Report - w3025v.webwave.dev/

Report Overview

Submitted URL

w3025v.webwave.dev/
IP

185.30.124.158

ASN

#20853 eTOP sp. z o.o.
Submitted

2023-11-20T21:17:14Z

Access

public
Website Title

Aol mail
Final URL

w3025v.webwave.dev/
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

7
Threat Detection Systems

15

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
w3025v.webwave.dev (5)	unknown	2022-12-27 22:57:13	2023-10-21 23:03:36	2589	339687	185.73.228.142

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup
2023-11-20T21:16:58Z	low	Client IP	Internal IP	ET INFO Free Website Builder Domain (webwave .dev) in DNS Lookup

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-14	medium	w3025v.webwave.dev/	AOL Inc.
2023-11-14	medium	w3025v.webwave.dev/	AOL Inc.
2023-11-14	medium	w3025v.webwave.dev/	AOL Inc.
2023-11-14	medium	w3025v.webwave.dev/	AOL Inc.
2023-11-14	medium	w3025v.webwave.dev/	AOL Inc.

PhishTank

Scan Date	Severity	Indicator	Alert
2022-12-27	medium	w3025v.webwave.dev/	Other
2022-12-27	medium	w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-2c90ec1d1522815b8cdc826cc432a7ab.css	Other
2022-12-27	medium	w3025v.webwave.dev/files/assets/webpack/unavailableWebsite.bundle-2f22d4474e9d73f617c76f262fb4d2ed.css	Other
2022-12-27	medium	w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-61613eab8d09c352f1a083bbfe0adda4.js	Other
2022-12-27	medium	w3025v.webwave.dev/favicon.ico	Other

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-20	medium	webwave.dev	Sinkholed
2023-11-20	medium	webwave.dev	Sinkholed
2023-11-20	medium	webwave.dev	Sinkholed
2023-11-20	medium	webwave.dev	Sinkholed
2023-11-20	medium	webwave.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

Pretty

URL

w3025v.webwave.dev/
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Introduced by

scriptElement
Inline HTML

true

Observations

First Seen2023-03-07 01:01:59

Last Seen2023-12-08 17:12:37

Times Seen32477101
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Pretty

URL

w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-61613eab8d09c352f1a083bbfe0adda4.js
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Introduced by

scriptElement
Inline HTML

false

Observations

First Seen2023-11-16 19:13:35

Last Seen2023-11-21 06:48:03

Times Seen64
Hash

71b06fd6ab000f54b243355a9292712b

6b7e28b715df8da14f0827aeba7b753c7a8d40d1

baaeb36cf0ca03620d0b1b7bf307c7836975aecc6643be14d6c4dc6be691df7f

HTTP Transactions (5)

URL IP Response Size

w3025v.webwave.dev/

185.73.228.142

200 OK

2217

URL User Request GET HTTP/2

w3025v.webwave.dev/
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Certificate

IssuerLet's Encrypt

Subjectwebwave.dev

Fingerprint4D:F6:FF:A1:FD:67:1A:76:E7:44:89:6A:0B:55:10:3F:EF:A9:F2:C3

ValiditySat, 11 Nov 2023 01:27:10 GMT - Fri, 09 Feb 2024 01:27:09 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3018)

Size

2217
Hash

b37a46efe8ee5021cedcb5bc34f3353c

8e0b5a84ef50eae56f76b6365169ab5bda25d3ae

3bd705d091c16e3c2790ddd640e0232f48a51dc6610517e1924484774d414cf5

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

                                        GET / HTTP/1.1
Host: w3025v.webwave.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Mon, 20 Nov 2023 06:51:37 GMT
server: Apache/2.4.58 (Unix) OpenSSL/3.0.11
content-security-policy: frame-ancestors 'self' webwavecms.com webwave.me ro.webwave.me webwave.ro webwave.com.au szablony.webwavecms.com templates.webwave.me templates.webwave.com.au sabloane.webwave.ro ;
x-application-context: application:production
content-type: text/html;charset=utf-8
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
cacheable: true
x-varnish: 25754170 21223529
age: 51918
via: 1.1 varnish (Varnish/6.1)
set-cookie: cache-with-varnish=true
accept-ranges: bytes
content-length: 2217
X-Firefox-Spdy: h2

w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-2c90ec1d1522815b8cdc826cc432a7ab.css

185.73.228.142

200 OK

1379

URL GET HTTP/2

w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-2c90ec1d1522815b8cdc826cc432a7ab.css
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Requested by

https://w3025v.webwave.dev/
Certificate

IssuerLet's Encrypt

Subjectwebwave.dev

Fingerprint4D:F6:FF:A1:FD:67:1A:76:E7:44:89:6A:0B:55:10:3F:EF:A9:F2:C3

ValiditySat, 11 Nov 2023 01:27:10 GMT - Fri, 09 Feb 2024 01:27:09 GMT

Magic

ASCII text, with very long lines (4382), with no line terminators

Size

1379
Hash

e6deb197fa9397809811aa9a353f85f8

2ef87634a4ea353287bd361ae749cc4858eaef20

9fa62835b73c062897249d634ac4457312b9ca2fd754a14f836d3dd30a1e8572

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

                                        GET /files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-2c90ec1d1522815b8cdc826cc432a7ab.css HTTP/1.1
Host: w3025v.webwave.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://w3025v.webwave.dev/
Cookie: cache-with-varnish=true
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
date: Mon, 20 Nov 2023 21:16:56 GMT
server: Apache/2.4.58 (Unix) OpenSSL/3.0.11
content-security-policy: frame-ancestors 'self' webwavecms.com webwave.me ro.webwave.me webwave.ro webwave.com.au szablony.webwavecms.com templates.webwave.me templates.webwave.com.au sabloane.webwave.ro ;
last-modified: Fri, 17 Nov 2023 17:37:35 GMT
etag: "111e-60a5c977bb5c0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
content-length: 1379
content-type: text/css
X-Firefox-Spdy: h2

w3025v.webwave.dev/files/assets/webpack/unavailableWebsite.bundle-2f22d4474e9d73f617c76f262fb4d2ed.css

185.73.228.142

200 OK

53653

URL GET HTTP/2

w3025v.webwave.dev/files/assets/webpack/unavailableWebsite.bundle-2f22d4474e9d73f617c76f262fb4d2ed.css
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Requested by

https://w3025v.webwave.dev/
Certificate

IssuerLet's Encrypt

Subjectwebwave.dev

Fingerprint4D:F6:FF:A1:FD:67:1A:76:E7:44:89:6A:0B:55:10:3F:EF:A9:F2:C3

ValiditySat, 11 Nov 2023 01:27:10 GMT - Fri, 09 Feb 2024 01:27:09 GMT

Magic

ASCII text, with very long lines (33295)

Size

53653
Hash

2f22d4474e9d73f617c76f262fb4d2ed

cf0aef61bf83a099beb5aac7a2a1227dc9743141

edc3c5847eb3782082ad588926cef363177719817e1630ee062d320daaddbc43

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

                                        GET /files/assets/webpack/unavailableWebsite.bundle-2f22d4474e9d73f617c76f262fb4d2ed.css HTTP/1.1
Host: w3025v.webwave.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://w3025v.webwave.dev/
Cookie: cache-with-varnish=true
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
date: Mon, 20 Nov 2023 21:16:56 GMT
server: Apache/2.4.58 (Unix) OpenSSL/3.0.11
content-security-policy: frame-ancestors 'self' webwavecms.com webwave.me ro.webwave.me webwave.ro webwave.com.au szablony.webwavecms.com templates.webwave.me templates.webwave.com.au sabloane.webwave.ro ;
last-modified: Fri, 17 Nov 2023 17:38:45 GMT
etag: "8ebdb-60a5c9baa5db4-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
content-length: 53653
content-type: text/css
X-Firefox-Spdy: h2

w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-61613eab8d09c352f1a083bbfe0adda4.js

185.73.228.142

200 OK

274674

URL GET HTTP/2

w3025v.webwave.dev/files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-61613eab8d09c352f1a083bbfe0adda4.js
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Requested by

https://w3025v.webwave.dev/
Certificate

IssuerLet's Encrypt

Subjectwebwave.dev

Fingerprint4D:F6:FF:A1:FD:67:1A:76:E7:44:89:6A:0B:55:10:3F:EF:A9:F2:C3

ValiditySat, 11 Nov 2023 01:27:10 GMT - Fri, 09 Feb 2024 01:27:09 GMT

Magic

ASCII text, with very long lines (682)

Size

274674
Hash

71b06fd6ab000f54b243355a9292712b

6b7e28b715df8da14f0827aeba7b753c7a8d40d1

baaeb36cf0ca03620d0b1b7bf307c7836975aecc6643be14d6c4dc6be691df7f

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

                                        GET /files/staticContent/5.57.1/websitesResources/unavailableWebsiteModule-61613eab8d09c352f1a083bbfe0adda4.js HTTP/1.1
Host: w3025v.webwave.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://w3025v.webwave.dev/
Cookie: cache-with-varnish=true
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Mon, 20 Nov 2023 21:16:56 GMT
server: Apache/2.4.58 (Unix) OpenSSL/3.0.11
content-security-policy: frame-ancestors 'self' webwavecms.com webwave.me ro.webwave.me webwave.ro webwave.com.au szablony.webwavecms.com templates.webwave.me templates.webwave.com.au sabloane.webwave.ro ;
last-modified: Fri, 17 Nov 2023 17:38:35 GMT
etag: "430f2-60a5c9b0f3cc0-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
content-type: application/javascript
X-Firefox-Spdy: h2

w3025v.webwave.dev/favicon.ico

185.73.228.142

200 OK

4683

URL GET HTTP/2

w3025v.webwave.dev/favicon.ico
IP

185.73.228.142:443
ASN

#20853 eTOP sp. z o.o.

Requested by

https://w3025v.webwave.dev/
Certificate

IssuerLet's Encrypt

Subjectwebwave.dev

Fingerprint4D:F6:FF:A1:FD:67:1A:76:E7:44:89:6A:0B:55:10:3F:EF:A9:F2:C3

ValiditySat, 11 Nov 2023 01:27:10 GMT - Fri, 09 Feb 2024 01:27:09 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (5015), with no line terminators

Size

4683
Hash

b8698182066468bb5335d8494d878fa6

07be09727ffb970ef9dd10f5614904ce4772152c

2a71e6b8fc413aeedd3ba3a0cf3d52ce900e644f868c9fc11d5cc33f0f8d7b79

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	AOL Inc.
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: w3025v.webwave.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://w3025v.webwave.dev/
Cookie: cache-with-varnish=true
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Mon, 20 Nov 2023 21:16:57 GMT
server: Apache/2.4.58 (Unix) OpenSSL/3.0.11
content-security-policy: frame-ancestors 'self' webwavecms.com webwave.me ro.webwave.me webwave.ro webwave.com.au szablony.webwavecms.com templates.webwave.me templates.webwave.com.au sabloane.webwave.ro ;
x-application-context: application:production
content-type: text/html;charset=utf-8
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
cacheable: true
x-varnish: 18757611
age: 0
via: 1.1 varnish (Varnish/6.1)
set-cookie: cache-with-varnish=true
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

#1 JS:Script (size: 0)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#2 JS:Script (size: 274674)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/2

IP

ASN

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size