Report - 49.50.160.125:8080/js/gw.txt

Report Overview

Visited public
2025-01-20 11:26:27
Tags
URL
49.50.160.125:8080/js/gw.txt
Finishing URL
49.50.160.125:8080/js/gw.txt
IP / ASN
49.50.160.125
#135354 NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.
Title
49.50.160.125:8080/js/gw.txt

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
49.50.160.125	unknown	unknown	No data	No data	754 B	24 kB	49.50.160.125

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-20 11:26:13	medium	49.50.160.125	Client IP	ET HUNTING Powershell Downloader with Start-Process Inbound M1

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-01-20	medium	49.50.160.125	Sinkholed
2025-01-20	medium	49.50.160.125	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

49.50.160.125:8080/js/gw.txt

49.50.160.125

200

1.5 kB

URL User Request GET HTTP/1.1
49.50.160.125:8080/js/gw.txt
IP
49.50.160.125:8080
ASN
#135354 NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.

File type
ASCII text, with CRLF line terminators
Size
1.5 kB (1515 bytes)
Hash
9b5164186ac7a7e6a8f497cdf3e725ec
32dd738c3daf4a7eab643d27b93319d95ed74600
f3e909b08a10cf26c1a7f9102c9405b5ed82225b6e203ae62a68e151ff9bdcf7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /js/gw.txt HTTP/1.1
Host: 49.50.160.125:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Accept-Ranges: bytes
ETag: W/"1515-1737332488289"
Last-Modified: Mon, 20 Jan 2025 00:21:28 GMT
Content-Type: text/plain
Content-Length: 1515
Date: Mon, 20 Jan 2025 11:26:03 GMT
Keep-Alive: timeout=20
Connection: keep-alive

49.50.160.125:8080/favicon.ico

49.50.160.125

200

22 kB

URL GET HTTP/1.1
49.50.160.125:8080/favicon.ico
IP
49.50.160.125:8080
ASN
#135354 NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.

Requested by
http://49.50.160.125:8080/js/gw.txt

File type
MS Windows icon resource - 9 icons, 16x16, 16 colors, 16x16
Size
22 kB (21630 bytes)
Hash
4644f2d45601037b8423d45e13194c93
dcfdc7b05cb629f3b91a7267c7f304306f461724
64a3170a912786e9eece7e347b58f36471cb9d0bc790697b216c61050e6b1f08

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 49.50.160.125:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://49.50.160.125:8080/js/gw.txt
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 
Accept-Ranges: bytes
ETag: W/"21630-1704158497073"
Last-Modified: Tue, 02 Jan 2024 01:21:37 GMT
Content-Type: image/x-icon
Content-Length: 21630
Date: Mon, 20 Jan 2025 11:26:03 GMT
Keep-Alive: timeout=20
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers