Report - l-two-two.com/M8vmBW1

Report Overview

Visited public
2023-11-28 05:59:25
Tags
URL
l-two-two.com/M8vmBW1
Finishing URL
l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313
IP / ASN
160.202.163.18
#45382 EHOSTICT
Title
LINKAGE

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
l-two-two.com	unknown	2022-07-26	2022-08-09 15:33:05	2023-07-04 03:21:29	6.4 kB	538 kB	160.202.163.18
netdna.bootstrapcdn.com	3413	2012-05-25	2012-09-07 17:11:00	2023-11-27 10:29:42	866 B	87 kB	104.18.10.207

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-28 05:59:11	high	160.202.163.18	Client IP	ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)
2023-11-28 05:59:11	high	160.202.163.18	Client IP	ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)
2023-11-28 05:59:12	high	160.202.163.18	Client IP	ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)
2023-11-28 05:59:12	high	160.202.163.18	Client IP	ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)
2023-11-28 05:59:13	high	160.202.163.18	Client IP	ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)
2023-11-28 05:59:13	high	160.202.163.18	Client IP	ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	From	Size	First Seen	Last Seen
	l-two-two.com/js/jsp/jquery-1.11.3.min.js	ScriptElement	96 kB	2023-03-07	2025-05-11
Pretty URL l-two-two.com/js/jsp/jquery-1.11.3.min.js IP 160.202.163.18 ASN #45382 EHOSTICT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07 Last Seen2025-05-11 05:55 Times Seen1718 Hash 13c0a5055cca7b2463b2f73701960b9e e6082a7b52db82604ac446d2e6a32cb5af263781 20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104 Loading...

	l-two-two.com/js/jsp/bootstrap.js	ScriptElement	72 kB	2023-03-07	2025-05-09
Pretty URL l-two-two.com/js/jsp/bootstrap.js IP 160.202.163.18 ASN #45382 EHOSTICT Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:19 Last Seen2025-05-09 02:30 Times Seen163 Hash 24276f268f56771dc4141e6b3d93a2aa 474b25cebd06d57a38090c6716d5dfaa5591baad d5fa375baaa8c2ae0f8a7a42b0ab21695a9ec04c68166ceb44118a6d27405449 Loading...

HTTP Transactions (17)

	URL	IP	Response	Size
	l-two-two.com/M8vmBW1	160.202.163.18	302 Found	0 B
URL User Request GET HTTP/1.1 l-two-two.com/M8vmBW1 IP 160.202.163.18:80 ASN #45382 EHOSTICT File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /M8vmBW1 HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 302 Found Date: Tue, 28 Nov 2023 05:59:07 GMT Server: Apache Location: http://l-two-two.com/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8`

	l-two-two.com/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313	160.202.163.18	302 Found	0 B
URL User Request GET HTTP/1.1 l-two-two.com/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 IP 160.202.163.18:80 ASN #45382 EHOSTICT File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 302 Found Date: Tue, 28 Nov 2023 05:59:08 GMT Server: Apache Location: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8`

	l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313	160.202.163.18	200 OK	13 kB
URL User Request GET HTTP/1.1 l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 IP 160.202.163.18:80 ASN #45382 EHOSTICT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1176), with CRLF line terminators Size 13 kB (12594 bytes) Hash b567f07ba2fd31a04823eb94fb6c778e 14630a6e59263b5dbf5048ca8431251bca440fbd 115f964452c4ad3190193b4521956d0fb2ae0ebf359b25be3ccdeeb978db661b HTTP Headers `GET /pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:09 GMT Server: Apache X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8`

	netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css	104.18.10.207	200 OK	7.8 kB
URL GET HTTP/1.1 netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css IP 104.18.10.207:80 ASN #13335 CLOUDFLARENET Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type ASCII text, with very long lines (30837) Size 7.8 kB (7782 bytes) Hash 269550530cc127b6aa5a35925a7de6ce 512c7d79033e3028a9be61b540cf1a6870c896f8 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd HTTP Headers `GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1 Host: netdna.bootstrapcdn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/ Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:09 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: DE Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 Content-Encoding: gzip ETag: W/"269550530cc127b6aa5a35925a7de6ce" Last-Modified: Mon, 25 Jan 2021 22:04:55 GMT CDN-CachedAt: 10/31/2023 18:48:06 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 722 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: 80f8aafddd0209efde488e1048444b77 CDN-Cache: HIT CF-Cache-Status: HIT Age: 349327 Server: cloudflare CF-RAY: 82d0621f19ddb511-OSL alt-svc: h3=":443"; ma=86400

	l-two-two.com/site_design/template/62e26e41bda0c/pc/login/index.css	160.202.163.18	200 OK	15 kB
URL GET HTTP/1.1 l-two-two.com/site_design/template/62e26e41bda0c/pc/login/index.css IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type Unicode text, UTF-8 text, with CRLF line terminators Size 15 kB (14815 bytes) Hash b03eb4ed75bd4dc961f930933f7aaaa9 105490b256c9ba204ad2e87359077188065f8c28 a86e74e7ba9d415fffd65907a4e9086a3e831a72f809bf43eb12806c434b99d7 HTTP Headers `GET /site_design/template/62e26e41bda0c/pc/login/index.css HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 11:56:46 GMT ETag: "39df-5e4dc3a52db80" Accept-Ranges: bytes Content-Length: 14815 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/css`

	l-two-two.com/css/csscs/bootstrap.css	160.202.163.18	200 OK	144 kB
URL GET HTTP/1.1 l-two-two.com/css/csscs/bootstrap.css IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type ASCII text, with very long lines (540), with CRLF line terminators Size 144 kB (143470 bytes) Hash b7f87bf3d00c0848a4bf36ec04cd3a8a 23016e7320459c4b801647f47d1303f042b29f48 e154809dcabcc331a2915d2380f0cddadf2285197c8a7bf1bfdc4a0596a5251c HTTP Headers `GET /css/csscs/bootstrap.css HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Sat, 16 Jul 2022 11:52:25 GMT ETag: "2306e-5e3eac4abd040" Accept-Ranges: bytes Content-Length: 143470 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/css`

	netdna.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0	104.18.10.207	200 OK	77 kB
URL GET HTTP/1.1 netdna.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 IP 104.18.10.207:80 ASN #13335 CLOUDFLARENET Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data Size 77 kB (77160 bytes) Hash af7ae505a9eed503f8b8e6982036873e d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe HTTP Headers `GET /font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1 Host: netdna.bootstrapcdn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: identity Origin: http://l-two-two.com DNT: 1 Connection: keep-alive Referer: http://netdna.bootstrapcdn.com/ Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Content-Type: font/woff2 Content-Length: 77160 Connection: keep-alive CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: DE Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: "af7ae505a9eed503f8b8e6982036873e" Last-Modified: Mon, 25 Jan 2021 22:04:55 GMT CDN-CachedAt: 10/31/2023 19:08:24 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 752 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: 963e72a9fb5901c37514cda3f0cd96c6 CDN-Cache: HIT CF-Cache-Status: HIT Accept-Ranges: bytes Vary: Accept-Encoding Server: cloudflare CF-RAY: 82d06225193056a4-OSL alt-svc: h3=":443"; ma=86400

	l-two-two.com/image/imgimg/sample1.jpg	160.202.163.18	200 OK	10 kB
URL GET HTTP/1.1 l-two-two.com/image/imgimg/sample1.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 300x200, components 3\012- data Size 10 kB (10507 bytes) Hash c283e30abe53bd68d9eb4ca8b272d4e0 bda5f78fe06198717da60a11d9db8982bb52f2a7 e8fb7d7d8dccfec227637ab489d4ff88d4f98cd66fd438e465b80e364addb298 HTTP Headers `GET /image/imgimg/sample1.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 02:46:22 GMT ETag: "290b-5e4d489f09b80" Accept-Ranges: bytes Content-Length: 10507 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/js/jsp/bootstrap.js	160.202.163.18	200 OK	72 kB
URL GET HTTP/1.1 l-two-two.com/js/jsp/bootstrap.js IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type ASCII text, with CRLF line terminators Size 72 kB (72084 bytes) Hash 24276f268f56771dc4141e6b3d93a2aa 474b25cebd06d57a38090c6716d5dfaa5591baad d5fa375baaa8c2ae0f8a7a42b0ab21695a9ec04c68166ceb44118a6d27405449 HTTP Headers `GET /js/jsp/bootstrap.js HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Tue, 12 Jul 2022 10:55:26 GMT ETag: "11994-5e39981848380" Accept-Ranges: bytes Content-Length: 72084 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/javascript`

	l-two-two.com/js/jsp/jquery-1.11.3.min.js	160.202.163.18	200 OK	96 kB
URL GET HTTP/1.1 l-two-two.com/js/jsp/jquery-1.11.3.min.js IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type ASCII text, with very long lines (32038), with CRLF line terminators Size 96 kB (95962 bytes) Hash 13c0a5055cca7b2463b2f73701960b9e e6082a7b52db82604ac446d2e6a32cb5af263781 20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104 HTTP Headers `GET /js/jsp/jquery-1.11.3.min.js HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Tue, 12 Jul 2022 11:00:12 GMT ETag: "176da-5e39992908700" Accept-Ranges: bytes Content-Length: 95962 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/javascript`

	l-two-two.com/image/imgimg/sample3.jpg	160.202.163.18	200 OK	14 kB
URL GET HTTP/1.1 l-two-two.com/image/imgimg/sample3.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 300x200, components 3\012- data Size 14 kB (14303 bytes) Hash 0c81dc1c08caee8728d6f2c0c6141b21 18548b3f0f4a735575cc4257d524c18b6fd4ebcd 60f0279c3446cf3293b832101a3c07b1c03f20548017d3b8bc4d1569941742ad HTTP Headers `GET /image/imgimg/sample3.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 02:46:22 GMT ETag: "37df-5e4d489f09b80" Accept-Ranges: bytes Content-Length: 14303 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/image/linkage/fprogo.jpg	160.202.163.18	200 OK	5.7 kB
URL GET HTTP/1.1 l-two-two.com/image/linkage/fprogo.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 239x37, components 3\012- data Size 5.7 kB (5738 bytes) Hash 16b2fce7ce601ca7eb6685ed102e21a5 34fbd338ab68e82f3d8ee9008a0cc684250faafa e8bbd181eb193af027e32b213c4c6d594f9f9988977312ffaec8e9d7f0f5da03 HTTP Headers `GET /image/linkage/fprogo.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:11 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 02:47:48 GMT ETag: "166a-5e4d48f10dd00" Accept-Ranges: bytes Content-Length: 5738 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/image/imgimg/sample4.jpg	160.202.163.18	200 OK	18 kB
URL GET HTTP/1.1 l-two-two.com/image/imgimg/sample4.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 300x204, components 3\012- data Size 18 kB (18002 bytes) Hash fc33e750b3836f5a158950f3276d1255 e9676f03d0ffbae50ac26645de40a61c45b309f6 cf1e75da779e470fea03f0b97ae3f179c23761835725968d8ad16d6ff0db3e14 HTTP Headers `GET /image/imgimg/sample4.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:11 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 02:46:22 GMT ETag: "4652-5e4d489f09b80" Accept-Ranges: bytes Content-Length: 18002 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/photo/ps/616bc629c2314893bf3ea2e0eaf0ba03b5c34d13.jpg	160.202.163.18	200 OK	47 kB
URL GET HTTP/1.1 l-two-two.com/photo/ps/616bc629c2314893bf3ea2e0eaf0ba03b5c34d13.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=12, height=400, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=400], baseline, precision 8, 261x320, components 3\012- data Size 47 kB (47200 bytes) Hash 81197e67a67910a52ad5a9b32a6fd565 8ca48b89a8811cee90bd9c4cbb39cd73142d3cde 1f42fb6e96cab21fde4912c81114a9f4749597cb9ecaa677bad1a69fb26c57f5 HTTP Headers `GET /photo/ps/616bc629c2314893bf3ea2e0eaf0ba03b5c34d13.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:11 GMT Server: Apache Last-Modified: Sat, 26 Jun 2021 00:49:35 GMT ETag: "b860-5c5a0a14a65c0" Accept-Ranges: bytes Content-Length: 47200 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/image/imgimg/sample2.jpg	160.202.163.18	200 OK	58 kB
URL GET HTTP/1.1 l-two-two.com/image/imgimg/sample2.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 300x200, components 3\012- data Size 58 kB (57968 bytes) Hash ab87dfc2bf7d5c4814fa0d7b69bbfec6 fad022dac3729f7dee9874579afd2f3f0507d500 797eefc39ff26777cffc9009ad79cedc1ceeed141aec3f8d9cfc05eb704f93cf HTTP Headers `GET /image/imgimg/sample2.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:10 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 02:46:22 GMT ETag: "e270-5e4d489f09b80" Accept-Ranges: bytes Content-Length: 57968 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/image/linkage/bg.jpg	160.202.163.18	200 OK	40 kB
URL GET HTTP/1.1 l-two-two.com/image/linkage/bg.jpg IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 216x216, components 3\012- data Size 40 kB (40224 bytes) Hash 51b5c50fce2d64586cf8d0f91f6da7bf b087bc1760cc2763d13363dd7479ecbc88e76572 da1f8cbbf4cd44fb9eee78da27d727c955762d1e590f47e4626a0e9c3c98870d HTTP Headers `GET /image/linkage/bg.jpg HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/site_design/template/62e26e41bda0c/pc/login/index.css Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:11 GMT Server: Apache Last-Modified: Thu, 28 Jul 2022 02:47:48 GMT ETag: "9d20-5e4d48f10dd00" Accept-Ranges: bytes Content-Length: 40224 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/jpeg`

	l-two-two.com/favicon.ico	160.202.163.18	200 OK	198 B
URL GET HTTP/1.1 l-two-two.com/favicon.ico IP 160.202.163.18:80 ASN #45382 EHOSTICT Requested by http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 File type MS Windows icon resource - 1 icon, 16x16, 2 colors\012- data Size 198 B (198 bytes) Hash c6acedaff906029fc5455d9ec52c7f42 92cbd806ca421aa2c9ff5e1ff76bbc20913a2f81 9deb629637088856fe61dc868bf40a7d21ed942e4117659f3d6c3408f59b906b HTTP Headers `GET /favicon.ico HTTP/1.1 Host: l-two-two.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://l-two-two.com/pc/login/read_receivemail.php?id=98451868&pass=ihdO&mid=641510313 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 28 Nov 2023 05:59:11 GMT Server: Apache Last-Modified: Fri, 17 Aug 2012 01:17:09 GMT ETag: "c6-4c76beb3e4f40" Accept-Ranges: bytes Content-Length: 198 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: image/vnd.microsoft.icon`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (17)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash