Report - ziwmvbra.000webhostapp.com/pansoft.html

Report Overview

Visited public
2023-12-05 10:09:15
Tags
zimbra phishing
URL
ziwmvbra.000webhostapp.com/pansoft.html
Finishing URL
ziwmvbra.000webhostapp.com/pansoft.html
IP / ASN
145.14.145.187
#204915 Hostinger International Limited
Title
Zimbra Web Client Sign In
Phishing - Zimbra Web Client

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
webmail.pansoft.de	unknown	unknown	No data	No data	1.5 kB	65 kB	37.24.150.171
ziwmvbra.000webhostapp.com	unknown	2016-05-11	2023-12-05 11:07:45	2023-12-05 11:07:45	507 B	14 kB	145.14.145.187

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-05 10:09:03	low	Client IP	Internal IP	ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
2023-12-05 10:09:03	low	Client IP	Internal IP	ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	unknown	EventHandler	9 B	2023-04-11	2025-05-09
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-04-11 04:37 Last Seen2025-05-09 13:55 Times Seen2458 Hash 8330d67045d053b17fa969ef2bdb5e54 041174325b27a7b4d2d1b1a0e353fa82d1cb6431 ceecf99c8bd1f6e5f89a26d3b40e009d48860d674231297254ff75d817b9a883 Loading...

	ziwmvbra.000webhostapp.com/pansoft.html	ScriptElement	207 B	2023-04-18	2025-05-06
Pretty URL ziwmvbra.000webhostapp.com/pansoft.html IP 145.14.145.187 ASN #204915 Hostinger International Limited Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-18 02:03 Last Seen2025-05-06 14:20 Times Seen155 Hash 700e887e90c4dd4028b8dc075599ebab a21a02ee24d2126e077886f8dfee7e8c2332467a ef77018d199c2b7456cd2cffc70518b1d320c96a0300180aa2a6da9dddfc06d7 Loading...

	ziwmvbra.000webhostapp.com/pansoft.html	ScriptElement	6.7 kB	2023-12-05	2024-09-28
Pretty URL ziwmvbra.000webhostapp.com/pansoft.html IP 145.14.145.187 ASN #204915 Hostinger International Limited Introduced by scriptElement Embedded in HTML true Observations First Seen2023-12-05 11:09 Last Seen2024-09-28 08:23 Times Seen4 Hash 0064312cdb18bd63de6b199c7452c309 d7b98f1ebe88e0f89b337bbcd3b1c2f772f2ded3 c816d30eaf67ef3cf3d8f134c0a7b3f01f35a17d5d5072aa35a4ad366c2e566f Loading...

		Size	First Seen	Last Seen
	#1 Write - 3050ae2abb1cd3f35953b5103fa3954a	136 B	2023-03-07 01:34	2025-05-06 14:20
Pretty Observations First Seen2023-03-07 01:34 Last Seen2025-05-06 14:20 Times Seen468 Hash 3050ae2abb1cd3f35953b5103fa3954a 1ed99d798e4fccce033962261830aa361a8e0c74 5f5bd55e3dc0ffc7f8c75f07f64be080f6513b37ab2628d0420f3668a9899412 Loading...

HTTP Transactions (4)

URL IP Response Size

webmail.pansoft.de/zimbra/skins/_base/logos/LoginBanner_white.png?v=200812070414

37.24.150.171

200 OK

3.3 kB

URL GET HTTP/2
webmail.pansoft.de/zimbra/skins/_base/logos/LoginBanner_white.png?v=200812070414
IP
37.24.150.171:443
ASN
#3209 Vodafone GmbH

Requested by
https://ziwmvbra.000webhostapp.com/pansoft.html
Certificate
IssuerSectigo Limited
Subject*.pansoft.de
Fingerprint1D:A0:80:F3:74:3E:4B:B9:66:74:CF:9E:39:16:F1:91:6F:62:7B:4C
ValidityThu, 19 Jan 2023 00:00:00 GMT - Mon, 19 Feb 2024 23:59:59 GMT

File type
PNG image data, 163 x 36, 8-bit/color RGBA, non-interlaced\012- data
Size
3.3 kB (3299 bytes)
Hash
e04d149f1a5dec8a4b31e20e1f1413fb
44e9355e76474683c0f9ebd8c8150fffd30f9e9b
8db258b55ceabeb5c9c8bf41f59a2743c579cfcee58c34cacc945ad9c01d6ef1

