301 Moved Permanently 0 B URL User Request GET HTTP/1.1 IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET / HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
X-Powered-By: PHP/7.0.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
Location: http://5.189.176.81/auth/login.html
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
5.189.176.81/auth/login.html
200 OK 7.3 kB URL User Request GET HTTP/1.1 5.189.176.81/auth/login.html
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (312), with CRLF, LF line terminators
Hash 38c88e583bac7e0a085b2d0fd2d6a36e
951f423ba625ff4c2eb1d69daea5afac29036fb2
e99eaf07afca744792e34c9e30dc74d3f42129adea65ac81ed17d2ce8b8bb447
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /auth/login.html HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
X-Powered-By: PHP/7.0.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
iresponse_session=c5db3p3fd2qf7bimtf085j6ci6; expires=Fri, 05-Jan-2024 15:08:41 GMT; Max-Age=2592000; path=/; domain=5.189.176.81; HttpOnly
Content-Length: 7291
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8
ajax.googleapis.com/ajax/libs/webfont/1.6.16/webfont.js
200 OK 5.5 kB URL GET HTTP/2 ajax.googleapis.com/ajax/libs/webfont/1.6.16/webfont.js
IP
Requested by http://5.189.176.81/auth/login.html
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (2220)
Hash 316f3557abf074f917ff1f83d776338d
8fdfb015a94c6ee5a4276e2577665a27ccc8c1f3
a28396880470a28e0525bdc0ea326ffb811de7de13662d02f7530dbbe3f12d90
GET /ajax/libs/webfont/1.6.16/webfont.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 5480
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 05 Dec 2023 00:48:12 GMT
expires: Wed, 04 Dec 2024 00:48:12 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 138029
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
5.189.176.81/plugins/font-awesome/css/font-awesome.min.css
200 OK 27 kB URL GET HTTP/1.1 5.189.176.81/plugins/font-awesome/css/font-awesome.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (26548)
Hash b0707c5cda60f769cfced7da684c0b83
a7b572fcadb21659a9f726e9fae70a808d052940
38594d7df2cb3a627ab8bc60bc8462d949a5b73d0b457202d0459a019db8401d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "6857-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 26711
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/bootstrap-toastr/toastr.min.css
200 OK 5.6 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-toastr/toastr.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (5619)
Hash 81889fa4c4664daa4f3f4ae924806bc3
d8830b2401c0210c510d336de57c66df8b3d10af
e0616ca2f0de8a5261acbb6c0a16c9bed36a3a8934cb1b53473cec7171063d2d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-toastr/toastr.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "15f4-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 5620
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/simple-line-icons/simple-line-icons.min.css
200 OK 9.6 kB URL GET HTTP/1.1 5.189.176.81/plugins/simple-line-icons/simple-line-icons.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (9503), with CRLF line terminators
Hash 6c977c35fbba185349bc72e0330a4046
befa20ea6b4311e2905f42b6c6550acbb9bb2a20
846e092e98b6069a43cd865bbd76d29535441bdb8fb27cef322d69bea1ac8367
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/simple-line-icons/simple-line-icons.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "255a-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 9562
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/bootstrap-switch/css/bootstrap-switch.min.css
200 OK 6.5 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-switch/css/bootstrap-switch.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (5487)
Hash 3afd78c0db1fad3e544071dd006a8aad
2af4576315ea9c582fc16064e072577be38efb73
44d5e78058468311e175771d0e4572672c2809d02adeaf3563d8e577beaa3b29
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-switch/css/bootstrap-switch.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "1939-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 6457
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/bootstrap-select/css/bootstrap-select.min.css
200 OK 6.7 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-select/css/bootstrap-select.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (6432)
Hash 869322f14ef11735cbc3023614357cf1
f61310024845e8591da64936a791744d211e1a57
e2fd0c5c00a4aee4808ca0338d2c132f06fb3bd3ed1269097e704ef24cef32d6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-select/css/bootstrap-select.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "19fa-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 6650
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/widearea/widearea.css
200 OK 7.7 kB URL GET HTTP/1.1 5.189.176.81/plugins/widearea/widearea.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (1672)
Hash 25a1753fd4592c9d18322065a745e1e9
33e7cbef2b7468a7f7a818ee2c31a2e303fc2010
d1ffe510a4c7540baec36b61c2b5b48f47b142db748f7e1b436cb1438fc744a8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/widearea/widearea.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "1e39-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 7737
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/bootstrap-sweetalert/sweetalert.css
200 OK 14 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-sweetalert/sweetalert.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with CRLF line terminators
Hash 672dac9e51793035dee3e7dabfea125a
9bacb9c2449118aea6630fdb3fd5b4491c015140
c66d639147a4b35d2ba1144c9c9201dabd1c420bbbf628c664fbf6296a0c4772
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-sweetalert/sweetalert.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "35ab-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 13739
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/styles/pages/login.min.css
200 OK 2.6 kB URL GET HTTP/1.1 5.189.176.81/styles/pages/login.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (2619), with no line terminators
Hash 2875b52545cac0751b4d6d00af3a168e
81f56cc16d7a816537e5bad2f717331b1db1abde
7526f5b49661fc139846ff12b3fff82ac70ff9e1018914bf0032f47ebb021172
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /styles/pages/login.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "a3b-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 2619
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/styles/custom.min.css
200 OK 6.2 kB URL GET HTTP/1.1 5.189.176.81/styles/custom.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (6192), with no line terminators
Hash 2c9669ae3776f23d30a20fdfe296c67e
739ad277d3545ce0d7b9476e446858e7f9f8dbe5
ec49aadc5cc5cdcc9452b0d217ffd43971f95f74824024c83793b96617a28223
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /styles/custom.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "1830-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 6192
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/fontawesome5/css/all.min.css
200 OK 171 kB URL GET HTTP/1.1 5.189.176.81/plugins/fontawesome5/css/all.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (65393)
Size 171 kB (170570 bytes)
Hash 81b2e00ad71a15f478a9def1e55ca743
b71f51da0c3fce0b6052a2b40909938b4e01fcab
a34e129ed3df3b2296abf74f041f034510a11a31b3243803164b86ffe83855d7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/fontawesome5/css/all.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "29a4a-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 170570
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/styles/plugins.min.css
200 OK 43 kB URL GET HTTP/1.1 5.189.176.81/styles/plugins.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type Unicode text, UTF-8 text, with very long lines (42756), with no line terminators
Hash 7e831b5751ee5354323fbdf5f8f8578e
29dfd0fa0fe0fd11d08246a8db8a61afab8fed06
b0dc4acfc842b0d7a8b3c08f3c27e33e5ae3a1418fc587ebe9690ae83d0d0f2a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /styles/plugins.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "a715-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 42773
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/js.cookie.min.js
200 OK 1.7 kB URL GET HTTP/1.1 5.189.176.81/plugins/js.cookie.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (1572)
Hash 51e87c6871523b63a469e88b244f0429
c3a95779bcddbb0eff1aafece75a53295b01124e
7d97491a3d294629a353bacd88442498b5f4609aef01afbed6277da906b8ed7f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/js.cookie.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "6ca-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 1738
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/jquery-slimscroll/jquery.slimscroll.min.js
200 OK 5.2 kB URL GET HTTP/1.1 5.189.176.81/plugins/jquery-slimscroll/jquery.slimscroll.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (4889)
Hash a83ca7a332677203800b1d9b7d22eac0
b0d21f603aee7a1460bcbe559b1e5d010c38941e
6e13ca9248b431e3be16a43100185e8e3a3311001154d73c30ddbcce1a4d5d94
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/jquery-slimscroll/jquery.slimscroll.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "1437-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 5175
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/jquery.min.js
200 OK 96 kB URL GET HTTP/1.1 5.189.176.81/plugins/jquery.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (32038), with CRLF line terminators
Hash 13c0a5055cca7b2463b2f73701960b9e
e6082a7b52db82604ac446d2e6a32cb5af263781
20e11ce61890c08c0529911822233c9023ebc367df6c1050dec105e2b9628104
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/jquery.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "176da-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 95962
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/jquery.blockui.min.js
200 OK 9.6 kB URL GET HTTP/1.1 5.189.176.81/plugins/jquery.blockui.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (9162), with CRLF line terminators
Hash f35b3230007335b610a67fe27e9c19b5
4d1ff795d8ce96081c46af237b983b02f2b4536d
1562ef5e592b67d9a95a9a3f7c2a05442a7e0f7b492dd0a56e43fea9acefe627
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/jquery.blockui.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "2561-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 9569
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/bootstrap-switch/js/bootstrap-switch.min.js
200 OK 15 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-switch/js/bootstrap-switch.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (13933)
Hash 12ce5d59f687e3c2a8d8395aee0c89b3
7e0725897d7b99c3c33b56915d202e2dde552ea9
b009172f00c548007f4b4f4908e591be7a0e9e11980eef55a8c9db08a0213332
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-switch/js/bootstrap-switch.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "3a37-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 14903
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/bootstrap/css/bootstrap.min.css
200 OK 119 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap/css/bootstrap.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (65371)
Size 119 kB (119248 bytes)
Hash 559be2a2240c136c319c9f44be66ddb4
f60859a7c4640c937f0a28e432ab1f41f8fcbb63
f774b9adb50e02b5e7347ecbe06db1df3e45eccd55769270d8b45865a080b26f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap/css/bootstrap.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "1d1d0-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 119248
