Report - 104.248.198.151/f/xs.mips

Report Overview

Submitted URL
104.248.198.151/f/xs.mips
IP
104.248.198.151
ASN
#14061 DIGITALOCEAN-ASN
Submitted
2023-03-29 10:10:25
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
46

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-29T18:13:46Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-29T18:37:20Z	606 B	238 B	34.117.65.55
104.248.198.151	unknown	2019-01-02T09:04:16Z	2019-01-04T10:35:14Z	7.3 kB	250 kB	104.248.198.151
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-29T18:12:03Z	1.4 kB	3.5 kB	23.36.76.226
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-29T18:14:38Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-29T18:24:36Z	413 B	5.9 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-03-29 10:10:36	medium	Client IP	104.248.198.151	ET INFO MIPS File Download Request from IP Address
2023-03-29 10:10:37	medium	Client IP	104.248.198.151	ET INFO MIPS File Download Request from IP Address

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-03-29	medium	104.248.198.151/f/xs.mips	Malware

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed
2023-03-29	medium	104.248.198.151	Sinkholed

ThreatFox

No alerts detected

JavaScript (11)

	URL	Size	First Seen	Last Seen
	104.248.198.151/f/xs.mips	115 B	2023-03-09	2023-08-10
Pretty URL 104.248.198.151/f/xs.mips IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-08-10 22:14:40 Times Seen18 Hash 24bdd8f92f1d2682e753029cfae1e4da 6dd6326782f726d28a1ad6246a5d47ef29e344c6 9894a693d30ffb74eecd707a0343834324f8680b68fd2e8f9050466c46851738 Loading...

	104.248.198.151/js/vendors-main.m.d184ed05.chunk.js	20 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/vendors-main.m.d184ed05.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash f8b006e2fa160fd1ee75b3771d5e0ee6 3a781ca8023e93ec99cfe47cda4d0881bed6b88f fe96fa3fe91209504f72a96fbbf265ea75c050d224ec171c8f1df5010da83fd6 Loading...

	104.248.198.151/js/17.m.7c19ad00.chunk.js	48 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/17.m.7c19ad00.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash 2682336bcc895a59c3813e6f167a037f fbe138f0c9184565a306d7f7bfd5d32337425fc6 90aa80620dda3489d3e134e9a9ba1cf41a81f9d0979e4bc39788a0b7be7b221f Loading...

	104.248.198.151/js/9.m.437592dd.chunk.js	59 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/9.m.437592dd.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash 7d368abd245248ed887f92ec3d84fb7c 16babd25a844ffe43958fbcda08b59f4c252b2ac e5c447acdddc8de2697805b084b989aaff33a6bf86da0250859e0e401b205695 Loading...

	104.248.198.151/js/app.m.3ee455d5.chunk.js	189 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/app.m.3ee455d5.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen13 Hash 9fe5c87ebd3111934ff87d6bf013437e 4d8e34263782088419be676e2d296caac7123bda a5550f6d83916410ff3f7ae924da232b90b5309eb7071c3db3377897484c9961 Loading...

	104.248.198.151/js/369.m.d59054c6.chunk.js	561 B	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/369.m.d59054c6.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash 7fac243e44988db163177060e7411591 7108d1c2bdaa91383903e1e79d23e12a2df57857 93fc935ddce94381d7b08c22f956b69b367539c7f9ec5cf7ef4b8318c829116f Loading...

	104.248.198.151/js/main.m.6f69b5a0.js	28 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/main.m.6f69b5a0.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash 5e694169d8c82815ebbfbea5b453d7be 6ceb3cba0ce4b129b9cb5fdf30ea123b07ebd527 b75b83e5b9bf317856293855b4084cf15ae9c441cc213e08371858905f7234ea Loading...

	104.248.198.151/js/vendors-app.m.b88ebad0.chunk.js	165 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/vendors-app.m.b88ebad0.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen15 Hash 4d62533a09ef7433f3790da02d650b7d b3eb39f2b5436e7aa44ad8ba6c31f5060cd5635f 0d07a46800e32b0085fd271255d99fd6422140b9a2faee96139796a7e391942f Loading...

	104.248.198.151/js/0.m.5f1f98f2.chunk.js	19 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/0.m.5f1f98f2.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash a55f90f53947d0e979e2fde40c21f5f2 33556dce7e6e2b78f4fe65a82c0e253972f36bd9 fc68471e3839041379d520a0f1b92ff69ce6577f1b339298ddece4c25c23aa04 Loading...

	104.248.198.151/js/21.m.1264acfc.chunk.js	2.3 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/21.m.1264acfc.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash cddfbb370decbdabf0891d09abfc63d5 e164c1d1ce7b573a8d1fc9b203f6afb01e8d954b 940795649281c1e6fad81d4318462bc7b70bdaf30d5a3e0542d38fc24a92bafd Loading...

	104.248.198.151/js/304.m.64d672ef.chunk.js	10 kB	2023-03-09	2023-04-01
Pretty URL 104.248.198.151/js/304.m.64d672ef.chunk.js IP 104.248.198.151 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-09 08:04:17 Last Seen2023-04-01 10:53:06 Times Seen16 Hash 439051f4db1a6635fe2eaf0996c92cc3 33d21cd0a75bad7aa4625aae13f2a7efaefa47a9 42497c444fb9512e6ebf6f5877bffadc05c73be0bc9c9bbc86273e720869ab17 Loading...

HTTP Transactions (31)

URL IP Response Size

104.248.198.151/f/xs.mips

104.248.198.151

200

10 kB

URL HTTP/1.1
104.248.198.151/f/xs.mips
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (43281)
Size
10 kB (10072 bytes)
Hash
4e37d731be022cdc3e4fb3d8867d6f67
7e3f1d2cf64037ba0da3bf8f5b94eeb72cad2185
f0505ee0689ebda4bdf559b48804d22c6c8ce0869d79a6366cee8674fb7f886b

Detections

Analyzer	Verdict	Alert
fortinet	Malware
quad9	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO MIPS File Download Request from IP Address

HTTP Headers

GET /f/xs.mips HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:13 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Vary: Accept-Encoding

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
93f633ce30c038eb581544323c5a971e
2f60526cb750c6babccc207f75fb5a8ae6f7598b
0ff6df80a892199848fb943af78541b66efc09a7ab70d4b169906fdbac1eabf8

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "0FF6DF80A892199848FB943AF78541B66EFC09A7AB70D4B169906FDBAC1EABF8"
Last-Modified: Mon, 27 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5265
Expires: Wed, 29 Mar 2023 11:37:59 GMT
Date: Wed, 29 Mar 2023 10:10:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
c83d39f350161ed2f5d20dcd68e47c92
2695a888e652cb314f8094cc6073c3364336d272
62e5cc6aea61c3c32acd964d4bbe143806416008181eebc4451a8f035b69a0bc

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "62E5CC6AEA61C3C32ACD964D4BBE143806416008181EEBC4451A8F035B69A0BC"
Last-Modified: Mon, 27 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7404
Expires: Wed, 29 Mar 2023 12:13:38 GMT
Date: Wed, 29 Mar 2023 10:10:14 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
5ad3eec59bebbf969f175627757507c1
b176af3a70db378c9e1f219bab24d9d446070d6f
704fa284035b4c9aa487331b516f5f11c324e204756ae2503bad2606ed34f25e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "704FA284035B4C9AA487331B516F5F11C324E204756AE2503BAD2606ED34F25E"
Last-Modified: Mon, 27 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7298
Expires: Wed, 29 Mar 2023 12:11:52 GMT
Date: Wed, 29 Mar 2023 10:10:14 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
7f03faaba3392caae6dae54467bfdf6d
57ea1f14e8bfbcca8190c706d708c9fda12442c1
02ac551ba61fcbc6b04f244df065948b181a8a258db5c2e197aae66fdfcea8ee