HTTP Headers

GET /zimbra/skins/_base/logos/LoginBanner_white.png?v=200812070414 HTTP/1.1
Host: webmail.pansoft.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://webmail.pansoft.de/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=200812070414
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 05 Dec 2023 10:07:23 GMT
content-type: image/png
content-length: 3299
x-frame-options: SAMEORIGIN
expires: Thu, 4 Jan 2024 11:08:58 GMT
cache-control: public, max-age=2595600
last-modified: Tue, 28 Feb 2017 20:13:10 GMT
accept-ranges: bytes
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

webmail.pansoft.de/zimbra/img/logo/favicon.ico

37.24.150.171

200 OK

1.2 kB

URL GET HTTP/2
webmail.pansoft.de/zimbra/img/logo/favicon.ico
IP
37.24.150.171:443
ASN
#3209 Vodafone GmbH

Requested by
https://ziwmvbra.000webhostapp.com/pansoft.html
Certificate
IssuerSectigo Limited
Subject*.pansoft.de
Fingerprint1D:A0:80:F3:74:3E:4B:B9:66:74:CF:9E:39:16:F1:91:6F:62:7B:4C
ValidityThu, 19 Jan 2023 00:00:00 GMT - Mon, 19 Feb 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size
1.2 kB (1150 bytes)
Hash
8c7d1c14e4b9c42f07bd6b800d93b806
87e49826ffb3bc1ddac38feebb6bb98eaef568b2
1afd891aacc433e75265e3ddc9cb4fc63b88259977811384426c535037711637

HTTP Headers

GET /zimbra/img/logo/favicon.ico HTTP/1.1
Host: webmail.pansoft.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziwmvbra.000webhostapp.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 05 Dec 2023 10:07:23 GMT
content-type: image/x-icon
content-length: 1150
x-frame-options: SAMEORIGIN
expires: Thu, 4 Jan 2024 11:08:58 GMT
cache-control: public, max-age=2595600
last-modified: Tue, 28 Feb 2017 20:13:10 GMT
accept-ranges: bytes
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

ziwmvbra.000webhostapp.com/pansoft.html

145.14.145.187

200 OK

14 kB

URL User Request GET HTTP/2
ziwmvbra.000webhostapp.com/pansoft.html
IP
145.14.145.187:443
ASN
#204915 Hostinger International Limited

Certificate
IssuerDigiCert Inc
Subject*.000webhostapp.com
FingerprintB0:57:03:97:AE:15:06:79:FC:86:0E:E2:79:B6:B0:9D:37:04:A5:49
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sat, 10 Aug 2024 23:59:59 GMT

File type

Size
14 kB (13532 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Zimbra Web Client

HTTP Headers

GET /pansoft.html HTTP/1.1
Host: ziwmvbra.000webhostapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 05 Dec 2023 10:08:57 GMT
content-type: text/html; charset=UTF-8
server: awex
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-request-id: 01e0023418250424d4f22ed804e808e1
content-encoding: gzip
X-Firefox-Spdy: h2

webmail.pansoft.de/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=200812070414

37.24.150.171

200 OK

60 kB

URL GET HTTP/2
webmail.pansoft.de/zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=200812070414
IP
37.24.150.171:443
ASN
#3209 Vodafone GmbH

Requested by
https://ziwmvbra.000webhostapp.com/pansoft.html
Certificate
IssuerSectigo Limited
Subject*.pansoft.de
Fingerprint1D:A0:80:F3:74:3E:4B:B9:66:74:CF:9E:39:16:F1:91:6F:62:7B:4C
ValidityThu, 19 Jan 2023 00:00:00 GMT - Mon, 19 Feb 2024 23:59:59 GMT

File type
ASCII text, with very long lines (751)
Size
60 kB (59560 bytes)
Hash
7ca150871c003b4e3545ee7ed6b21a0c
aee8f47467a9c806004bdd717654efa31d96f232
471cec1143885b3fe7ba6144da7fb991f0fdfc3404ef1cb8dcf3a6d254465449

HTTP Headers

GET /zimbra/css/common,login,zhtml,skin.css?skin=harmony&v=200812070414 HTTP/1.1
Host: webmail.pansoft.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziwmvbra.000webhostapp.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 05 Dec 2023 10:07:22 GMT
content-type: text/css
x-frame-options: SAMEORIGIN
expires: Thu, 4 Jan 2024 11:08:58 GMT
cache-control: public, max-age=2595600
vary: User-Agent, Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (4)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers