Report - 18.196.160.92/

Report Overview

Submitted URL
18.196.160.92/
IP
18.196.160.92
ASN
#16509 AMAZON-02
Submitted
2024-05-04 18:48:05
Access
public
Website Title
alexa
Final URL
18.196.160.92/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
14

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.trust-provider.cn	unknown	2015-04-09	2022-02-10	2024-05-03	334 B	1.1 kB	36.248.38.100
18.196.160.92	unknown	unknown	2018-01-26	2024-05-04	3.1 kB	719 kB	18.196.160.92

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-04	medium	18.196.160.92	Sinkholed
2024-05-04	medium	18.196.160.92	Sinkholed
2024-05-04	medium	18.196.160.92	Sinkholed
2024-05-04	medium	18.196.160.92	Sinkholed
2024-05-04	medium	18.196.160.92	Sinkholed
2024-05-04	medium	18.196.160.92	Sinkholed
2024-05-04	medium	18.196.160.92	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	18.196.160.92/static/application.config.js	212 B	2024-02-13	2024-05-14
Pretty URL 18.196.160.92/static/application.config.js IP 18.196.160.92 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-13 19:47:21 Last Seen2024-05-14 20:49:09 Times Seen8 Hash cbe140556fb319fe71531a7aa0b1e29e 0971c59efeefe45a08d12233ef08d0b2dfa45151 90a6087d94dc8e260941c4968309a104f14e05ee5ba9317a27f99d9b3c8fd157 Loading...

	18.196.160.92/static/js/manifest.2ae2e69a05c33dfc65f8.js	857 B	2023-03-07	2024-05-14
Pretty URL 18.196.160.92/static/js/manifest.2ae2e69a05c33dfc65f8.js IP 18.196.160.92 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:02:00 Last Seen2024-05-14 20:49:09 Times Seen200 Hash 323055c248c0cbf6e12cf4b27d6dfd9b 71dff9423565dde98338fe885c33098093408dcf d414b80e539a45c4c5b318d37543f524d2cfcc69c92256879afb2f1dd980fdd1 Loading...

HTTP Transactions (8)

URL IP Response Size

ocsp.trust-provider.cn/

36.248.38.100

281 B

URL
ocsp.trust-provider.cn/
IP
36.248.38.100:0
ASN
#4837 CHINA UNICOM China169 Backbone

File type
data
Size
281 B (281 bytes)
Hash
aba33918f10836a592d60f928445e8fb
f8b52bea3504be182a497f3e9d662f0d5ac967c9
78fab34768b483cd741dc48cb5bc1b1a4cefdd922b9f385dc37a42bbdb0095f3

HTTP Headers

POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 281
Connection: keep-alive
cf-cache-status: EXPIRED
age: 2984
expires: Sat, 11 May 2024 12:11:44 GMT
accept-ranges: bytes
etag: "f8b52bea3504be182a497f3e9d662f0d5ac967c9"
ctl-cache-status: HIT from hk-xianggang4-ca01, HIT from fj-quanzhou7-ca56, HIT from sn-xian3-ca05
x-frame-options: SAMEORIGIN
date: Sat, 04 May 2024 18:47:40 GMT
cache-control: max-age=3600
cf-ray: 87e8c02a6b12855f-HKG
last-modified: Sat, 04 May 2024 12:11:45 GMT
x-ccacdn-proxy-id: scdpinlb5
request-id: 663682ccea439c01a25795826816675f
via: n172-013-216.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 17148484601010a43b2e40d4ee9058f53993acc136
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=44, edge;dur=0

18.196.160.92/

18.196.160.92

200 OK

590 B

URL User Request GET HTTP/2
18.196.160.92/
IP
18.196.160.92:443
ASN
#16509 AMAZON-02

Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (590), with no line terminators
Size
590 B (590 bytes)
Hash
65951cb31e79cb9a3e5c89dde98dc26c
a1e998fd5bc78484ad3c4a5e0487d2bc9407ab9c
3e356fea0edb85ed0d8b7c7f342281c7ecf6f82a43fa9df9888dde24eb304f97

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 04 May 2024 18:47:42 GMT
content-type: text/html
content-length: 590
server: nginx
last-modified: Tue, 07 Nov 2023 02:22:34 GMT
etag: "65499f6a-24e"
cache-control: max-age=600
accept-ranges: bytes
X-Firefox-Spdy: h2

18.196.160.92/static/js/manifest.2ae2e69a05c33dfc65f8.js

18.196.160.92

200 OK

857 B

URL GET HTTP/2
18.196.160.92/static/js/manifest.2ae2e69a05c33dfc65f8.js
IP
18.196.160.92:443
ASN
#16509 AMAZON-02

Requested by
https://18.196.160.92/
Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type
ASCII text, with very long lines (799)
Size
857 B (857 bytes)
Hash
323055c248c0cbf6e12cf4b27d6dfd9b
71dff9423565dde98338fe885c33098093408dcf
d414b80e539a45c4c5b318d37543f524d2cfcc69c92256879afb2f1dd980fdd1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/manifest.2ae2e69a05c33dfc65f8.js HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://18.196.160.92/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 04 May 2024 18:47:42 GMT
content-type: application/javascript
content-length: 857
server: nginx
last-modified: Wed, 23 Sep 2020 13:54:28 GMT
etag: "5f6b5394-359"
accept-ranges: bytes
X-Firefox-Spdy: h2

18.196.160.92/static/application.config.js

18.196.160.92

200 OK

212 B

URL GET HTTP/2
18.196.160.92/static/application.config.js
IP
18.196.160.92:443
ASN
#16509 AMAZON-02

Requested by
https://18.196.160.92/
Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type
ASCII text
Size
212 B (212 bytes)
Hash
cbe140556fb319fe71531a7aa0b1e29e
0971c59efeefe45a08d12233ef08d0b2dfa45151
90a6087d94dc8e260941c4968309a104f14e05ee5ba9317a27f99d9b3c8fd157

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/application.config.js HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://18.196.160.92/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 04 May 2024 18:47:42 GMT
content-type: application/javascript
content-length: 212
server: nginx
last-modified: Tue, 07 Nov 2023 02:23:11 GMT
etag: "65499f8f-d4"
accept-ranges: bytes
X-Firefox-Spdy: h2

18.196.160.92/static/js/app.92ea468f42e72fae3386.js

18.196.160.92

200 OK

409 kB

URL GET HTTP/2
18.196.160.92/static/js/app.92ea468f42e72fae3386.js
IP
18.196.160.92:443
ASN
#16509 AMAZON-02

Requested by
https://18.196.160.92/
Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (63537), with no line terminators
Size
409 kB (409379 bytes)
Hash
f99a986a52f9329b0532cffee4bce5e9
5977300468fbeb32540208f878f8a59a14a1dd23
0269e2d1c4ef497593c1d4eb0d4f4726308515448bf3aaad4a5977611fa2d803

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/app.92ea468f42e72fae3386.js HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://18.196.160.92/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 04 May 2024 18:47:42 GMT
content-type: application/javascript
content-length: 409379
server: nginx
last-modified: Tue, 07 Nov 2023 02:22:48 GMT
vary: Accept-Encoding
etag: "65499f78-63f23"
accept-ranges: bytes
X-Firefox-Spdy: h2

18.196.160.92/static/css/app.4a65d06b7249442aab97c59b2823bed8.css

18.196.160.92

200 OK

306 kB

URL GET HTTP/2
18.196.160.92/static/css/app.4a65d06b7249442aab97c59b2823bed8.css
IP
18.196.160.92:443
ASN
#16509 AMAZON-02

Requested by
https://18.196.160.92/
Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
306 kB (305882 bytes)
Hash
aeeca65d16eaed772e72b5187f627597
7988ac9d02c3434a4c05ef4d598b634bc0ade1e5
8b47dac120923f5e73ed2430830d5b3d47057753f35e6d0ed065d6c665bc4e2b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/css/app.4a65d06b7249442aab97c59b2823bed8.css HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://18.196.160.92/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 04 May 2024 18:47:42 GMT
content-type: text/css
content-length: 305882
server: nginx
last-modified: Tue, 07 Nov 2023 02:22:40 GMT
vary: Accept-Encoding
etag: "65499f70-4aada"
accept-ranges: bytes
X-Firefox-Spdy: h2

18.196.160.92/favicon.ico

18.196.160.92

200 OK

590 B

URL GET HTTP/2
18.196.160.92/favicon.ico
IP
18.196.160.92:443
ASN
#16509 AMAZON-02

Requested by
https://18.196.160.92/
Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (590), with no line terminators
Size
590 B (590 bytes)
Hash
65951cb31e79cb9a3e5c89dde98dc26c
a1e998fd5bc78484ad3c4a5e0487d2bc9407ab9c
3e356fea0edb85ed0d8b7c7f342281c7ecf6f82a43fa9df9888dde24eb304f97

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://18.196.160.92/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 04 May 2024 18:47:43 GMT
content-type: text/html
content-length: 590
server: nginx
last-modified: Tue, 07 Nov 2023 02:23:08 GMT
etag: "65499f8c-24e"
cache-control: max-age=600
accept-ranges: bytes
X-Firefox-Spdy: h2

18.196.160.92/static/js/vendor.898bf13de21cab7d4911.js

0.0.0.0

0 B

URL GET
18.196.160.92/static/js/vendor.898bf13de21cab7d4911.js
IP
0.0.0.0:0
ASN
#0

Requested by
https://18.196.160.92/
Certificate
IssuerTrustAsia Technologies, Inc.
Subjectai.tclking.com
FingerprintA2:B9:09:0B:FA:B3:4E:76:C4:3B:B4:0D:25:9E:EF:10:9F:7E:A7:4D
ValidityMon, 04 Mar 2024 00:00:00 GMT - Mon, 31 Mar 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/js/vendor.898bf13de21cab7d4911.js HTTP/1.1
Host: 18.196.160.92
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://18.196.160.92/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (8)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN