Report - 185.125.50.17/

Report Overview

Submitted URL
185.125.50.17/
IP
185.125.50.17
ASN
#215730 H2nexus Ltd
Submitted
2024-04-24 07:39:28
Access
public
Website Title
Unam Web Panel — Login
Final URL
185.125.50.17/pages/login.php
Tags
botpanel malware
urlquery detections
Malware - Botnet panel

Detections

urlquery
16
Network Intrusion Detection
0
Threat Detection Systems
30

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
zerossl.ocsp.sectigo.com	4049	2018-08-16	2020-05-09	2024-04-22	336 B	1.2 kB	104.18.38.233
185.125.50.17	unknown	unknown	No data	No data	5.8 kB	1.8 MB	185.125.50.17

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed
2024-04-24	medium	185.125.50.17	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	185.125.50.17/assets/modules/select2/select2.min.js	71 kB	2023-03-08	2024-04-29
Pretty URL 185.125.50.17/assets/modules/select2/select2.min.js IP 185.125.50.17 ASN #215730 H2nexus Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:22:52 Last Seen2024-04-29 17:11:23 Times Seen338 Hash 37dd3c4be796c3e4d2914e336fc84624 efd00b3c59b9093335cfcc043fa0576587676636 d7a7379926f63b11f218a615443f004d03fc499bc1baf50d4142b1b2a76c3772 Loading...

	185.125.50.17/__UNAM_LIB/unam_lib.js	952 B	2023-03-08	2024-04-29
Pretty URL 185.125.50.17/__UNAM_LIB/unam_lib.js IP 185.125.50.17 ASN #215730 H2nexus Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:22:52 Last Seen2024-04-29 17:11:23 Times Seen305 Hash 8c7fb12cb6f7e2df13448f35fcc57fb4 d21730a298168b00466ccf8d73232794c789bc23 203a6503c36c58ca3a61da4107de3834e15419b1f5540b98e7ff2c503b01e2ee Loading...

	185.125.50.17/pages/login.php	0 B	2023-03-07	2024-05-06
Pretty URL 185.125.50.17/pages/login.php IP 185.125.50.17 ASN #215730 H2nexus Ltd Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-06 08:36:37 Times Seen37375151 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	185.125.50.17/assets/modules/jquery/jquery-3.7.1.min.js	88 kB	2023-08-31	2024-05-06
Pretty URL 185.125.50.17/assets/modules/jquery/jquery-3.7.1.min.js IP 185.125.50.17 ASN #215730 H2nexus Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-31 16:03:19 Last Seen2024-05-06 04:30:45 Times Seen8751 Hash 2c872dbe60f4ba70fb85356113d8b35e ee48592d1fff952fcf06ce0b666ed4785493afdc fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Loading...

	185.125.50.17/assets/modules/izitoast/iziToast.min.js	18 kB	2023-03-07	2024-04-29
Pretty URL 185.125.50.17/assets/modules/izitoast/iziToast.min.js IP 185.125.50.17 ASN #215730 H2nexus Ltd Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:01:52 Last Seen2024-04-29 23:58:23 Times Seen576 Hash df383d4feeb05ea8bfe86a0569ef0524 c6fd53b0a4abc2b73f55025ecb28d2eb65db93d4 df6d4fc52f8f3af6ef59c215a1165e4667f7daaedf4c5409db56d7c133564446 Loading...

HTTP Transactions (16)

URL IP Response Size

zerossl.ocsp.sectigo.com/

104.18.38.233

728 B

URL
zerossl.ocsp.sectigo.com/
IP
104.18.38.233:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
728 B (728 bytes)
Hash
f64967837743793f1f86d8d46db39012
ce0bd37744b6c52cefe61b73740c9ca92e5a35de
890bd87a20e31c9edfb986c75297f30ed000731ec5d237f169a2517c4723c3dd

HTTP Headers

POST / HTTP/1.1
Host: zerossl.ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Content-Type: application/ocsp-response
Content-Length: 728
Connection: keep-alive
Last-Modified: Mon, 22 Apr 2024 06:44:10 GMT
Expires: Mon, 29 Apr 2024 06:44:09 GMT
Etag: "ce0bd37744b6c52cefe61b73740c9ca92e5a35de"
Cache-Control: max-age=428105,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb4
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 87946ff01bb1712f-OSL

185.125.50.17/

185.125.50.17

302 Found

0 B

URL User Request GET HTTP/1.1
185.125.50.17/
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
X-Powered-By: PHP/8.2.12
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-b1hdYbyGXeXuVQkZJE5QWg=='; style-src 'self'; img-src 'self' data:; object-src 'none'; frame-src 'none'; child-src 'none'; worker-src 'none'; media-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none';
Feature-Policy: geolocation 'none'; microphone 'none'; camera 'none'
Permissions-Policy: geolocation=(), microphone=(), camera=()
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Robots-Tag: noindex, nofollow
Cross-Origin-Resource-Policy: same-origin
Set-Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura; path=/; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: pages/login.php
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

185.125.50.17/pages/login.php

185.125.50.17

3.5 kB

URL User Request GET
185.125.50.17/pages/login.php
IP
185.125.50.17:0
ASN
#215730 H2nexus Ltd

File type
HTML document, ASCII text, with very long lines (324), with CRLF line terminators
Size
3.5 kB (3528 bytes)
Hash
139edb167eac3059d96549b1994b37f4
32885cffa987dc22bf26a6ad5acc05573bbf6aa0
53a9974aa1972efaea9a7afbb9fc897eda7cd90e52b8d13095d6a59240fc6127

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pages/login.php HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
X-Powered-By: PHP/8.2.12
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-S5DByXAgSGNdQnalijHcwQ=='; style-src 'self'; img-src 'self' data:; object-src 'none'; frame-src 'none'; child-src 'none'; worker-src 'none'; media-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none';
Feature-Policy: geolocation 'none'; microphone 'none'; camera 'none'
Permissions-Policy: geolocation=(), microphone=(), camera=()
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Robots-Tag: noindex, nofollow
Cross-Origin-Resource-Policy: same-origin
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 3528
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

185.125.50.17/assets/modules/fontawesome-free/css/solid.min.css

185.125.50.17

200 OK

673 B

URL GET HTTP/1.1
185.125.50.17/assets/modules/fontawesome-free/css/solid.min.css
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
ASCII text, with very long lines (483), with CRLF line terminators
Size
673 B (673 bytes)
Hash
3b659e3d10259f2c31001fee050aeb63
b4be4363d60981bd76c578190333414f0b91407c
7854d8e44687343f7178f324562de684a174684f0e92c66ce00d4c4bf1795fc1

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/fontawesome-free/css/solid.min.css HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "2a1-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 673
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

185.125.50.17/assets/css/custom.css

185.125.50.17

200 OK

5.3 kB

URL GET HTTP/1.1
185.125.50.17/assets/css/custom.css
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
assembler source, ASCII text, with CRLF line terminators
Size
5.3 kB (5331 bytes)
Hash
274d1b39686a1af376b031b629e3cea4
01c5158874c3721961a929d68ce2bf602e29addb
b6feea9f686c611086401d611e776bf8258a92ca065ba8269edfd4c6414e93da

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/css/custom.css HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 04 Feb 2024 13:09:09 GMT
ETag: "14d3-6108e0cf44740"
Accept-Ranges: bytes
Content-Length: 5331
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

185.125.50.17/assets/modules/fontawesome-free/css/fontawesome.min.css

185.125.50.17

200 OK

58 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/fontawesome-free/css/fontawesome.min.css
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
ASCII text, with very long lines (57726), with CRLF line terminators
Size
58 kB (57916 bytes)
Hash
bb747d04bc4c8aa452bb9bd91ae47935
9039d9584b2e8f55f9da771dcf1b4854b6633e14
e0351876703417eb2a9985cb15ecf9910966d2941e7c61c8f3907a2834c38383

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/fontawesome-free/css/fontawesome.min.css HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "e23c-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 57916
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css

185.125.50.17/assets/modules/izitoast/iziToast.min.css

185.125.50.17

200 OK

42 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/izitoast/iziToast.min.css
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
ASCII text, with very long lines (41419), with CRLF line terminators
Size
42 kB (41505 bytes)
Hash
b2f7bdc3ed47f5956551ce0333925792
d2c6cd54cf8a6c040c28844b306543b76eeab8b8
7fa7d6e3b4039b59b4d4721ea7e523a42a4dc0b56405829df9f8696f8550fa01

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/izitoast/iziToast.min.css HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "a221-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 41505
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

185.125.50.17/assets/modules/select2/select2.min.css

185.125.50.17

200 OK

15 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/select2/select2.min.css
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
ASCII text, with very long lines (14965), with CRLF line terminators
Size
15 kB (14967 bytes)
Hash
ba5948c0bda0f5f26bd3068ce565deaa
6d28595693ce13f1a79db7d5c73bd82b13cf63b5
c2a282dd6dac10a3fbf469b4e67f489608777854e6d157bf11233dfbaa16851e

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/select2/select2.min.css HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "3a77-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 14967
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

185.125.50.17/assets/modules/select2/select2.min.js

185.125.50.17

200 OK

71 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/select2/select2.min.js
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (64130), with CRLF line terminators
Size
71 kB (70852 bytes)
Hash
37dd3c4be796c3e4d2914e336fc84624
efd00b3c59b9093335cfcc043fa0576587676636
d7a7379926f63b11f218a615443f004d03fc499bc1baf50d4142b1b2a76c3772

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/select2/select2.min.js HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "114c4-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 70852
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/x-javascript

185.125.50.17/__UNAM_LIB/unam_lib.js

185.125.50.17

200 OK

952 B

URL GET HTTP/1.1
185.125.50.17/__UNAM_LIB/unam_lib.js
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
ASCII text, with CRLF line terminators
Size
952 B (952 bytes)
Hash
8c7fb12cb6f7e2df13448f35fcc57fb4
d21730a298168b00466ccf8d73232794c789bc23
203a6503c36c58ca3a61da4107de3834e15419b1f5540b98e7ff2c503b01e2ee

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /__UNAM_LIB/unam_lib.js HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "3b8-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 952
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/x-javascript

185.125.50.17/assets/modules/izitoast/iziToast.min.js

185.125.50.17

200 OK

18 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/izitoast/iziToast.min.js
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (18398), with CRLF line terminators
Size
18 kB (18486 bytes)
Hash
df383d4feeb05ea8bfe86a0569ef0524
c6fd53b0a4abc2b73f55025ecb28d2eb65db93d4
df6d4fc52f8f3af6ef59c215a1165e4667f7daaedf4c5409db56d7c133564446

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/izitoast/iziToast.min.js HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "4836-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 18486
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/x-javascript

185.125.50.17/assets/modules/jquery/jquery-3.7.1.min.js

185.125.50.17

200 OK

88 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/jquery/jquery-3.7.1.min.js
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
88 kB (87533 bytes)
Hash
2c872dbe60f4ba70fb85356113d8b35e
ee48592d1fff952fcf06ce0b666ed4785493afdc
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/jquery/jquery-3.7.1.min.js HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Mon, 15 Jan 2024 06:26:30 GMT
ETag: "155ed-60ef61823b180"
Accept-Ranges: bytes
Content-Length: 87533
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/x-javascript

185.125.50.17/assets/css/adminlte.min.css

185.125.50.17

200 OK

1.4 MB

URL GET HTTP/1.1
185.125.50.17/assets/css/adminlte.min.css
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
ASCII text, with very long lines (65148), with CRLF line terminators
Size
1.4 MB (1382986 bytes)
Hash
efd25adb317155ad5b5e3ab8a9a692dd
db0afb70249f3787a94bd4e97ebda0878191d394
8777aaf5d50b19f517d03349f82ac8634fac8d2d4ef71a715fead6a43435ee25

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/css/adminlte.min.css HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Tue, 20 Dec 2022 23:52:50 GMT
ETag: "151a4a-5f04b222ad880"
Accept-Ranges: bytes
Content-Length: 1382986
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

185.125.50.17/assets/fonts/sourcesanspro-regular-webfont.woff2

185.125.50.17

200 OK

20 kB

URL GET HTTP/1.1
185.125.50.17/assets/fonts/sourcesanspro-regular-webfont.woff2
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
Web Open Font Format (Version 2), TrueType, length 20540, version 2.2949
Size
20 kB (20540 bytes)
Hash
d67b548b833d70dda3779916f5415e7e
f1d3b0c478384a35f0766d9d1839aea81a164b3f
8792619becd8b285e78f14bfcf1ad66e2adbae0f5ec8ad131246621f806ac535

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/fonts/sourcesanspro-regular-webfont.woff2 HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://185.125.50.17/assets/css/custom.css
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:04 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sat, 03 Feb 2024 10:44:42 GMT
ETag: "503c-61077ea84fa80"
Accept-Ranges: bytes
Content-Length: 20540
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

185.125.50.17/assets/modules/fontawesome-free/webfonts/fa-solid-900.woff2

185.125.50.17

200 OK

78 kB

URL GET HTTP/1.1
185.125.50.17/assets/modules/fontawesome-free/webfonts/fa-solid-900.woff2
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
Web Open Font Format (Version 2), TrueType, length 78196, version 331.-31261
Size
78 kB (78196 bytes)
Hash
e8a427e15cc502bef99cfd722b37ea98
a9922842a120a7f1eaced667480c5e185a106d69
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/modules/fontawesome-free/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://185.125.50.17/assets/modules/fontawesome-free/css/solid.min.css
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:04 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "13174-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 78196
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive

185.125.50.17/assets/img/favicon.png

185.125.50.17

200 OK

1.8 kB

URL GET HTTP/1.1
185.125.50.17/assets/img/favicon.png
IP
185.125.50.17:80
ASN
#215730 H2nexus Ltd

Requested by
http://185.125.50.17/pages/login.php

File type
PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Size
1.8 kB (1846 bytes)
Hash
596af1ae4b10854e334121133691325b
ccbaa5ee0def372ae2d791e7c0666e5777c75198
576d5210ef7bd676fff12be80fd61b793c5acdc618b4734f2da4cd638966e496

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/img/favicon.png HTTP/1.1
Host: 185.125.50.17
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=ndkpltriscer89bths7nvv4ura
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 07:39:04 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/1.1.1w PHP/8.2.12 mod_perl/2.0.12 Perl/v5.34.1
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "736-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 1846
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (16)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN