| 5.42.96.65:8081/login |  5.42.96.65 | | 9.0 kB |
IP5.42.96.65:0 ASN#39493 CJSC Kolomna-Sviaz TV
File typeHTML document, ASCII text, with CRLF line terminators Hash49ce4bd9a6bbdaf40335caeeab24f0f6 7483702728cfe367fa4252200f7ad1a035e022e8 5e52c3d964fc5e71ca6ed84cb3061f3d48921f12c08beb5f13e19be0fe5065c2
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /login HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 9036
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| cdn.jsdelivr.net/npm/toastify-js/src/toastify.min.css |  104.18.187.31 | 200 OK | 845 B |
URL GET HTTP/2cdn.jsdelivr.net/npm/toastify-js/src/toastify.min.css IP104.18.187.31:443
Requested byhttp://5.42.96.65:8081/login CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeASCII text, with very long lines (1052) Hashe2d7b8766226cfd5a2968d2e15297bb9 fb5575e03a25d8d4f17d67991d748ce7d71bf642 ee3e2cb414ba901f68aec843a0b31c25c4c5fd6071d78a1db9c16f2acd01e58f
GET /npm/toastify-js/src/toastify.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 14:44:29 GMT
content-type: text/css; charset=utf-8
content-length: 845
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 1.12.0
x-jsd-version-type: version
etag: W/"5f3-+1V14Dol2NTxfWeZHXSM59cb9kI"
content-encoding: br
x-served-by: cache-fra-etou8220126-FRA, cache-lga21953-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 4354
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrivQr2mfxvBF8DShOkz0BYwzv8rVNO9NqAg%2B2Ijm%2Fov7mH0PHqLarpFGrHssiFBJWZlRghKrQ9VjoOPKqJppI2TeOmBqBtdLBW8xbUvLsXrLevIurkKUxqzYJS11Qiq4fY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881ab526cf560b55-OSL
X-Firefox-Spdy: h2
|
|
| cdn.jsdelivr.net/npm/toastify-js | 104.18.187.31 | | 2.4 kB |
URL cdn.jsdelivr.net/npm/toastify-js IP104.18.187.31:0
CertificateIssuerSectigo Limited Subject*.jsdelivr.net Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (6311) Hashd01b47a4c6f303749ab44e1844573cdd 82720b71f10818e4d2f413b1afadb0d7827f0093 582becbb62bba81285347855cf7027db831b23e6419c89c427d05e4c3cea0741
GET /npm/toastify-js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 14:44:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 2425
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 1.12.0
x-jsd-version-type: version
etag: W/"1a78-gnILcfEIGOTS9BOxr62w14J/AJM"
content-encoding: br
x-served-by: cache-fra-etou8220096-FRA, cache-lga21932-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 4321
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1crJE6dNDFBahD9%2FpPrzd%2FAre4RomYoBdsoSaAOoVYZxwKGbZo5xSp%2F7o0xnd3CxzVNBv0DpSPXqksQ4CnQubkTTHO51ySOtHGx64mKr8qWu6EoAqudH%2BtbPfc%2FrTvGgQWU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881ab526cf5c0b55-OSL
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/font-awesome/5.11.2/css/all.min.css | 104.17.24.14 | 200 OK | 10 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/font-awesome/5.11.2/css/all.min.css IP104.17.24.14:443
Requested byhttp://5.42.96.65:8081/login CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeASCII text, with very long lines (56656) Hash41d394990448b2c2b1afe840e837dc8e 29250ef1fa6bfbda364a1112a86b2fb7157dd44b f8de3f57f49b005896d4c3c10979df9cff5048ddfe29ebbe36507ed1ebff60a4
GET /ajax/libs/font-awesome/5.11.2/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 14:44:29 GMT
content-type: text/css; charset=utf-8
content-length: 10022
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e60-de0a"
last-modified: Mon, 04 May 2020 16:10:08 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 32032
expires: Wed, 30 Apr 2025 14:44:29 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3IsQGEKX6a2XXWzapurlxnSg0jydWN7zYBPBwGGLWEnckIMmN5jf6VQd731Yn60IAFAbfCPgHP7sU3CdBGso34BJdp2IeQrtEq2POknnYUYGsltuk2T6aFqnVzp8id0t5nZhUCO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881ab5270b48568f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| 5.42.96.65:8081/index.c5b0c95d.css | 5.42.96.65 | | 137 kB |
URL 5.42.96.65:8081/index.c5b0c95d.css IP5.42.96.65:0 ASN#39493 CJSC Kolomna-Sviaz TV
File typeUnicode text, UTF-8 text, with very long lines (65533), with no line terminators Size137 kB (136649 bytes) Hashc624e1d6a5292f264a004b7dde013d6f 2cb56d7bae111e5f998b3739adee560b44dbb638 1e9641ef4a04cdff05f5b5cd524af6bc20adaf07c34a0f4003e3db05ccb57040
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /index.c5b0c95d.css HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 136649
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/vendorscripts.bundle.js | 5.42.96.65 | 200 OK | 50 kB |
URL GET HTTP/1.15.42.96.65:8081/vendorscripts.bundle.js IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typeJavaScript source, ASCII text, with very long lines (49541), with no line terminators Hasha5de1179e31ecb2453c13215d59548e6 0654eeba3a9b48f2766ebd1de18eccf4814e6c10 ca7c384797db9bd7d6920be3466da9af06a255bb04418badb9349d1d3d9b09cc
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /vendorscripts.bundle.js HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 49541
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/mainscripts.bundle.js | 5.42.96.65 | 200 OK | 139 kB |
URL GET HTTP/1.15.42.96.65:8081/mainscripts.bundle.js IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typeJavaScript source, ASCII text, with very long lines (1575) Size139 kB (138701 bytes) Hash2a5902ac4bb8e0383120fe2a89bb7145 fe16b79f9013199a112a7ae5d5f46e1aa3f54df2 d6db2ea8a1a3b0b9f2cdac9b8b71900752dee98503500d701a0859d8ab54af38
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mainscripts.bundle.js HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 138701
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/index.4c562d12.css | 5.42.96.65 | | 332 kB |
URL 5.42.96.65:8081/index.4c562d12.css IP5.42.96.65:0 ASN#39493 CJSC Kolomna-Sviaz TV
File typeUnicode text, UTF-8 (with BOM) text, with very long lines (64579), with no line terminators Size332 kB (331820 bytes) Hash1e05b8d2ccea2ddf81f28f01bb12fbe5 3268615b6ebbb1a0bcb9dbe78bdf72483c8af399 e6cb3651b7732dc14b9a9d6e6918f94333e9c462dfe6ab35a9601f0d6036ac6b
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /index.4c562d12.css HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 331820
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/libscripts.bundle.js | 5.42.96.65 | 200 OK | 187 kB |
URL GET HTTP/1.15.42.96.65:8081/libscripts.bundle.js IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators Size187 kB (186879 bytes) Hash17f2bebbade0f9da8640a0fdf345ad34 bff4b9d4df23c4cb1e346c04750f1e6965ab61b2 0a37abaca65b34c36b95489a853d2453d05dcccc685ab3e35ff52009befc7407
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /libscripts.bundle.js HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 186879
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/signin.73ddf31b.svg | 5.42.96.65 | | 11 kB |
URL 5.42.96.65:8081/signin.73ddf31b.svg IP5.42.96.65:0 ASN#39493 CJSC Kolomna-Sviaz TV
File typeSVG Scalable Vector Graphics image Hasheb6d11521c96aea6281ae350c4d64e48 57cad62c27fb35b94b885d4d5234fb669e7a2b22 76f3f68d92db2e526a53520d5630248214f254752df1db8a3b85e62569a37a3d
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /signin.73ddf31b.svg HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Type: image/svg+xml
Content-Length: 10631
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/logo.4d8a429d.png | 5.42.96.65 | 200 OK | 44 kB |
URL GET HTTP/1.15.42.96.65:8081/logo.4d8a429d.png IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typePNG image data, 288 x 272, 8-bit/color RGBA, non-interlaced Hashafc3a9b12f23267efe078e728b919538 f2f0365cab0bd75ebec8f767e4631dc3bc5c68fd 8bff11b5c87d706a5235e3de1bb506f4ece6c30b9a8173f5c5c1c9e8fd61f922
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /logo.4d8a429d.png HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 44241
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/Material-Design-Iconic-Fontd1f1.576c36d7.woff2 | 5.42.96.65 | 200 OK | 38 kB |
URL GET HTTP/1.15.42.96.65:8081/Material-Design-Iconic-Fontd1f1.576c36d7.woff2 IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typeWeb Open Font Format (Version 2), TrueType, length 38384, version 1.0 Hasha4d31128b633bc0b1cc1f18a34fb3851 6ee4c79372c3fd679706306ede47e4b03cf53d60 e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /Material-Design-Iconic-Fontd1f1.576c36d7.woff2 HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/index.4c562d12.css
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 38384
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| fonts.gstatic.com/s/comfortaa/v40/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDr0fIA9c.woff2 |  216.58.207.227 | 200 OK | 9.2 kB |
URL GET HTTP/2fonts.gstatic.com/s/comfortaa/v40/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDr0fIA9c.woff2 IP216.58.207.227:443
Requested byhttp://5.42.96.65:8081/login CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 9180, version 1.0 Hashd09100fdee59eb7a9e0a8a5315af0da1 18531fd1ca65a5b91b120338fdd8a2666e1bf09b e73109d50494d1ea233a174c776e69e86cb9ef1ad4fc87a54caac2b5d72e3389
GET /s/comfortaa/v40/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDr0fIA9c.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://5.42.96.65:8081
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9180
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 16:43:00 GMT
expires: Fri, 09 May 2025 16:43:00 GMT
cache-control: public, max-age=31536000
age: 79290
last-modified: Fri, 24 Jun 2022 19:25:09 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/comfortaa/v40/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDrMfIA.woff2 | 216.58.207.227 | 200 OK | 12 kB |
URL GET HTTP/2fonts.gstatic.com/s/comfortaa/v40/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDrMfIA.woff2 IP216.58.207.227:443
Requested byhttp://5.42.96.65:8081/login CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 12028, version 1.0 Hashc92223022d496bee841361b12c319d47 a7332119646a0bbddc2b7c6a4cc2e9b7a1ca92b6 7beee22f05326e6b35fe4737c4639433f496bac10e22e2b9ae23068a3d2aba29
GET /s/comfortaa/v40/1Pt_g8LJRfWJmhDAuUsSQamb1W0lwk4S4WjMDrMfIA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://5.42.96.65:8081
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 12028
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 11:24:56 GMT
expires: Tue, 06 May 2025 11:24:56 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 24 Jun 2022 19:17:50 GMT
content-type: font/woff2
age: 357574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 5.42.96.65:8081/logo.4d8a429d.png | 5.42.96.65 | 200 OK | 44 kB |
URL GET HTTP/1.15.42.96.65:8081/logo.4d8a429d.png IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typePNG image data, 288 x 272, 8-bit/color RGBA, non-interlaced Hashafc3a9b12f23267efe078e728b919538 f2f0365cab0bd75ebec8f767e4631dc3bc5c68fd 8bff11b5c87d706a5235e3de1bb506f4ece6c30b9a8173f5c5c1c9e8fd61f922
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /logo.4d8a429d.png HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 44241
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/vendorscripts.bundle.js | 5.42.96.65 | 200 OK | 50 kB |
URL GET HTTP/1.15.42.96.65:8081/vendorscripts.bundle.js IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typeJavaScript source, ASCII text, with very long lines (49541), with no line terminators Hasha5de1179e31ecb2453c13215d59548e6 0654eeba3a9b48f2766ebd1de18eccf4814e6c10 ca7c384797db9bd7d6920be3466da9af06a255bb04418badb9349d1d3d9b09cc
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /vendorscripts.bundle.js HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 49541
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/libscripts.bundle.js | 5.42.96.65 | 200 OK | 187 kB |
URL GET HTTP/1.15.42.96.65:8081/libscripts.bundle.js IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators Size187 kB (186879 bytes) Hash17f2bebbade0f9da8640a0fdf345ad34 bff4b9d4df23c4cb1e346c04750f1e6965ab61b2 0a37abaca65b34c36b95489a853d2453d05dcccc685ab3e35ff52009befc7407
| Analyzer | Verdict | Alert |
|---|
| urlquery | malware | Malware - Botnet panel | | Quad9 DNS | malicious | Sinkholed |
GET /libscripts.bundle.js HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public, max-age=2592000
Content-Length: 186879
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|
| 5.42.96.65:8081/mainscripts.bundle.js | 5.42.96.65 | 200 OK | 67 kB |
URL GET HTTP/1.15.42.96.65:8081/mainscripts.bundle.js IP5.42.96.65:8081 ASN#39493 CJSC Kolomna-Sviaz TV
Requested byhttp://5.42.96.65:8081/login
Hashf7e3fa70aff17a61a3ef48523bb4292c e0fccf1be9f3e2bd8e596af944799437e64b69da 7e44b8a13de2807570244b6bd044e8616967a2b4599b44d30ca0fb2d866b7d00
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /mainscripts.bundle.js HTTP/1.1
Host: 5.42.96.65:8081
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: http://5.42.96.65:8081/login
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 138701
Server: RisePro
Date: Fri, 10 May 2024 14:44:29 GMT
Connection: Keep-Alive
|
|