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Length, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 29 Mar 2023 09:28:09 GMT
content-type: application/json
age: 2525
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
e7bace7c1e04d44012e37ddffe36e5d5
3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: MVY/alIWp6x02m1Sasxqtt9oBSmj/nQqFnUUQ++wH3qJWviaN4boVwU758kmhDsMiuhX5/uCzpY=
x-amz-request-id: EVW9V3DA6BY60HEA
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 29 Mar 2023 10:02:26 GMT
age: 468
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

104.248.198.151/js/vendors-main.m.d184ed05.chunk.js

104.248.198.151

200

6.0 kB

URL HTTP/1.1
104.248.198.151/js/vendors-main.m.d184ed05.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (19748)
Size
6.0 kB (6042 bytes)
Hash
353aa07ab75f8003f39ab11bbd1b7c9e
af3badcf2125977484f816dcd70b40e6cebf528f
ecc6d6e389eb715ba973d112bf919537d4b4acc547e2a4cc900806a05b76cf81

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/vendors-main.m.d184ed05.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"19806-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Wed, 29 Mar 2023 10:10:14 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

104.248.198.151/js/main.m.6f69b5a0.js

104.248.198.151

200

11 kB

URL HTTP/1.1
104.248.198.151/js/main.m.6f69b5a0.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (28285)
Size
11 kB (10888 bytes)
Hash
127d7be464cb45c11e3f1ac00129052f
08368e4a3e49e5d3c19579984d78e18a4070d8b1
3f4fb9162f5c7a96f6718cf1141cfc500c825abdd81df546646168abe6056c3a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/main.m.6f69b5a0.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"28329-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/api/users/current

104.248.198.151

401

0 B

URL HTTP/1.1
104.248.198.151/api/users/current
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /api/users/current HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.248.198.151/f/xs.mips
Connection: keep-alive

HTTP/1.1 401 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Length: 0
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff

104.248.198.151/js/17.m.7c19ad00.chunk.js

104.248.198.151

200

13 kB

URL HTTP/1.1
104.248.198.151/js/17.m.7c19ad00.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
data
Size
13 kB (12574 bytes)
Hash
0a8752041abf0421db227b2ff66585c9
7fccfb611898287650d07a849c0e492f33ff0573
87d8f241343fe0bddf3613ea48578639ce77298943c4c6b8e64e157448143e07

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/17.m.7c19ad00.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"47505-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/api/l10n/index?locale=en-US

104.248.198.151

200

50 kB

URL HTTP/1.1
104.248.198.151/api/l10n/index?locale=en-US
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
JSON data\012- , Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Size
50 kB (50523 bytes)
Hash
10cc882196fccab20bad7f9be46dc34e
5a6bea5d58ac24b3385705948ad77bb3455dbea1
d1d0df6643eed17029b598c14fc3799cfbf22228cdfd30a5de0027e59e5990cf

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /api/l10n/index?locale=en-US HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.248.198.151/f/xs.mips
Connection: keep-alive

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, must-revalidate
Sonar-Version: 7.9.5.38598
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/api/navigation/global

104.248.198.151

401

0 B

URL HTTP/1.1
104.248.198.151/api/navigation/global
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /api/navigation/global HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.248.198.151/f/xs.mips
Connection: keep-alive

HTTP/1.1 401 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Length: 0
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff

104.248.198.151/js/9.m.437592dd.chunk.js

104.248.198.151

200

18 kB

URL HTTP/1.1
104.248.198.151/js/9.m.437592dd.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (34594)
Size
18 kB (17492 bytes)
Hash
21fb7b1a51bb02234d9a75f6e5af6387
a211e40fbb790f4fa0de87400a3cad7d1006130e
1d7874d0257bd116e1418c1941928e601c3637aecb50bc9a41bdb733cbbb1f0a

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/9.m.437592dd.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"59416-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

r3.o.lencr.org/

23.36.76.226

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a740252e7b24892a3e34f6dfed6e3bde
d44d21abb95edd1ccc775632254f11ee94fb585e
e289995a2b4b340364dd7dfa32c79c7722ece6cc4b893b38fc68bbce680d2f94

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E289995A2B4B340364DD7DFA32C79C7722ECE6CC4B893B38FC68BBCE680D2F94"
Last-Modified: Mon, 27 Mar 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6263
Expires: Wed, 29 Mar 2023 11:54:37 GMT
Date: Wed, 29 Mar 2023 10:10:14 GMT
Connection: keep-alive

104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

104.248.198.151

200

10 kB

URL HTTP/1.1
104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (43281)
Size
10 kB (10072 bytes)
Hash
4e37d731be022cdc3e4fb3d8867d6f67
7e3f1d2cf64037ba0da3bf8f5b94eeb72cad2185
f0505ee0689ebda4bdf559b48804d22c6c8ce0869d79a6366cee8674fb7f886b

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO MIPS File Download Request from IP Address

HTTP Headers

GET /sessions/new?return_to=%2Ff%2Fxs.mips HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/api/navigation/global

104.248.198.151

401

0 B

URL HTTP/1.1
104.248.198.151/api/navigation/global
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /api/navigation/global HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips
Connection: keep-alive

HTTP/1.1 401 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Length: 0
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff

104.248.198.151/api/l10n/index?locale=en-US&ts=2023-03-29T10%3A10%3A37%2B0000

104.248.198.151

304

0 B

URL HTTP/1.1
104.248.198.151/api/l10n/index?locale=en-US&ts=2023-03-29T10%3A10%3A37%2B0000
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /api/l10n/index?locale=en-US&ts=2023-03-29T10%3A10%3A37%2B0000 HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips
Connection: keep-alive

HTTP/1.1 304 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, must-revalidate
Sonar-Version: 7.9.5.38598

104.248.198.151/js/vendors-app.m.b88ebad0.chunk.js

104.248.198.151

200

54 kB

URL HTTP/1.1
104.248.198.151/js/vendors-app.m.b88ebad0.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (64942)
Size
54 kB (54040 bytes)
Hash
99aefef73eaad012bf380f6474008336
c9002a1094783bbb25bee661f8a35f2caa711e3d
dabed327494fd3a55119b4fbc35599364f14aaccf1f40d09cd9a23205ca40673

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/vendors-app.m.b88ebad0.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"165141-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

push.services.mozilla.com/

34.117.65.55

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
34.117.65.55:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: jhMhpDGq5BtLXobBC077Bg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 8Vzcvqi2oXo8+318YEPmD7X9PdU=
Date: Wed, 29 Mar 2023 10:10:14 GMT
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

104.248.198.151/js/app.m.3ee455d5.chunk.js

104.248.198.151

200

47 kB

URL HTTP/1.1
104.248.198.151/js/app.m.3ee455d5.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (65536), with no line terminators
Size
47 kB (47400 bytes)
Hash
de37f25ca046a0e68790c7e74999dcbe
252de6699ba49ea6db56058440a1c5637833cf55
d3a4754f99af4b468997f258f10586d11be1df4fd27cbd88ac7bbc64925e426f

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/app.m.3ee455d5.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"188922-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Last-Modified, Retry-After, ETag, Content-Length, Content-Type, Backoff, Pragma, Expires, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 29 Mar 2023 09:17:26 GMT
age: 3168
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

104.248.198.151/favicon.ico

104.248.198.151

200

5.4 kB

URL HTTP/1.1
104.248.198.151/favicon.ico
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
5.4 kB (5430 bytes)
Hash
b4e4785d5852c563b9ae47cbb7af06fe
b9a7a5180304bf8af55cce900012010239c1dd80
0cb0b90207b376931f9a8fa5d518f6b1ea2ecf6b0d67d634ae01a38ecb8ad8b5

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: image/x-icon
Content-Length: 5430
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
ETag: W/"5430-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT

104.248.198.151/apple-touch-icon-180x180.png

104.248.198.151

200

6.1 kB

URL HTTP/1.1
104.248.198.151/apple-touch-icon-180x180.png
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Size
6.1 kB (6087 bytes)
Hash
47204bd1431a1a73ef2525bfa5509fdc
8f98e730f717699b376ed5ceb6843eb77d2b0167
040bb39fa16f1bc88f01a26d1a471de74027b2d7a00035bf638b2dbf7755974d

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /apple-touch-icon-180x180.png HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: image/png
Content-Length: 6087
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
ETag: W/"6087-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT

104.248.198.151/js/369.m.d59054c6.chunk.js

104.248.198.151

200

561 B

URL HTTP/1.1
104.248.198.151/js/369.m.d59054c6.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (512)
Size
561 B (561 bytes)
Hash
7fac243e44988db163177060e7411591
7108d1c2bdaa91383903e1e79d23e12a2df57857
93fc935ddce94381d7b08c22f956b69b367539c7f9ec5cf7ef4b8318c829116f

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/369.m.d59054c6.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Content-Length: 561
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"561-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT

104.248.198.151/js/0.m.5f1f98f2.chunk.js

104.248.198.151

200

6.0 kB

URL HTTP/1.1
104.248.198.151/js/0.m.5f1f98f2.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (17170)
Size
6.0 kB (5960 bytes)
Hash
487a99c96e1d753bb9b22669b9b0cbff
f063ce08faaad0703234091e1567040ea4c166e9
ec7d1a65c6bcc0658deebc73f945dc48e617a7effcb47f44afc44e7b421a8ebb

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/0.m.5f1f98f2.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"18895-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/js/21.m.1264acfc.chunk.js

104.248.198.151

200

1.1 kB

URL HTTP/1.1
104.248.198.151/js/21.m.1264acfc.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (2205)
Size
1.1 kB (1122 bytes)
Hash
b8a74baf9f0938feed452e83535cf9d5
f067b3715c06d671ffddc15f86dadde1124c83d0
e99b758f54c1b8b0d161b098dd1aac940a33c53ac559e2fce3f9a1e759bfa4a2

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/21.m.1264acfc.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"2253-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/js/304.m.64d672ef.chunk.js

104.248.198.151

200

3.1 kB

URL HTTP/1.1
104.248.198.151/js/304.m.64d672ef.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
ASCII text, with very long lines (10155)
Size
3.1 kB (3051 bytes)
Hash
a1b1015267fe5b248707e3536fe83202
47b112b1b93807719f1ff1a7e2f1727ee4a3c534
3f721d6b76ebcd57589684aceca8d9996f3ee302a471d8755f293b64c02c8fc8

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/304.m.64d672ef.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"10204-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/api/users/identity_providers

104.248.198.151

200

24 B

URL HTTP/1.1
104.248.198.151/api/users/identity_providers
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type
JSON data\012- , ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f6771007e68c1504df1f503964c8f6d5
a021d30aa08ed4bbc01c28eb2414b6aae7b7df81
757bb747ba269253666a63bb8bf42b5711e8c5af8f7e03b17b1a1888e3e74e91

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /api/users/identity_providers HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://104.248.198.151/sessions/new?return_to=%2Ff%2Fxs.mips
Connection: keep-alive

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:15 GMT
Content-Type: application/json
Content-Length: 24
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, must-revalidate
Sonar-Version: 7.9.5.38598

104.248.198.151/js/app.m.3ee455d5.chunk.js

104.248.198.151

200

0 B

URL HTTP/1.1
104.248.198.151/js/app.m.3ee455d5.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/app.m.3ee455d5.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"188922-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

104.248.198.151/js/vendors-app.m.b88ebad0.chunk.js

104.248.198.151

200

0 B

URL HTTP/1.1
104.248.198.151/js/vendors-app.m.b88ebad0.chunk.js
IP
104.248.198.151:0
ASN
#14061 DIGITALOCEAN-ASN

File type

Size
0 B (0 bytes)
Hash

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /js/vendors-app.m.b88ebad0.chunk.js HTTP/1.1
Host: 104.248.198.151
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://104.248.198.151/f/xs.mips

HTTP/1.1 200 
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Mar 2023 10:10:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: max-age=31536000
Accept-Ranges: bytes
ETag: W/"165141-1605082808000"
Last-Modified: Wed, 11 Nov 2020 08:20:08 GMT
Content-Encoding: gzip
Vary: Accept-Encoding

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (11)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML