Report - 172.232.159.13

Report Overview

Submitted URL
172.232.159.13
IP
172.232.159.13
ASN
#63949 Akamai Connected Cloud
Submitted
2024-04-26 05:29:39
Access
public
Website Title
OpenVPN CWS
Final URL
172.232.159.13/?src=connect
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
60

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mitmdetection.services.mozilla.com	67826	1994-10-18	2019-07-22	2024-04-23	366 B	326 B	54.230.111.49
172.232.159.13	unknown	unknown	No data	No data	19 kB	743 kB	172.232.159.13

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed
2024-04-26	medium	172.232.159.13	Sinkholed

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	172.232.159.13/js/lib/json2.min.js	3.4 kB	2023-05-17	2024-04-29
Pretty URL 172.232.159.13/js/lib/json2.min.js IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-17 11:47:41 Last Seen2024-04-29 11:23:43 Times Seen25 Hash 35ee2c48bc8e66cbf949aab854d65d04 e1a916748c79387ac69c4add0fe977607e47780a 6082321fa006c2afea53132ac86165e4a598f3e53b2721cc8dedcbeacb667e54 Loading...

	172.232.159.13/js/lib-cws.js?v=1553284059	7.6 kB	2023-05-17	2024-04-26
Pretty URL 172.232.159.13/js/lib-cws.js?v=1553284059 IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-17 11:47:41 Last Seen2024-04-26 07:29:46 Times Seen18 Hash 29cfe232c3415ea0b1cb374b004ee78b 9ff0243eaf73003a55d8c9528a840a485a18beed 8ad16ebcc2920635ce21cbf0f6cf21dc1d4db2caa47a08e92dc9f51d566d7b74 Loading...

	172.232.159.13/bootstrap.min.js	60 kB	2023-03-07	2024-05-05
Pretty URL 172.232.159.13/bootstrap.min.js IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:32 Last Seen2024-05-05 19:10:16 Times Seen6405 Hash 6bea60c34c5db6797150610dacdc6bce 544afefd148715da7dd52d368a414703390ca0e0 38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff Loading...

	172.232.159.13/?src=connect	162 B	2023-05-17	2024-04-29
Pretty URL 172.232.159.13/?src=connect IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-17 11:47:41 Last Seen2024-04-29 11:23:43 Times Seen13 Hash cfbf6d91652b9710ed15a8fd8f29180b 02f5983f8b9c1d0f4a4528ac98af8d68072a6bba 5d10251a90d34461d2f5f03846030c73d99aa56db7af3e85534234ceddaf5475 Loading...

	172.232.159.13/popper.min.js	19 kB	2023-03-07	2024-05-06
Pretty URL 172.232.159.13/popper.min.js IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:09:31 Last Seen2024-05-06 08:34:53 Times Seen1383 Hash 6383a57baa1479e8490a42f4184b7f0b a7e89fa1896ec8afca2a442b792c9aa29e5823dd 5292e677fe712c80863414e9e73f3678d86d409f751392b6803b70a949fc1017 Loading...

	172.232.159.13/bootstrap-select.min.js	52 kB	2023-03-07	2024-05-05
Pretty URL 172.232.159.13/bootstrap-select.min.js IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:03:50 Last Seen2024-05-05 20:36:34 Times Seen1255 Hash ba9d5bbe072f5626909db4e31da3ba4d 44f87f163f71d0bac27876272fa98f615381fcf8 6763de73150d26e3296cd0154ff12dede3b5d39251c734c0ae4f8af4e437e4cc Loading...

	172.232.159.13/jquery.min.js	90 kB	2023-03-07	2024-05-06
Pretty URL 172.232.159.13/jquery.min.js IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-05-06 15:47:48 Times Seen266449 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	172.232.159.13/qrcode.js	13 kB	2023-05-17	2024-04-26
Pretty URL 172.232.159.13/qrcode.js IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-17 11:47:41 Last Seen2024-04-26 07:29:46 Times Seen22 Hash 689ce972c075abd47036d6d3b872351d f1de512359b944181c04ddd76807849a1e34e117 96d296336c91c047aca5230e2d4ca303e713f6c26c3928e3778bd0d77c48e3e4 Loading...

	172.232.159.13/?src=connect	1.0 kB	2024-04-26	2024-04-26
Pretty URL 172.232.159.13/?src=connect IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-26 07:29:46 Last Seen2024-04-26 07:29:46 Times Seen1 Hash 881d635be7658e4a78191c0c1af8438c da2cf7d7c95c500d67a02b89198121765b63325f 93a1f7e8d4b87fbe1e5eb7e729ebf3e7eb401a16c0f954d05470872eef3b0ad0 Loading...

	172.232.159.13/js/connect-cws.js?v=1553284059	26 kB	2024-02-08	2024-04-26
Pretty URL 172.232.159.13/js/connect-cws.js?v=1553284059 IP 172.232.159.13 ASN #63949 Akamai Connected Cloud Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-08 21:15:32 Last Seen2024-04-26 07:29:46 Times Seen14 Hash 81975f9903c0201931ff73543adb0363 b4c529bfde37073beacc96151e3cca1cd7193aab 06ce334ffe48dbfd6bee06baaf5fed183e033f258dd00ea388c4ed8aeec2ab13 Loading...

HTTP Transactions (31)

URL IP Response Size

mitmdetection.services.mozilla.com/

54.230.111.49

0 B

URL
mitmdetection.services.mozilla.com/
IP
54.230.111.49:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

HEAD / HTTP/1.1
Host: mitmdetection.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
content-type: application/xml
date: Fri, 26 Apr 2024 05:29:14 GMT
server: AmazonS3
x-cache: Error from cloudfront
via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: cAGS2H_RTEw4-AxT9cedH4IcBCDWqkBCpGNwMiq1fI3R-s2S-X4Rew==
X-Firefox-Spdy: h2

172.232.159.13/

172.232.159.13

302 Found

0 B

URL User Request GET HTTP/1.1
172.232.159.13/
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:14 GMT
Location: https://172.232.159.13/__session_start__
Content-Length: 0
Set-Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw; Expires=Fri, 26 Apr 2024 05:59:14 GMT; Path=/; Secure; HttpOnly

172.232.159.13/__session_start__

172.232.159.13

302 Found

59 B

URL User Request GET HTTP/1.1
172.232.159.13/__session_start__
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
HTML document, ASCII text
Size
59 B (59 bytes)
Hash
20b5dcc7a42ef848f11b67929654c7b2
1c4c4bbfb63f51eae1ae53cdd3baa83bbb998ca3
c49c6e7ed4e7f44391cff036e6eeca2371f324c272cd563cd551ea58f0995ac2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /__session_start__ HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:14 GMT
Location: https://172.232.159.13/
Content-Length: 59

172.232.159.13/

172.232.159.13

302 Found

0 B

URL User Request GET HTTP/1.1
172.232.159.13/
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:14 GMT
Location: /?src=connect

172.232.159.13/?src=connect

172.232.159.13

4.3 kB

URL
172.232.159.13/?src=connect
IP
172.232.159.13:0
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
HTML document, ASCII text, with very long lines (869)
Size
4.3 kB (4283 bytes)
Hash
330dd94c05472c73a0f619537dfa6221
809912353899a1bf01708eb8e90782f59a33c304
0930a310491c540a06dda1642e79f86a97a64904785b6daa1063ed1fa7cf73fc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?src=connect HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:14 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4283

172.232.159.13/load-fonts.css

172.232.159.13

200 OK

1.4 kB

URL GET HTTP/1.1
172.232.159.13/load-fonts.css
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text
Size
1.4 kB (1353 bytes)
Hash
0006c5755c9fb271a81ba2b4074db3f2
1f5f46ae39b2faa7f925077a65382f8f7c21f835
aec35173a7631923704b1030573be26f3dda488bd0bdb0043fe1f536820f6ba6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /load-fonts.css HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1353

172.232.159.13/bootstrap.min.css

172.232.159.13

200 OK

160 kB

URL GET HTTP/1.1
172.232.159.13/bootstrap.min.css
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text, with very long lines (65324)
Size
160 kB (160403 bytes)
Hash
3afe15e976734d9daac26310110c4594
4f14a09a606c99a11f8fda15564ef66f70402826
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bootstrap.min.css HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 160403

172.232.159.13/bootstrap-select.min.css

172.232.159.13

200 OK

11 kB

URL GET HTTP/1.1
172.232.159.13/bootstrap-select.min.css
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text, with very long lines (10879), with CRLF line terminators
Size
11 kB (11120 bytes)
Hash
2d868f5f03695620ad1c172dfb4ebbdc
ca09c1cfac0e43f60db2f0845768caa5838cecab
69279bee49c5f3502f7a3f07358da1562cc0a10d57e8a56cfc0f8977d367c99f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bootstrap-select.min.css HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 11120

172.232.159.13/css/style.css?v=1553284059

172.232.159.13

200 OK

1.9 kB

URL GET HTTP/1.1
172.232.159.13/css/style.css?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text
Size
1.9 kB (1875 bytes)
Hash
f1b9ed18fefa4c0adfb7ec2e779098d5
ec5baac63187938372742c199bfe8cc6be9c2ec9
50f51c5162563b91a3bd2cd1d5ffe3091eee193371848199c5486c299f12aebf

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/style.css?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1875

172.232.159.13/bootstrap.min.js

172.232.159.13

200 OK

60 kB

URL GET HTTP/1.1
172.232.159.13/bootstrap.min.js
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (59893)
Size
60 kB (60174 bytes)
Hash
6bea60c34c5db6797150610dacdc6bce
544afefd148715da7dd52d368a414703390ca0e0
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bootstrap.min.js HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 60174

172.232.159.13/all.min.css

172.232.159.13

200 OK

80 kB

URL GET HTTP/1.1
172.232.159.13/all.min.css
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text, with very long lines (65394)
Size
80 kB (79597 bytes)
Hash
32adeb405522e886e870370c80425f16
62115f1585197dc6b350fa5f162e64e39f7986fd
c3d8c409f0ad78fe1288ba3b3404c06b1722b83ac3a69248e0f356e83d03bf7e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /all.min.css HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 79597

172.232.159.13/js/lib/json2.min.js

172.232.159.13

200 OK

3.4 kB

URL GET HTTP/1.1
172.232.159.13/js/lib/json2.min.js
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (582), with CRLF line terminators
Size
3.4 kB (3436 bytes)
Hash
35ee2c48bc8e66cbf949aab854d65d04
e1a916748c79387ac69c4add0fe977607e47780a
6082321fa006c2afea53132ac86165e4a598f3e53b2721cc8dedcbeacb667e54

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/lib/json2.min.js HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 3436

172.232.159.13/qrcode.js

172.232.159.13

200 OK

13 kB

URL GET HTTP/1.1
172.232.159.13/qrcode.js
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
HTML document, ASCII text, with very long lines (523), with CRLF line terminators
Size
13 kB (13006 bytes)
Hash
689ce972c075abd47036d6d3b872351d
f1de512359b944181c04ddd76807849a1e34e117
96d296336c91c047aca5230e2d4ca303e713f6c26c3928e3778bd0d77c48e3e4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /qrcode.js HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 13006

172.232.159.13/bootstrap-select.min.js

172.232.159.13

200 OK

52 kB

URL GET HTTP/1.1
172.232.159.13/bootstrap-select.min.js
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (51959)
Size
52 kB (52249 bytes)
Hash
ba9d5bbe072f5626909db4e31da3ba4d
44f87f163f71d0bac27876272fa98f615381fcf8
6763de73150d26e3296cd0154ff12dede3b5d39251c734c0ae4f8af4e437e4cc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /bootstrap-select.min.js HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 52249

172.232.159.13/js/lib-cws.js?v=1553284059

172.232.159.13

200 OK

7.6 kB

URL GET HTTP/1.1
172.232.159.13/js/lib-cws.js?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (543)
Size
7.6 kB (7635 bytes)
Hash
29cfe232c3415ea0b1cb374b004ee78b
9ff0243eaf73003a55d8c9528a840a485a18beed
8ad16ebcc2920635ce21cbf0f6cf21dc1d4db2caa47a08e92dc9f51d566d7b74

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/lib-cws.js?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 7635

172.232.159.13/js/connect-cws.js?v=1553284059

172.232.159.13

200 OK

26 kB

URL GET HTTP/1.1
172.232.159.13/js/connect-cws.js?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (600)
Size
26 kB (26285 bytes)
Hash
81975f9903c0201931ff73543adb0363
b4c529bfde37073beacc96151e3cca1cd7193aab
06ce334ffe48dbfd6bee06baaf5fed183e033f258dd00ea388c4ed8aeec2ab13

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/connect-cws.js?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 26285

172.232.159.13/popper.min.js

172.232.159.13

200 OK

19 kB

URL GET HTTP/1.1
172.232.159.13/popper.min.js
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (18860)
Size
19 kB (19033 bytes)
Hash
6383a57baa1479e8490a42f4184b7f0b
a7e89fa1896ec8afca2a442b792c9aa29e5823dd
5292e677fe712c80863414e9e73f3678d86d409f751392b6803b70a949fc1017

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /popper.min.js HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 19033

172.232.159.13/jquery.min.js

172.232.159.13

200 OK

90 kB

URL GET HTTP/1.1
172.232.159.13/jquery.min.js
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
90 kB (89501 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /jquery.min.js HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/x-javascript
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 89501

172.232.159.13/logo

172.232.159.13

200 OK

19 kB

URL GET HTTP/1.1
172.232.159.13/logo
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
PNG image data, 664 x 175, 8-bit/color RGBA, interlaced
Size
19 kB (18660 bytes)
Hash
5d9730e2b3ab035f3045f9c7a4c6f62c
299b6574f2f9fe4512b3487065ca009fe2ccedb3
bc1a2be47a9bd11315f591a92d420f2ff06359403572c35a6b39b7136c66ad97

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /logo HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 18660

172.232.159.13/open-vpn-logo.png

172.232.159.13

1.8 kB

URL
172.232.159.13/open-vpn-logo.png
IP
172.232.159.13:0
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
PNG image data, 79 x 14, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1750 bytes)
Hash
6aef6a38eccf1b06e4f1d17268d81b09
d88e981dd44f32c6794a341d1290b4a58b990501
f9702ca06f17996477501afb9ea9236f6c22168e439968a99433ce60633761ef

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /open-vpn-logo.png HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1750

172.232.159.13/poppins-v9-latin-regular.woff2

172.232.159.13

200 OK

8.0 kB

URL GET HTTP/1.1
172.232.159.13/poppins-v9-latin-regular.woff2
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7968, version 1.0
Size
8.0 kB (7968 bytes)
Hash
1a280523d375e9358d5229df34fc8e94
eec7a97bc1319b123a7addb438fa8a231469b511
fab32ccef85408b763c899ad7c0b910c96c76dc9ed7158ce304fdcd3c0bf8388

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /poppins-v9-latin-regular.woff2 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/load-fonts.css
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 7968

172.232.159.13/fa-light-300.woff2

172.232.159.13

157 kB

URL
172.232.159.13/fa-light-300.woff2
IP
172.232.159.13:0
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
Web Open Font Format (Version 2), TrueType, length 157064, version 329.-17761
Size
157 kB (157064 bytes)
Hash
20bbccf14518922fa95a440f4c217d9e
3b6df1951440663f01dad7a45c034ce6ef506895
558c1708821688922a35f8105bc9b840a73ae02165d0016746c71741ab48128d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fa-light-300.woff2 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/all.min.css
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 157064

172.232.159.13/html/login.html?v=1553284059

172.232.159.13

200 OK

2.0 kB

URL GET HTTP/1.1
172.232.159.13/html/login.html?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
HTML document, ASCII text
Size
2.0 kB (1968 bytes)
Hash
d208608162ebc31a5be18713abaa051b
b31266cd0e65091d8c363b9629385253250b583b
5b902fadbc81f4a8349d0a18b027aa17e2938f59132f530883b7461671cea903

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /html/login.html?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1968

172.232.159.13/favicon.ico

172.232.159.13

200 OK

1.2 kB

URL GET HTTP/1.1
172.232.159.13/favicon.ico
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
32a8c07c149098f52cda6c0d6b19fdce
b4f5917543a5c593ea6131159f4c93cae0462a3b
b63c06fc9bee3e2135aedbb6f96b44c777b75a00ad8d3df8dcf572f9ab2bde75

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/x-icon
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1150

172.232.159.13/html/login-challenge.html?v=1553284059

172.232.159.13

627 B

URL
172.232.159.13/html/login-challenge.html?v=1553284059
IP
172.232.159.13:0
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text
Size
627 B (627 bytes)
Hash
6d1e53e93e5155148e94048ac06cd14d
724977d0cd938e140ccf6ccd52d6b6b87311e269
af56b6e2ac80cf26dbf5fd22ecfe9dec97b17db4c011fe5bb995c51008f36f43

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /html/login-challenge.html?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 627

172.232.159.13/html/downloads.html?v=1553284059

172.232.159.13

200 OK

5.3 kB

URL GET HTTP/1.1
172.232.159.13/html/downloads.html?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
HTML document, ASCII text
Size
5.3 kB (5273 bytes)
Hash
79f1560b544fdf766590ece218ce3ae3
adf5ca5758d8c762de40a69c707e7a8590b0fe7c
a55559f0be798529230ce6607c6755ea3a8d50fe02bc564e8eacb40640007dce

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /html/downloads.html?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 5273

172.232.159.13/html/import_profile.html?v=1553284059

172.232.159.13

200 OK

1.5 kB

URL GET HTTP/1.1
172.232.159.13/html/import_profile.html?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text
Size
1.5 kB (1492 bytes)
Hash
37c9ad98bc00862614f9da505ce631a8
82224825737f1fa9bb36985eb529216fc09dceb7
9fe7ad0167a7fc7cf5d36b4a683a35a384cd557569f940e08f3f29fcaf6f45d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /html/import_profile.html?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1492

172.232.159.13/html/profiles.html?v=1553284059

172.232.159.13

200 OK

1.6 kB

URL GET HTTP/1.1
172.232.159.13/html/profiles.html?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text
Size
1.6 kB (1585 bytes)
Hash
d749c0346f308a30d510feaa413c0733
cfb1404d4ad1d3f89fa4cd6ee21a30896b316b47
1aace9b45aa44d3a43ded96a19313090148d581f5059587fe03cbbfb6166be9a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /html/profiles.html?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 1585

172.232.159.13/html/password.html?v=1553284059

172.232.159.13

200 OK

946 B

URL GET HTTP/1.1
172.232.159.13/html/password.html?v=1553284059
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
ASCII text
Size
946 B (946 bytes)
Hash
0a9f88d8029b2be0b47c03692aa6cd30
cfff4b5db058abb1e3fa135dea173d53f4991517
94b60bb2a455856a150af70192527cc2de373db6fc6aec5114f595ba4f5b0bc9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /html/password.html?v=1553284059 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 946

172.232.159.13/session2.json?_ts=1714109355512

172.232.159.13

928 B

URL
172.232.159.13/session2.json?_ts=1714109355512
IP
172.232.159.13:0
ASN
#63949 Akamai Connected Cloud

Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
HTML document, ASCII text
Size
928 B (928 bytes)
Hash
79493e7f7beacb9fb01c900bf0bc7286
eb84d908c11572d47df7ced687ee22bdfb19a990
c87456d50a7fa4e006d07c8b6f8fb081ff18325498c6bd17d666bd94867cdf27

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /session2.json?_ts=1714109355512 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-OpenVPN: 1
X-CWS-Proto-Ver: 2
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/?src=connect
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache

172.232.159.13/poppins-v9-latin-regular.woff2

172.232.159.13

200 OK

8.0 kB

URL GET HTTP/1.1
172.232.159.13/poppins-v9-latin-regular.woff2
IP
172.232.159.13:443
ASN
#63949 Akamai Connected Cloud

Requested by
https://172.232.159.13/?src=connect
Certificate
Issuer
Subject172.232.159.13
Fingerprint10:7D:22:3C:9F:8A:63:3C:78:89:B0:A7:50:AA:36:0F:B4:35:3E:8E
ValidityMon, 13 Nov 2023 15:06:57 GMT - Wed, 13 Nov 2024 15:06:57 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7968, version 1.0
Size
8.0 kB (7968 bytes)
Hash
1a280523d375e9358d5229df34fc8e94
eec7a97bc1319b123a7addb438fa8a231469b511
fab32ccef85408b763c899ad7c0b910c96c76dc9ed7158ce304fdcd3c0bf8388

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /poppins-v9-latin-regular.woff2 HTTP/1.1
Host: 172.232.159.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://172.232.159.13/load-fonts.css
Cookie: openvpn_sess_XuG0G6KDnHdoBITx3w7vl6KnwAgnf4ZqijXZmyDxUuCR2UTljXh0QrlNuAPADgW1Bg1f8uHkEnsMge084nKumQ=lPfuaf8kXITksdu5xqAsQ-S2f7l69olQwJ5r2h_-6lkp_dPO3w1Js6RPRvym9DIL2h1Uq1vBXaMIW--XZN2JWw
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: font/woff2
X-Frame-Options: SAMEORIGIN
Server: OpenVPN-AS
Date: Fri, 26 Apr 2024 05:29:15 GMT
Content-Length: 7968

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML