Report - 1212937-cj74480.tw1.ru/pages/login.php

Report Overview

Visited public
2025-03-02 03:37:57
Tags
botpanel malware
URL
1212937-cj74480.tw1.ru/pages/login.php
Finishing URL
1212937-cj74480.tw1.ru/pages/login.php
IP / ASN
37.220.83.212
#9123 TimeWeb Ltd.
Title
Unam Web Panel — Login
Malware - Botnet panel

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
1212937-cj74480.tw1.ru	unknown	2006-06-29	2025-03-02	2025-03-02	5.7 kB	311 kB	37.220.83.212

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-03-02 03:37:26	high	Client IP	37.220.83.212	ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)
2025-03-02 03:37:26	high	Client IP	37.220.83.212	ThreatFox botnet C2 traffic (url - confidence level: 100%)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	1212937-cj74480.tw1.ru/pages/login.php	ScriptElement	0 B	0001-01-01	2025-06-12
Pretty URL 1212937-cj74480.tw1.ru/pages/login.php IP 37.220.83.212 ASN #9123 TimeWeb Ltd. Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-06-12 10:38 Times Seen4928347 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	1212937-cj74480.tw1.ru/assets/modules/jquery/jquery-3.7.1.min.js	ScriptElement	88 kB	2023-08-31	2025-06-12
Pretty URL 1212937-cj74480.tw1.ru/assets/modules/jquery/jquery-3.7.1.min.js IP 37.220.83.212 ASN #9123 TimeWeb Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-31 16:03 Last Seen2025-06-12 10:33 Times Seen38764 Hash 2c872dbe60f4ba70fb85356113d8b35e ee48592d1fff952fcf06ce0b666ed4785493afdc fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Loading...

	1212937-cj74480.tw1.ru/assets/modules/izitoast/iziToast.min.js	ScriptElement	18 kB	2023-03-07	2025-06-11
Pretty URL 1212937-cj74480.tw1.ru/assets/modules/izitoast/iziToast.min.js IP 37.220.83.212 ASN #9123 TimeWeb Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:01 Last Seen2025-06-11 17:15 Times Seen626 Hash df383d4feeb05ea8bfe86a0569ef0524 c6fd53b0a4abc2b73f55025ecb28d2eb65db93d4 df6d4fc52f8f3af6ef59c215a1165e4667f7daaedf4c5409db56d7c133564446 Loading...

	1212937-cj74480.tw1.ru/assets/modules/select2/select2.min.js	ScriptElement	71 kB	2023-03-08	2025-06-09
Pretty URL 1212937-cj74480.tw1.ru/assets/modules/select2/select2.min.js IP 37.220.83.212 ASN #9123 TimeWeb Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:22 Last Seen2025-06-09 02:05 Times Seen372 Hash 37dd3c4be796c3e4d2914e336fc84624 efd00b3c59b9093335cfcc043fa0576587676636 d7a7379926f63b11f218a615443f004d03fc499bc1baf50d4142b1b2a76c3772 Loading...

	1212937-cj74480.tw1.ru/__UNAM_LIB/unam_lib.js	ScriptElement	952 B	2023-03-08	2025-06-09
Pretty URL 1212937-cj74480.tw1.ru/__UNAM_LIB/unam_lib.js IP 37.220.83.212 ASN #9123 TimeWeb Ltd. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 15:22 Last Seen2025-06-09 02:05 Times Seen411 Hash 8c7fb12cb6f7e2df13448f35fcc57fb4 d21730a298168b00466ccf8d73232794c789bc23 203a6503c36c58ca3a61da4107de3834e15419b1f5540b98e7ff2c503b01e2ee Loading...

HTTP Transactions (14)

URL IP Response Size

1212937-cj74480.tw1.ru/pages/login.php

37.220.83.212

200 OK

1.2 kB

URL User Request GET HTTP/1.1
1212937-cj74480.tw1.ru/pages/login.php
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

File type
HTML document, ASCII text, with very long lines (324), with CRLF line terminators
Size
1.2 kB (1232 bytes)
Hash
b73750ea2eae26b1eb202746d2879ca2
96db94290779b164df3274d7100694ab7c60161a
211dd987748f1d9d045c1a3ee470de05d7787acf678e070c3f51df174476a53c

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

NIDS	Severity	Alert
suricata	high	ThreatFox botnet C2 traffic (url - confidence level: 100%)

HTTP Headers

GET /pages/login.php HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-LNknjBHHmlHFWVcRE9pczA=='; style-src 'self'; img-src 'self' data:; object-src 'none'; frame-src 'none'; child-src 'none'; worker-src 'none'; media-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none';
Feature-Policy: geolocation 'none'; microphone 'none'; camera 'none'
Permissions-Policy: geolocation=(), microphone=(), camera=()
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Robots-Tag: noindex, nofollow
Cross-Origin-Resource-Policy: same-origin
Set-Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib; path=/; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1232
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/css/fontawesome.min.css

37.220.83.212

200 OK

13 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/css/fontawesome.min.css
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
ASCII text, with very long lines (57726), with CRLF line terminators
Size
13 kB (12586 bytes)
Hash
bb747d04bc4c8aa452bb9bd91ae47935
9039d9584b2e8f55f9da771dcf1b4854b6633e14
e0351876703417eb2a9985cb15ecf9910966d2941e7c61c8f3907a2834c38383

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/fontawesome-free/css/fontawesome.min.css HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "e23c-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 12586
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/css/solid.min.css

37.220.83.212

200 OK

312 B

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/css/solid.min.css
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
ASCII text, with very long lines (483), with CRLF line terminators
Size
312 B (312 bytes)
Hash
3b659e3d10259f2c31001fee050aeb63
b4be4363d60981bd76c578190333414f0b91407c
7854d8e44687343f7178f324562de684a174684f0e92c66ce00d4c4bf1795fc1

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/fontawesome-free/css/solid.min.css HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "2a1-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 312
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

1212937-cj74480.tw1.ru/assets/modules/izitoast/iziToast.min.css

37.220.83.212

200 OK

10 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/izitoast/iziToast.min.css
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
ASCII text, with very long lines (41419), with CRLF line terminators
Size
10 kB (10437 bytes)
Hash
b2f7bdc3ed47f5956551ce0333925792
d2c6cd54cf8a6c040c28844b306543b76eeab8b8
7fa7d6e3b4039b59b4d4721ea7e523a42a4dc0b56405829df9f8696f8550fa01

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/izitoast/iziToast.min.css HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "a221-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 10437
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

1212937-cj74480.tw1.ru/assets/css/custom.css

37.220.83.212

200 OK

1.4 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/css/custom.css
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
assembler source, ASCII text, with CRLF line terminators
Size
1.4 kB (1426 bytes)
Hash
1123383213092643b28c31c521a184ef
5a584dd8aa499f0f0d97734b5f1c6a20444d77a4
19567504a2faa9db6515f2323aeb58f0892db85b0fca2a3cb7ffea243369d43f

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/css/custom.css HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 05 Feb 2024 11:50:21 GMT
ETag: "14ce-610a110fc1940-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1426
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css

1212937-cj74480.tw1.ru/assets/modules/select2/select2.min.js

37.220.83.212

200 OK

20 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/select2/select2.min.js
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (64130), with CRLF line terminators
Size
20 kB (19907 bytes)
Hash
37dd3c4be796c3e4d2914e336fc84624
efd00b3c59b9093335cfcc043fa0576587676636
d7a7379926f63b11f218a615443f004d03fc499bc1baf50d4142b1b2a76c3772

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/select2/select2.min.js HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "114c4-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 19907
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript

1212937-cj74480.tw1.ru/__UNAM_LIB/unam_lib.js

37.220.83.212

200 OK

389 B

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/__UNAM_LIB/unam_lib.js
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
ASCII text, with CRLF line terminators
Size
389 B (389 bytes)
Hash
8c7fb12cb6f7e2df13448f35fcc57fb4
d21730a298168b00466ccf8d73232794c789bc23
203a6503c36c58ca3a61da4107de3834e15419b1f5540b98e7ff2c503b01e2ee

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /__UNAM_LIB/unam_lib.js HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "3b8-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 389
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript

1212937-cj74480.tw1.ru/assets/modules/select2/select2.min.css

37.220.83.212

200 OK

2.0 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/select2/select2.min.css
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
ASCII text, with very long lines (14965), with CRLF line terminators
Size
2.0 kB (2000 bytes)
Hash
ba5948c0bda0f5f26bd3068ce565deaa
6d28595693ce13f1a79db7d5c73bd82b13cf63b5
c2a282dd6dac10a3fbf469b4e67f489608777854e6d157bf11233dfbaa16851e

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/select2/select2.min.css HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "3a77-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2000
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css

1212937-cj74480.tw1.ru/assets/modules/jquery/jquery-3.7.1.min.js

37.220.83.212

200 OK

30 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/jquery/jquery-3.7.1.min.js
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
30 kB (30362 bytes)
Hash
2c872dbe60f4ba70fb85356113d8b35e
ee48592d1fff952fcf06ce0b666ed4785493afdc
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/jquery/jquery-3.7.1.min.js HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Mon, 15 Jan 2024 06:26:30 GMT
ETag: "155ed-60ef61823b180-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 30362
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

1212937-cj74480.tw1.ru/assets/css/adminlte.min.css

37.220.83.212

200 OK

122 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/css/adminlte.min.css
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
ASCII text, with very long lines (65148), with CRLF line terminators
Size
122 kB (121678 bytes)
Hash
efd25adb317155ad5b5e3ab8a9a692dd
db0afb70249f3787a94bd4e97ebda0878191d394
8777aaf5d50b19f517d03349f82ac8634fac8d2d4ef71a715fead6a43435ee25

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/css/adminlte.min.css HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:26 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 20 Dec 2022 23:52:50 GMT
ETag: "151a4a-5f04b222ad880-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/css

1212937-cj74480.tw1.ru/assets/modules/izitoast/iziToast.min.js

37.220.83.212

200 OK

5.1 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/izitoast/iziToast.min.js
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (18398), with CRLF line terminators
Size
5.1 kB (5080 bytes)
Hash
df383d4feeb05ea8bfe86a0569ef0524
c6fd53b0a4abc2b73f55025ecb28d2eb65db93d4
df6d4fc52f8f3af6ef59c215a1165e4667f7daaedf4c5409db56d7c133564446

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/izitoast/iziToast.min.js HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "4836-5ddeaf2bb4c00-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5080
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/javascript

1212937-cj74480.tw1.ru/assets/fonts/sourcesanspro-regular-webfont.woff2

37.220.83.212

200 OK

20 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/fonts/sourcesanspro-regular-webfont.woff2
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
Web Open Font Format (Version 2), TrueType, length 20540, version 2.2949
Size
20 kB (20540 bytes)
Hash
d67b548b833d70dda3779916f5415e7e
f1d3b0c478384a35f0766d9d1839aea81a164b3f
8792619becd8b285e78f14bfcf1ad66e2adbae0f5ec8ad131246621f806ac535

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/fonts/sourcesanspro-regular-webfont.woff2 HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://1212937-cj74480.tw1.ru/assets/css/custom.css
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sat, 03 Feb 2024 10:44:42 GMT
ETag: "503c-61077ea84fa80"
Accept-Ranges: bytes
Content-Length: 20540
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: font/woff2

1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/webfonts/fa-solid-900.woff2

37.220.83.212

200 OK

78 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/webfonts/fa-solid-900.woff2
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
Web Open Font Format (Version 2), TrueType, length 78196, version 331.-31261
Size
78 kB (78196 bytes)
Hash
e8a427e15cc502bef99cfd722b37ea98
a9922842a120a7f1eaced667480c5e185a106d69
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/modules/fontawesome-free/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://1212937-cj74480.tw1.ru/assets/modules/fontawesome-free/css/solid.min.css
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "13174-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 78196
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff2

1212937-cj74480.tw1.ru/assets/img/favicon.png

37.220.83.212

200 OK

1.8 kB

URL GET HTTP/1.1
1212937-cj74480.tw1.ru/assets/img/favicon.png
IP
37.220.83.212:80
ASN
#9123 TimeWeb Ltd.

Requested by
http://1212937-cj74480.tw1.ru/pages/login.php

File type
PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Size
1.8 kB (1846 bytes)
Hash
596af1ae4b10854e334121133691325b
ccbaa5ee0def372ae2d791e7c0666e5777c75198
576d5210ef7bd676fff12be80fd61b793c5acdc618b4734f2da4cd638966e496

Detections

Analyzer	Verdict	Alert
urlquery	malware	Malware - Botnet panel

HTTP Headers

GET /assets/img/favicon.png HTTP/1.1
Host: 1212937-cj74480.tw1.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=3nker5j3bcjp3pfd7i53k45uib
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 02 Mar 2025 03:37:27 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Sun, 01 May 2022 03:34:08 GMT
ETag: "736-5ddeaf2bb4c00"
Accept-Ranges: bytes
Content-Length: 1846
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/png

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size