103.119.142.252:8001/reporting2/
302 Found 0 B URL User Request GET HTTP/1.1 103.119.142.252:8001/reporting2/
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/ HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Thu, 09 Nov 2023 10:54:57 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Location: public/index.php
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
103.119.142.252:8001/reporting2/public/index.php
302 Found 490 B URL User Request GET HTTP/1.1 103.119.142.252:8001/reporting2/public/index.php
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash afedac5a1c1d402b116a77fd5de60b94
6279996124b26211408e08ea0b9849cfa7682ed3
d04691397c02c834ae6a4eb595dba13d68fa64e0c7ea22ad93f2711517d440cf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/index.php HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Thu, 09 Nov 2023 10:54:57 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Cache-Control: no-cache, private
Location: http://103.119.142.252:8001/reporting2/public/index.php/login
Set-Cookie: XSRF-TOKEN=eyJpdiI6IjMrSkVtMzEwN0FkOEZ1aWhLQUJFR1E9PSIsInZhbHVlIjoiZE5VYkdpWkpJcm5jcVlQMlFsZTcxZ3J3TXRhSVlhajh0NHVUd3huWUNBTUZhQ0tLZndvajd2NUlYU0NQbjNDTE5OR2Z1SUZXS244RGdvRzV3YlR5SWFZNXMxaDNUY1Z3QkVNRU5XTUNtQjJ5eEdPc29sRDBERHVvVlQ5U3ZSbXoiLCJtYWMiOiJlMTYyY2NiMjNkZWVjNGQ0N2JiYjZmYmRkNzE5NmM1YTdjMzg2YTFhNzI2NWY1OTk1MTE5YTQzOTIzOWY2YTMzIiwidGFnIjoiIn0%3D; expires=Thu, 09-Nov-2023 12:54:57 GMT; Max-Age=7200; path=/; samesite=lax
spi_web_reporting_session=eyJpdiI6IldHQ2pUQi81aExJMWtvNTdBNG9oTFE9PSIsInZhbHVlIjoidzFLY3pobHphOEsvbzFjZHFGbjBXRkZQek13QkdFTFRpTktZQ2tYOW5CVnhsQU5SSzBsTmlPbDNhMmtVaXFSNSsrMTZIbWkvSzJ1N2YyUEltWDcvUHU3MUZKcUdnRDdrVzRoM0Qxb3ZqL3B6cXZJVis2K09OZllIVDRIeDFZeUIiLCJtYWMiOiI3OTZkMWZmMjVjM2ZiZjRkYWYzMDA2ZjhjMWIwOGU2YzdjMDU0YjA4MGM4YjY2Njk5YWI4Njg5ZmM5ODhjN2MxIiwidGFnIjoiIn0%3D; expires=Thu, 09-Nov-2023 12:54:57 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Content-Length: 490
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
103.119.142.252:8001/reporting2/public/index.php/login
200 OK 5.5 kB URL User Request GET HTTP/1.1 103.119.142.252:8001/reporting2/public/index.php/login
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text
Hash c45812ba4aa3d48d1e0709553b45a2e2
cd1541cf222e0abc4c778e163ca7f78421167b5a
ba6a7549887a0220a8dc2ceb5d899250df71644433cd860db2948162df8bad4c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/index.php/login HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjMrSkVtMzEwN0FkOEZ1aWhLQUJFR1E9PSIsInZhbHVlIjoiZE5VYkdpWkpJcm5jcVlQMlFsZTcxZ3J3TXRhSVlhajh0NHVUd3huWUNBTUZhQ0tLZndvajd2NUlYU0NQbjNDTE5OR2Z1SUZXS244RGdvRzV3YlR5SWFZNXMxaDNUY1Z3QkVNRU5XTUNtQjJ5eEdPc29sRDBERHVvVlQ5U3ZSbXoiLCJtYWMiOiJlMTYyY2NiMjNkZWVjNGQ0N2JiYjZmYmRkNzE5NmM1YTdjMzg2YTFhNzI2NWY1OTk1MTE5YTQzOTIzOWY2YTMzIiwidGFnIjoiIn0%3D; spi_web_reporting_session=eyJpdiI6IldHQ2pUQi81aExJMWtvNTdBNG9oTFE9PSIsInZhbHVlIjoidzFLY3pobHphOEsvbzFjZHFGbjBXRkZQek13QkdFTFRpTktZQ2tYOW5CVnhsQU5SSzBsTmlPbDNhMmtVaXFSNSsrMTZIbWkvSzJ1N2YyUEltWDcvUHU3MUZKcUdnRDdrVzRoM0Qxb3ZqL3B6cXZJVis2K09OZllIVDRIeDFZeUIiLCJtYWMiOiI3OTZkMWZmMjVjM2ZiZjRkYWYzMDA2ZjhjMWIwOGU2YzdjMDU0YjA4MGM4YjY2Njk5YWI4Njg5ZmM5ODhjN2MxIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2023 10:54:57 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
X-Powered-By: PHP/7.3.28
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6IjhrZllXeUNUQVUrTFUwbTN0NjlyM3c9PSIsInZhbHVlIjoid3VBR3M0bFZCbVltSFJIeWR4RXFGU1dFbVVqdlhNVWZKRWZ6Uk90NDg1bXQ1SGsrOFMwWHNzS2E2T1BUNXByUU1kVXNLdm53N0pxSEtlUFRLT0dKSUo3UGpoV25OTi9zNTBMUGpuczcrWWhoQSsyYjhSOE1PeTlqaXFaVGhoOHIiLCJtYWMiOiJmMWY3NDkxYjU2ZDYyNDJlMjYwODA2OWU1OTYzNzg2YzIyMzhiYTAxYjc0MDgyYWQ4MWY2YjM5YmYyNzQ4ZWNlIiwidGFnIjoiIn0%3D; expires=Thu, 09-Nov-2023 12:54:57 GMT; Max-Age=7200; path=/; samesite=lax
spi_web_reporting_session=eyJpdiI6Imh4dXNIODVocHgvQndmQlkxRTZ0bGc9PSIsInZhbHVlIjoiUHJibE9tN3RoOFRkTElSdTZrWkZYemttNEwrLzV3MHdMN0N4bG1CZ0djUDNXS3dsVVJCT0UvSkJweWdzMkZRU2xGOGtLREprUFR4UGZEQUk3eXlOSkR5U0svcjdHeEVXTWFDdmNabHhxSFNjeThsZ25lY1BSS0c5V09hM3d4eXciLCJtYWMiOiI5ZTFkNmE3OGQ1ODJmN2EzY2ZlY2Y0NTI2ODE4YzlmMDUyNjEwMzBmOTE1NzRkNTZjZTNlM2Q3MGVhYjI2Y2I1IiwidGFnIjoiIn0%3D; expires=Thu, 09-Nov-2023 12:54:57 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Content-Length: 5481
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
fonts.googleapis.com/css?family=Nunito
200 OK 994 B URL GET HTTP/2 fonts.googleapis.com/css?family=Nunito
IP
Requested by http://103.119.142.252:8001/reporting2/public/index.php/login
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintFA:D7:68:E4:12:7D:FE:22:87:DE:95:F1:1E:49:5A:49:FA:12:1E:B9
ValidityMon, 16 Oct 2023 08:10:01 GMT - Mon, 08 Jan 2024 08:10:00 GMT
File type gzip compressed data, max compression\012- data
Hash 1edb0b1d488d4ea37c06d17625e8e5d1
8535bf47c25f4ad063aceda48910160041abfddd
7d86b46342c20542bc3934eea8d57c3df42efd28db440c9e7e351a376a11eefa
GET /css?family=Nunito HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://103.119.142.252:8001/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 09 Nov 2023 10:54:59 GMT
date: Thu, 09 Nov 2023 10:54:59 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
103.119.142.252:8001/reporting2/public/css/app.css
200 OK 372 kB URL GET HTTP/1.1 103.119.142.252:8001/reporting2/public/css/app.css
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
Requested by http://103.119.142.252:8001/reporting2/public/index.php/login
File type ASCII text, with very long lines (64911)
Size 372 kB (372119 bytes)
Hash c2664d4da23b761042de9585a68241ac
d51fc95b9b4f49cf1c48ee1f6c8fd3d5d8baa9aa
b69a27d6e9237b6c0cff94422b80870db7c434d4db4f15fb4cd67733a21edee7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/css/app.css HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://103.119.142.252:8001/reporting2/public/index.php/login
Cookie: XSRF-TOKEN=eyJpdiI6IjhrZllXeUNUQVUrTFUwbTN0NjlyM3c9PSIsInZhbHVlIjoid3VBR3M0bFZCbVltSFJIeWR4RXFGU1dFbVVqdlhNVWZKRWZ6Uk90NDg1bXQ1SGsrOFMwWHNzS2E2T1BUNXByUU1kVXNLdm53N0pxSEtlUFRLT0dKSUo3UGpoV25OTi9zNTBMUGpuczcrWWhoQSsyYjhSOE1PeTlqaXFaVGhoOHIiLCJtYWMiOiJmMWY3NDkxYjU2ZDYyNDJlMjYwODA2OWU1OTYzNzg2YzIyMzhiYTAxYjc0MDgyYWQ4MWY2YjM5YmYyNzQ4ZWNlIiwidGFnIjoiIn0%3D; spi_web_reporting_session=eyJpdiI6Imh4dXNIODVocHgvQndmQlkxRTZ0bGc9PSIsInZhbHVlIjoiUHJibE9tN3RoOFRkTElSdTZrWkZYemttNEwrLzV3MHdMN0N4bG1CZ0djUDNXS3dsVVJCT0UvSkJweWdzMkZRU2xGOGtLREprUFR4UGZEQUk3eXlOSkR5U0svcjdHeEVXTWFDdmNabHhxSFNjeThsZ25lY1BSS0c5V09hM3d4eXciLCJtYWMiOiI5ZTFkNmE3OGQ1ODJmN2EzY2ZlY2Y0NTI2ODE4YzlmMDUyNjEwMzBmOTE1NzRkNTZjZTNlM2Q3MGVhYjI2Y2I1IiwidGFnIjoiIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2023 10:54:58 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
Last-Modified: Fri, 11 Aug 2023 07:47:41 GMT
ETag: "5ad97-602a0ed6cba49"
Accept-Ranges: bytes
Content-Length: 372119
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
103.119.142.252:8001/reporting2/public/js/app.js
200 OK 1.4 MB URL GET HTTP/1.1 103.119.142.252:8001/reporting2/public/js/app.js
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
Requested by http://103.119.142.252:8001/reporting2/public/index.php/login
File type ASCII text, with very long lines (65475)
Size 1.4 MB (1429740 bytes)
Hash df8078d19f29126ca99e12adc45c183f
491128c4751cbc55a2058338085a042d91e503f4
b70cc6b9aceceac3d4d12664996aab96a18e48f07bcae221542e441f7d77cc49
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/js/app.js HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://103.119.142.252:8001/reporting2/public/index.php/login
Cookie: XSRF-TOKEN=eyJpdiI6IjhrZllXeUNUQVUrTFUwbTN0NjlyM3c9PSIsInZhbHVlIjoid3VBR3M0bFZCbVltSFJIeWR4RXFGU1dFbVVqdlhNVWZKRWZ6Uk90NDg1bXQ1SGsrOFMwWHNzS2E2T1BUNXByUU1kVXNLdm53N0pxSEtlUFRLT0dKSUo3UGpoV25OTi9zNTBMUGpuczcrWWhoQSsyYjhSOE1PeTlqaXFaVGhoOHIiLCJtYWMiOiJmMWY3NDkxYjU2ZDYyNDJlMjYwODA2OWU1OTYzNzg2YzIyMzhiYTAxYjc0MDgyYWQ4MWY2YjM5YmYyNzQ4ZWNlIiwidGFnIjoiIn0%3D; spi_web_reporting_session=eyJpdiI6Imh4dXNIODVocHgvQndmQlkxRTZ0bGc9PSIsInZhbHVlIjoiUHJibE9tN3RoOFRkTElSdTZrWkZYemttNEwrLzV3MHdMN0N4bG1CZ0djUDNXS3dsVVJCT0UvSkJweWdzMkZRU2xGOGtLREprUFR4UGZEQUk3eXlOSkR5U0svcjdHeEVXTWFDdmNabHhxSFNjeThsZ25lY1BSS0c5V09hM3d4eXciLCJtYWMiOiI5ZTFkNmE3OGQ1ODJmN2EzY2ZlY2Y0NTI2ODE4YzlmMDUyNjEwMzBmOTE1NzRkNTZjZTNlM2Q3MGVhYjI2Y2I1IiwidGFnIjoiIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2023 10:54:58 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
Last-Modified: Thu, 24 Aug 2023 14:17:41 GMT
ETag: "15d0ec-603abe4161a5e"
Accept-Ranges: bytes
Content-Length: 1429740
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
103.119.142.252:8001/reporting2/public/logo.png
200 OK 2.2 kB URL GET HTTP/1.1 103.119.142.252:8001/reporting2/public/logo.png
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
Requested by http://103.119.142.252:8001/reporting2/public/index.php/login
File type PNG image data, 206 x 42, 8-bit/color RGB, non-interlaced\012- data
Hash 612a9d0f0bb08abf500ba61500ce0bed
db32a6f2d54e2fc52cd7fe7058c2af63c382724f
9b8ab3c9b14b1cb18bd9b8c6a48b5b2737974fdeec2eae375187dbb1863a97f2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/logo.png HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://103.119.142.252:8001/reporting2/public/index.php/login
Cookie: XSRF-TOKEN=eyJpdiI6IjhrZllXeUNUQVUrTFUwbTN0NjlyM3c9PSIsInZhbHVlIjoid3VBR3M0bFZCbVltSFJIeWR4RXFGU1dFbVVqdlhNVWZKRWZ6Uk90NDg1bXQ1SGsrOFMwWHNzS2E2T1BUNXByUU1kVXNLdm53N0pxSEtlUFRLT0dKSUo3UGpoV25OTi9zNTBMUGpuczcrWWhoQSsyYjhSOE1PeTlqaXFaVGhoOHIiLCJtYWMiOiJmMWY3NDkxYjU2ZDYyNDJlMjYwODA2OWU1OTYzNzg2YzIyMzhiYTAxYjc0MDgyYWQ4MWY2YjM5YmYyNzQ4ZWNlIiwidGFnIjoiIn0%3D; spi_web_reporting_session=eyJpdiI6Imh4dXNIODVocHgvQndmQlkxRTZ0bGc9PSIsInZhbHVlIjoiUHJibE9tN3RoOFRkTElSdTZrWkZYemttNEwrLzV3MHdMN0N4bG1CZ0djUDNXS3dsVVJCT0UvSkJweWdzMkZRU2xGOGtLREprUFR4UGZEQUk3eXlOSkR5U0svcjdHeEVXTWFDdmNabHhxSFNjeThsZ25lY1BSS0c5V09hM3d4eXciLCJtYWMiOiI5ZTFkNmE3OGQ1ODJmN2EzY2ZlY2Y0NTI2ODE4YzlmMDUyNjEwMzBmOTE1NzRkNTZjZTNlM2Q3MGVhYjI2Y2I1IiwidGFnIjoiIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2023 10:54:59 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
Last-Modified: Wed, 06 Oct 2021 03:51:52 GMT
ETag: "8ab-5cda711000600"
Accept-Ranges: bytes
Content-Length: 2219
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
103.119.142.252:8001/reporting2/public/fonts/fa-solid-900.woff2?691d32a32aa44fee6d6bc452e09727b0
200 OK 79 kB URL GET HTTP/1.1 103.119.142.252:8001/reporting2/public/fonts/fa-solid-900.woff2?691d32a32aa44fee6d6bc452e09727b0
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
Requested by http://103.119.142.252:8001/reporting2/public/index.php/login
File type Web Open Font Format (Version 2), TrueType, length 79212, version 1.0\012- data
Hash 8086e197694282b26c7b729945ecc377
58990abc3958c68e01a50f00bceb50fb3987fb72
3135d8dcdc19a876e23e693a53d9fc3ad45bb0b9ba4abb34e118e54bdec71c6b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/fonts/fa-solid-900.woff2?691d32a32aa44fee6d6bc452e09727b0 HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://103.119.142.252:8001/reporting2/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6IjhrZllXeUNUQVUrTFUwbTN0NjlyM3c9PSIsInZhbHVlIjoid3VBR3M0bFZCbVltSFJIeWR4RXFGU1dFbVVqdlhNVWZKRWZ6Uk90NDg1bXQ1SGsrOFMwWHNzS2E2T1BUNXByUU1kVXNLdm53N0pxSEtlUFRLT0dKSUo3UGpoV25OTi9zNTBMUGpuczcrWWhoQSsyYjhSOE1PeTlqaXFaVGhoOHIiLCJtYWMiOiJmMWY3NDkxYjU2ZDYyNDJlMjYwODA2OWU1OTYzNzg2YzIyMzhiYTAxYjc0MDgyYWQ4MWY2YjM5YmYyNzQ4ZWNlIiwidGFnIjoiIn0%3D; spi_web_reporting_session=eyJpdiI6Imh4dXNIODVocHgvQndmQlkxRTZ0bGc9PSIsInZhbHVlIjoiUHJibE9tN3RoOFRkTElSdTZrWkZYemttNEwrLzV3MHdMN0N4bG1CZ0djUDNXS3dsVVJCT0UvSkJweWdzMkZRU2xGOGtLREprUFR4UGZEQUk3eXlOSkR5U0svcjdHeEVXTWFDdmNabHhxSFNjeThsZ25lY1BSS0c5V09hM3d4eXciLCJtYWMiOiI5ZTFkNmE3OGQ1ODJmN2EzY2ZlY2Y0NTI2ODE4YzlmMDUyNjEwMzBmOTE1NzRkNTZjZTNlM2Q3MGVhYjI2Y2I1IiwidGFnIjoiIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2023 10:54:59 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
Last-Modified: Wed, 06 Oct 2021 08:08:00 GMT
ETag: "1356c-5cdaaa5011800"
Accept-Ranges: bytes
Content-Length: 79212
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: font/woff2
103.119.142.252:8001/reporting2/public/favicon.png
200 OK 529 B URL GET HTTP/1.1 103.119.142.252:8001/reporting2/public/favicon.png
IP
ASN #136119 PT Bali Towerindo Sentra, Tbk
Requested by http://103.119.142.252:8001/reporting2/public/index.php/login
File type PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced\012- data
Hash 5a2d33153b5f93c156805ad9e77e0d27
813ca71c6edca45e666c31769719b471dc8ac35d
e78f494aa0deccb2d8d57323fcf5a1b1c992fa051e5473071f5b6954ff98805e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /reporting2/public/favicon.png HTTP/1.1
Host: 103.119.142.252:8001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://103.119.142.252:8001/reporting2/public/index.php/login
Cookie: XSRF-TOKEN=eyJpdiI6IjhrZllXeUNUQVUrTFUwbTN0NjlyM3c9PSIsInZhbHVlIjoid3VBR3M0bFZCbVltSFJIeWR4RXFGU1dFbVVqdlhNVWZKRWZ6Uk90NDg1bXQ1SGsrOFMwWHNzS2E2T1BUNXByUU1kVXNLdm53N0pxSEtlUFRLT0dKSUo3UGpoV25OTi9zNTBMUGpuczcrWWhoQSsyYjhSOE1PeTlqaXFaVGhoOHIiLCJtYWMiOiJmMWY3NDkxYjU2ZDYyNDJlMjYwODA2OWU1OTYzNzg2YzIyMzhiYTAxYjc0MDgyYWQ4MWY2YjM5YmYyNzQ4ZWNlIiwidGFnIjoiIn0%3D; spi_web_reporting_session=eyJpdiI6Imh4dXNIODVocHgvQndmQlkxRTZ0bGc9PSIsInZhbHVlIjoiUHJibE9tN3RoOFRkTElSdTZrWkZYemttNEwrLzV3MHdMN0N4bG1CZ0djUDNXS3dsVVJCT0UvSkJweWdzMkZRU2xGOGtLREprUFR4UGZEQUk3eXlOSkR5U0svcjdHeEVXTWFDdmNabHhxSFNjeThsZ25lY1BSS0c5V09hM3d4eXciLCJtYWMiOiI5ZTFkNmE3OGQ1ODJmN2EzY2ZlY2Y0NTI2ODE4YzlmMDUyNjEwMzBmOTE1NzRkNTZjZTNlM2Q3MGVhYjI2Y2I1IiwidGFnIjoiIn0%3D
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2023 10:55:00 GMT
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
Last-Modified: Mon, 18 Oct 2021 09:11:06 GMT
ETag: "211-5ce9cecc35e80"
Accept-Ranges: bytes
Content-Length: 529
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/png
103.119.142.252
142.250.74.106