Report - 0ffs3c.com/qm/login.php

Report Overview

Submitted URL
0ffs3c.com/qm/login.php
IP
72.167.56.109
ASN
#398101 GO-DADDY-COM-LLC
Submitted
2024-04-24 23:08:33
Access
public
Website Title
RAPTOR
Final URL
www.0ffs3c.com/qm/login.php
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
0ffs3c.com	unknown	unknown	2015-07-09	2023-02-20	393 B	452 B	72.167.56.109
www.0ffs3c.com	unknown	unknown	2015-11-10	2023-02-20	1.5 kB	20 kB	72.167.56.109

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	0ffs3c.com	Sinkholed
2024-04-24	medium	0ffs3c.com	Sinkholed
2024-04-24	medium	0ffs3c.com	Sinkholed
2024-04-24	medium	0ffs3c.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (4)

URL IP Response Size

0ffs3c.com/qm/login.php

72.167.56.109

219 B

URL
0ffs3c.com/qm/login.php
IP
72.167.56.109:0
ASN
#398101 GO-DADDY-COM-LLC

File type
HTML document, ASCII text
Size
219 B (219 bytes)
Hash
3e02a1bfb0abb83192f774729baee129
96d202d95428b3af44a67e9e9bc084500ae2e698
58a1494e13adc2684b99111735a740d3c886ad66dab8c1495ced1fc629ba258c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /qm/login.php HTTP/1.1
Host: 0ffs3c.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Wed, 24 Apr 2024 23:08:08 GMT
Server: Apache
Location: https://www.0ffs3c.com/qm/login.php
Content-Length: 219
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

www.0ffs3c.com/qm/login.php

72.167.56.109

200 OK

690 B

URL User Request GET HTTP/2
www.0ffs3c.com/qm/login.php
IP
72.167.56.109:443
ASN
#398101 GO-DADDY-COM-LLC

Certificate
IssuerZeroSSL
Subject0ffs3c.com
FingerprintF3:19:45:F4:03:C0:FA:D7:08:53:64:F9:53:E9:08:9B:A2:8E:D3:FA
ValidityMon, 20 Feb 2023 00:00:00 GMT - Sun, 21 May 2023 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
690 B (690 bytes)
Hash
eab6e4831a2695597fee8de663ee6154
59d8d91c37e380a47451dd61c6c64c1c2284752b
0eab354108b488db4b50ce2b676f73286fe52eb785cf6edfa130b23994cc04e0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /qm/login.php HTTP/1.1
Host: www.0ffs3c.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-powered-by: PHP/8.1.27
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=t76f4g65abe2311edfhf55i1bt; path=/
vary: Accept-Encoding
content-encoding: br
content-length: 690
content-type: text/html; charset=UTF-8
date: Wed, 24 Apr 2024 23:08:10 GMT
server: Apache
X-Firefox-Spdy: h2

www.0ffs3c.com/qm/css/theme.css

72.167.56.109

200 OK

18 kB

URL GET HTTP/2
www.0ffs3c.com/qm/css/theme.css
IP
72.167.56.109:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://www.0ffs3c.com/qm/login.php
Certificate
IssuerZeroSSL
Subject0ffs3c.com
FingerprintF3:19:45:F4:03:C0:FA:D7:08:53:64:F9:53:E9:08:9B:A2:8E:D3:FA
ValidityMon, 20 Feb 2023 00:00:00 GMT - Sun, 21 May 2023 23:59:59 GMT

File type
ASCII text, with very long lines (6132)
Size
18 kB (17771 bytes)
Hash
0328d1d32642756d2a34e99e82a55d8e
b1decd5d5ec89586471bac84375c88661ef42f35
a790436a3bffbf90c463e17b1c285d596f658d72cbf83dd2cc618b523c2b6420

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /qm/css/theme.css HTTP/1.1
Host: www.0ffs3c.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.0ffs3c.com/qm/login.php
Cookie: PHPSESSID=t76f4g65abe2311edfhf55i1bt
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 13 May 2022 04:40:10 GMT
etag: "53204bb-1ce07-5dedd44fb1e80-br"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 17771
content-type: text/css
date: Wed, 24 Apr 2024 23:08:10 GMT
server: Apache
X-Firefox-Spdy: h2

www.0ffs3c.com/favicon.ico

72.167.56.109

404 Not Found

703 B

URL GET HTTP/2
www.0ffs3c.com/favicon.ico
IP
72.167.56.109:443
ASN
#398101 GO-DADDY-COM-LLC

Requested by
https://www.0ffs3c.com/qm/login.php
Certificate
IssuerZeroSSL
Subject0ffs3c.com
FingerprintF3:19:45:F4:03:C0:FA:D7:08:53:64:F9:53:E9:08:9B:A2:8E:D3:FA
ValidityMon, 20 Feb 2023 00:00:00 GMT - Sun, 21 May 2023 23:59:59 GMT

File type
HTML document, ASCII text
Size
703 B (703 bytes)
Hash
12bc9fcd7f59bd4a0c74e0477ccbad55
9c866d208d2bc04fdc136dbc1fef2e889beb9cbf
cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.0ffs3c.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.0ffs3c.com/qm/login.php
Cookie: PHPSESSID=t76f4g65abe2311edfhf55i1bt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-length: 703
content-type: text/html
date: Wed, 24 Apr 2024 23:08:10 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (4)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers