Report - 167.103.19.194/

Report Overview

Submitted URL
167.103.19.194/
IP
167.103.19.194
ASN
#53813 ZSCALER-INC
Submitted
2024-04-24 18:48:02
Access
public
Website Title
Welcome To Zscaler Directory Authentication
Final URL
gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
167.103.19.194	unknown	unknown	No data	No data	385 B	358 B	167.103.19.194
gateway.zscloud.net	13712	2011-05-27	2014-04-11	2024-04-20	1.7 kB	36 kB	147.161.146.47

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	167.103.19.194	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7	1.6 kB	2023-03-08	2024-05-02
Pretty URL gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7 IP 147.161.146.47 ASN #62044 Zscaler Switzerland GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 19:58:25 Last Seen2024-05-02 06:15:40 Times Seen489 Hash 7c34fcb122d8febf0fd24adbddeebf54 d404c72d08e904edd424f53a541a6384f184f9c3 6c0fd787c1028cdb38077c2f68700cf64b86efd6c0a0914df9ac41701e6f191b Loading...

	gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7	0 B	2023-03-07	2024-05-06
Pretty URL gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7 IP 147.161.146.47 ASN #62044 Zscaler Switzerland GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-06 11:53:44 Times Seen37376903 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	18 B	2023-04-10	2024-05-02
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-04-10 21:15:26 Last Seen2024-05-02 06:15:40 Times Seen464 Hash aa5d300f2e380b9a0d81f86e691c26fd fc63e872eefbd5eb5da1a5524a2e4d4bd5db9986 8141fc05eb86ef27c81adbf84dc66bd9cf0d06fe848e3f3e63017098690b6760 Loading...

HTTP Transactions (4)

URL IP Response Size

167.103.19.194/

167.103.19.194

307 Temporary Redirect

0 B

URL User Request GET HTTP/1.1
167.103.19.194/
IP
167.103.19.194:80
ASN
#53813 ZSCALER-INC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 167.103.19.194
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 307 Temporary Redirect
Content-Length: 0
Access-Control-Allow-Origin: *
Location: https://gateway.zscloud.net:443/auD?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
Content-Type: text/html
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Set-Cookie: _sm_au_d=1;SameSite=LAX;path=/;domain=167.103.19.194

gateway.zscloud.net/auD?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7

147.161.146.47

307 Temporary Redirect

0 B

URL User Request GET HTTP/1.1
gateway.zscloud.net/auD?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
IP
147.161.146.47:443
ASN
#62044 Zscaler Switzerland GmbH

Certificate
IssuerDigiCert Inc
Subject*.zscloud.net
FingerprintB6:BC:77:15:07:7F:D9:0F:26:6C:20:8A:2A:8B:32:68:92:A9:67:D3
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sun, 06 Oct 2024 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /auD?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7 HTTP/1.1
Host: gateway.zscloud.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 307 Temporary Redirect
Content-Length: 0
Access-Control-Allow-Origin: *
Location: https://gateway.zscloud.net:443/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
Content-Type: text/html
Set-Cookie: _sm_au_d=1;path=/;domain=.zscloud.net;SameSite=None;Secure;HttpOnly;
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"

gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7

147.161.146.47

200 OK

22 kB

URL User Request GET HTTP/1.1
gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
IP
147.161.146.47:443
ASN
#62044 Zscaler Switzerland GmbH

Certificate
IssuerDigiCert Inc
Subject*.zscloud.net
FingerprintB6:BC:77:15:07:7F:D9:0F:26:6C:20:8A:2A:8B:32:68:92:A9:67:D3
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sun, 06 Oct 2024 23:59:59 GMT

File type
HTML document text HTML document, ASCII text, with very long lines (22033), with no line terminators
Size
22 kB (22033 bytes)
Hash
f79e5941525f2c7582a37f03679e8821
a2995be234a1b08cb2fdbb6ef47811a8c7cdd394
8f54fd4796802a86542f2e97bb1f35dcd11a1ccefbc47d1900fce91045850aa0

HTTP Headers

GET /auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7 HTTP/1.1
Host: gateway.zscloud.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: _sm_au_d=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
Server: Zscaler/6.2
Cache-Control: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-length: 22033
Set-Cookie: _sm__fch=WP6NSksTVksV6

gateway.zscloud.net/favicon.ico

147.161.146.47

403 Forbidden

14 kB

URL GET HTTP/1.1
gateway.zscloud.net/favicon.ico
IP
147.161.146.47:443
ASN
#62044 Zscaler Switzerland GmbH

Requested by
https://gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
Certificate
IssuerDigiCert Inc
Subject*.zscloud.net
FingerprintB6:BC:77:15:07:7F:D9:0F:26:6C:20:8A:2A:8B:32:68:92:A9:67:D3
ValidityWed, 06 Sep 2023 00:00:00 GMT - Sun, 06 Oct 2024 23:59:59 GMT

File type
HTML document text HTML document, ASCII text, with very long lines (2391)
Size
14 kB (13694 bytes)
Hash
12aa5fea0c1d66a43054785b2f3d9930
43edf5fc63d5ea71629a8f6fdb235f9fc3f4968b
0768577b85bdb8ec9ecbaa4b757b943493780ad9a1f8ff1fa84dccdbedb84308

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: gateway.zscloud.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gateway.zscloud.net/auT?origurl=http%3A%2F%2F167%2e103%2e19%2e194%2f&_ordtok=DZZ3WVZ7KFSNNq4jsH7VD8F2M7
Cookie: _sm_au_d=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Content-Type: text/html
Server: Zscaler/6.2
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Content-length: 13694

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (4)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers