTUhWd2JPc0FqSWNxOG1uTVljUGhjQkoiLCJtYWMiOiJjMWIzZDhiZThiOWFiYTEzZTk0MDBkZTA4ZmI3M2I3YjNmNjZmMzQxODgwMGZkYTNhMmY2ZDcyMTE1N2ZiZTEyIn0%3D; _ga_KJZ2PKR3XS=GS1.1.1714036666.1.0.1714036666.0.0.0; _ga=GA1.1.1136836274.1714036667
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:47 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 20 Jun 2022 10:07:30 GMT
ETag: "1c6e-5e1de4595fc80"
Accept-Ranges: bytes
Content-Length: 7278
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: image/png
|
|
| 159.223.66.188/uploads/0000/1/2023/09/18/logo1.png | 159.223.66.188 | 200 OK | 19 kB |
URL GET HTTP/1.1159.223.66.188/uploads/0000/1/2023/09/18/logo1.png IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typePNG image data, 200 x 63, 8-bit/color RGBA, non-interlaced Hash749ddf0e23b6356a75489329dfac45ab a7fc3b1e5472ffb4032acb0da5cf304f503f8210 43434f885ee401ad32008939c8dff29c9af1245e02198bce57a902616f23316a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /uploads/0000/1/2023/09/18/logo1.png HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/login
Cookie: XSRF-TOKEN=eyJpdiI6IlVFTmkxdnhDTlJoVXFGamV6bHNBdUE9PSIsInZhbHVlIjoiLzIzbmhlbjdRTU9URFZBRHdyTzJNMGpKZnB4dlhZMUlUV0R6UkJFQjBPTTlvV3JyaHFTSXNUUEpFeXVKYW1sMXh0ODFCb2VMWEtUMzZEMDMvM0JtQU10VnZiVjlDWGhmakVDL1RXbW1NYXQ5aG9NSm1TVVR6aDBuNHlYRWdZUkQiLCJtYWMiOiI1ZWU3OWE0OGI3ZjlkNDZiODcxZjhjMDJmZGJkZjYzMmEyOTAxYWYwN2Y5MTlkZDhkMGI5NjU3ZWU5NDRiY2VkIn0%3D; safwabusiness_session=eyJpdiI6IklUWitvd2U5a0hpSTRna2UyRGJYZmc9PSIsInZhbHVlIjoiU1JUZWMvWFE3UUE1UWVBd0dDa0l0b2UwcERuNGhJUFhnR0JPbWEwRXJaYTlFbnI2STBBT1NRelM5RWQ2Q0xDNk9DWUtYR2dkbTJPOElhWVcwUkRlcjFlQ0l5MVBRUGxGaWc1ZFVka2tvZnBJb1ZJNDZnQzJFMXNwY2VSNy9zREsiLCJtYWMiOiI1NWEyNGExMGZiYzUwZjg0YTQ0MDYxMmE2MTU4ZDM3NGZhZjU4NjQyZmNjY2M1MmE2NWVjZDgzNzBhNWNlYzM0In0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 18 Sep 2023 10:42:13 GMT
ETag: "488a-6059fcb916ea1"
Accept-Ranges: bytes
Content-Length: 18570
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png
|
|
| 159.223.66.188/libs/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 | 159.223.66.188 | 200 OK | 77 kB |
URL GET HTTP/1.1159.223.66.188/libs/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 IP159.223.66.188:80 ASN#14061 DIGITALOCEAN-ASN
Requested byhttp://159.223.66.188/login
File typeWeb Open Font Format (Version 2), TrueType, length 77160, version 4.459 Hashaf7ae505a9eed503f8b8e6982036873e d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/libs/font-awesome/css/font-awesome.css
Cookie: XSRF-TOKEN=eyJpdiI6InhtY1Y2OU5iRDh5SG03RFJMeUxUYXc9PSIsInZhbHVlIjoic0drK1kyVGZwSjYveXljU3hTa1UzSU9XWXhaSkhEYkh5ZEE4cDV6Qjl6bTV0cC9EajlkbkVOUnErbEZwMXlkZ1NONitkZ094RzBwTzhIQllySkRxRk5YalVCdlVhcmNneFFhTThHNnNuRWpFRjNsYlpvZXNJbEQxbTZxNHNTck4iLCJtYWMiOiI3YmQ4ODA3ZDZiYjU1MDExYjUzNTYzM2YyMGIxZTQzNzAxNGQ5NjJlMTI1NGYxNzAxMWE5OGU2MDJiZDQ0NThlIn0%3D; safwabusiness_session=eyJpdiI6InJWQzBsbWNVZExSTzVONVREWEFjMlE9PSIsInZhbHVlIjoiTFlHdFdNcERFTHlmR0lpNkE0YU81YUgxYXFOS1I4dTlJeE56c1VkZnI3MlNOOHVYc3ladjhTdkxWNkpFc3ZNRFF2REJIYk9BL2t5U1ptblhBeldENlZuS09pQzIxTVpUNGhBOEU4TFRDTUhWd2JPc0FqSWNxOG1uTVljUGhjQkoiLCJtYWMiOiJjMWIzZDhiZThiOWFiYTEzZTk0MDBkZTA4ZmI3M2I3YjNmNjZmMzQxODgwMGZkYTNhMmY2ZDcyMTE1N2ZiZTEyIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "12d68-5f6cc07aeb9d4"
Accept-Ranges: bytes
Content-Length: 77160
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: font/woff2
|
|
| 159.223.66.188/libs/icofont/fonts/icofont.woff2 | 0.0.0.0 | | 0 B |
URL GET 159.223.66.188/libs/icofont/fonts/icofont.woff2 IP0.0.0.0:0
Requested byhttp://159.223.66.188/login
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /libs/icofont/fonts/icofont.woff2 HTTP/1.1
Host: 159.223.66.188
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/libs/icofont/icofont.min.css
Cookie: XSRF-TOKEN=eyJpdiI6InhtY1Y2OU5iRDh5SG03RFJMeUxUYXc9PSIsInZhbHVlIjoic0drK1kyVGZwSjYveXljU3hTa1UzSU9XWXhaSkhEYkh5ZEE4cDV6Qjl6bTV0cC9EajlkbkVOUnErbEZwMXlkZ1NONitkZ094RzBwTzhIQllySkRxRk5YalVCdlVhcmNneFFhTThHNnNuRWpFRjNsYlpvZXNJbEQxbTZxNHNTck4iLCJtYWMiOiI3YmQ4ODA3ZDZiYjU1MDExYjUzNTYzM2YyMGIxZTQzNzAxNGQ5NjJlMTI1NGYxNzAxMWE5OGU2MDJiZDQ0NThlIn0%3D; safwabusiness_session=eyJpdiI6InJWQzBsbWNVZExSTzVONVREWEFjMlE9PSIsInZhbHVlIjoiTFlHdFdNcERFTHlmR0lpNkE0YU81YUgxYXFOS1I4dTlJeE56c1VkZnI3MlNOOHVYc3ladjhTdkxWNkpFc3ZNRFF2REJIYk9BL2t5U1ptblhBeldENlZuS09pQzIxTVpUNGhBOEU4TFRDTUhWd2JPc0FqSWNxOG1uTVljUGhjQkoiLCJtYWMiOiJjMWIzZDhiZThiOWFiYTEzZTk0MDBkZTA4ZmI3M2I3YjNmNjZmMzQxODgwMGZkYTNhMmY2ZDcyMTE1N2ZiZTEyIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 09:17:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 13 Mar 2023 18:10:46 GMT
ETag: "8350c-5f6cc07af84f4"
Accept-Ranges: bytes
Content-Length: 537868
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: font/woff2
|
|
| fonts.googleapis.com/css?family=Tajawal%3A300%2C400%2C500%2C600 | 142.250.74.74 | 200 OK | 3.7 kB |
URL GET HTTP/2fonts.googleapis.com/css?family=Tajawal%3A300%2C400%2C500%2C600 IP142.250.74.74:443
Requested byhttp://159.223.66.188/login CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2 ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT
File typeASCII text, with very long lines (3721), with no line terminators Hash7f567eec1ce83f8e62d69ccdd9b570a3 f4d114c0c91468b83c0a8a8b4a7b60ed2c9b0ad8 73d99fe0e572aadb67d54aa7f78571e2deb8366af885800d895a3938a8fc2510
GET /css?family=Tajawal%3A300%2C400%2C500%2C600 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://159.223.66.188/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 25 Apr 2024 09:17:41 GMT
date: Thu, 25 Apr 2024 09:17:41 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
0.0.0.0