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/bootstrap-sweetalert/sweetalert.min.js
200 OK 17 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-sweetalert/sweetalert.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (16651), with no line terminators
Hash 0e2613ca4d17a624d7e9928acd07a7c6
b28faec55f0534a1b07a4be5aeb7bdd73418c395
262ad846a6dffaacdfa95b441381844f21e501b882a42d34e720536b8ae3eb18
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-sweetalert/sweetalert.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "410b-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 16651
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/bootstrap/js/bootstrap.min.js
200 OK 37 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap/js/bootstrap.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (32034)
Hash 4becdc9104623e891fbb9d38bba01be4
6c264e0e0026ab5ece49350c6a8812398e696cbb
4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap/js/bootstrap.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "8fd0-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 36816
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/styles/components.min.css
200 OK 642 kB URL GET HTTP/1.1 5.189.176.81/styles/components.min.css
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (65536), with no line terminators
Size 642 kB (642462 bytes)
Hash 923923d1b27f446c10bff05b2730f2bd
713ff8ff877a930b28541c4f395ece568ea419ba
3c855b7de73cbcb0a7ee386556504d6885580d685f4d3467c6d28a72e7167738
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /styles/components.min.css HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:41 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "9cd9e-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 642462
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:41 GMT
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/css
5.189.176.81/plugins/bootstrap-toastr/toastr.min.js
200 OK 3.7 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-toastr/toastr.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (3695)
Hash ff17c837de44098153252a099c6f2179
590ef1bc6046a31847f913edcae17a9c28705541
b222c4d78e15f658da273327db335518a053b824e20bc16423922597d30ca4d2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-toastr/toastr.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "e70-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 3696
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/bootstrap-select/js/bootstrap-select.min.js
200 OK 33 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-select/js/bootstrap-select.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (31980)
Hash f7f690bbf905342027b167e459b8e742
8b6b9c94e68b141f51019a08bb10caca558110da
d705b3a9f50c89af172e18fe083ae91c99709b86b40376bec900ad18d1b6c71a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-select/js/bootstrap-select.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "8187-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 33159
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/bootstrap-tabdrop/js/bootstrap-tabdrop.js
200 OK 3.3 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-tabdrop/js/bootstrap-tabdrop.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with CRLF line terminators
Hash b6479b169d07a2d84f022ee8914e92ab
ad315a7f1885057956f2b48337cd2af945423121
fadfca2bb957da198a0f11e77156f9473845ca1e2b8bb0d89fecc71ab5e608fc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-tabdrop/js/bootstrap-tabdrop.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "cd3-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 3283
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/bootstrap-hover-dropdown/bootstrap-hover-dropdown.min.js
200 OK 1.5 kB URL GET HTTP/1.1 5.189.176.81/plugins/bootstrap-hover-dropdown/bootstrap-hover-dropdown.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (1187)
Hash 37de75434657af5bfe94cf3f4450c80b
e59cc56383c3b79a91c23c9f6e8ac0389bfad115
412cf28cec5787f5a120e337814a31068e1f02df08d0ae323134eb7f75a34a26
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/bootstrap-hover-dropdown/bootstrap-hover-dropdown.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "603-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 1539
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/jquery-inputmask/jquery.inputmask.bundle.min.js
200 OK 76 kB URL GET HTTP/1.1 5.189.176.81/plugins/jquery-inputmask/jquery.inputmask.bundle.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (32016)
Hash af65c661edb28db1752a59725b0dcee6
2cfcaed5836efb1d0c85c93ae0769a2f9c44f30b
7fae7063ec1d5382cd082e6e07fa65aeefafbd7db59abf0b87a54584cf4e1ed6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/jquery-inputmask/jquery.inputmask.bundle.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "127db-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 75739
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/widearea/widearea.js
200 OK 9.5 kB URL GET HTTP/1.1 5.189.176.81/plugins/widearea/widearea.js
IP
Requested by http://5.189.176.81/auth/login.html
Hash dc5599e086d5bf00f95a12e37ee0f26a
02da567b8a306d119a5fa8defa6ea707e15bf9da
5e629e7b6f35204eb3550dd0ff46be585bb282372c818d53be91d84b4a5787d4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/widearea/widearea.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "24f7-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 9463
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/plugins/moment.min.js
200 OK 130 kB URL GET HTTP/1.1 5.189.176.81/plugins/moment.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type Algol 68 source text\012- Pascal source, ASCII text
Size 130 kB (130198 bytes)
Hash bf12445c472f3309011a1d80c93d25ad
ef15332c47f9126059f389e61e84c62536776143
720b4817c779f94c3e5f5785186a2789852f74160da6ff2956140f2266b030b8
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/moment.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "1fc96-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 130198
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
5.189.176.81/scripts/global/datatable.min.js
200 OK 4.7 kB URL GET HTTP/1.1 5.189.176.81/scripts/global/datatable.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (4661), with no line terminators
Hash 8b6f95a4b0b8a592bc3c46fe271b129b
e00e35947bfc77d6a6fa5a78624400d6af3ac4d7
bcee611e988b573b91a746de5171731291a888ca70acf1880cc3646de917a53c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /scripts/global/datatable.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "1235-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 4661
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/javascript
fonts.googleapis.com/css?family=Poppins:300,400,500,600,700%7CRoboto:300,400,500,600,700
200 OK 940 B URL GET HTTP/1.1 fonts.googleapis.com/css?family=Poppins:300,400,500,600,700%7CRoboto:300,400,500,600,700
IP
Requested by http://5.189.176.81/auth/login.html
Hash d6116500f13420a2ffa5800ffb896881
4f52ac922d461a1d4e6b832df1216e0b3d0a318e
1b239c5a9de6421a180c9d58609bdcae32500ca2d661bd71e5708fbb004557f8
GET /css?family=Poppins:300,400,500,600,700%7CRoboto:300,400,500,600,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Wed, 06 Dec 2023 15:08:42 GMT
Date: Wed, 06 Dec 2023 15:08:42 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
5.189.176.81/images/logos/iresponse-black.png
200 OK 167 kB URL GET HTTP/1.1 5.189.176.81/images/logos/iresponse-black.png
IP
Requested by http://5.189.176.81/auth/login.html
File type PNG image data, 5301 x 1319, 8-bit/color RGBA, non-interlaced\012- data
Size 167 kB (166574 bytes)
Hash e8e9bd2d2a248fe64104bbb449934ae1
61ec81be6a76942e9f6f610d67a90ac4c70d2a4b
2853682ef328ba0bb82dcd050c271f655142e7879719aab15b246e0af80bd340
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/logos/iresponse-black.png HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "28aae-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 166574
Cache-Control: max-age=31536000
Expires: Thu, 05 Dec 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/png
fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
200 OK 7.8 kB URL GET HTTP/1.1 fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 7840, version 1.0\012- data
Hash 8d91ec1ca2d8b56640a47117e313a3e9
a9e9bafe64666f4595051a0e895b47a5fa39e67e
78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb
GET /s/poppins/v20/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7840
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 04 Dec 2023 21:18:59 GMT
Expires: Tue, 03 Dec 2024 21:18:59 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 27 Apr 2022 16:51:55 GMT
Content-Type: font/woff2
Age: 150583
fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
200 OK 7.9 kB URL GET HTTP/1.1 fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 7884, version 1.0\012- data
Hash 9212f6f9860f9fc6c69b02fedf6db8c3
ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
GET /s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7884
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 04 Dec 2023 20:34:33 GMT
Expires: Tue, 03 Dec 2024 20:34:33 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 27 Apr 2022 17:03:52 GMT
Content-Type: font/woff2
Age: 153249
fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
200 OK 7.7 kB URL GET HTTP/1.1 fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 7748, version 1.0\012- data
Hash a09f2fccfee35b7247b08a1a266f0328
0da2d17e738f46d2a09e6fb7969da451719a9820
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
GET /s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7748
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 05 Dec 2023 21:28:36 GMT
Expires: Wed, 04 Dec 2024 21:28:36 GMT
Cache-Control: public, max-age=31536000
Age: 63606
Last-Modified: Wed, 27 Apr 2022 16:21:30 GMT
Content-Type: font/woff2
fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
200 OK 8.0 kB URL GET HTTP/1.1 fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 8000, version 1.0\012- data
Hash 72993dddf88a63e8f226656f7de88e57
179f97ec0275f09603a8db94d4380eb584d81cd5
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
GET /s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 8000
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 04 Dec 2023 19:52:03 GMT
Expires: Tue, 03 Dec 2024 19:52:03 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 27 Apr 2022 16:59:07 GMT
Content-Type: font/woff2
Age: 155799
fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
200 OK 7.8 kB URL GET HTTP/1.1 fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 7816, version 1.0\012- data
Hash 25b0e113ca7cce3770d542736db26368
cb726212d5d525021752a1d8470a0fb593e0c49e
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
GET /s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 7816
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 30 Nov 2023 05:25:34 GMT
Expires: Fri, 29 Nov 2024 05:25:34 GMT
Cache-Control: public, max-age=31536000
Age: 553388
Last-Modified: Wed, 27 Apr 2022 16:11:40 GMT
Content-Type: font/woff2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
200 OK 16 kB URL GET HTTP/1.1 fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Hash 15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15744
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 05 Dec 2023 15:01:32 GMT
Expires: Wed, 04 Dec 2024 15:01:32 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 11 May 2022 19:24:48 GMT
Content-Type: font/woff2
Age: 86830
5.189.176.81/scripts/global/iresponse.min.js
200 OK 29 kB URL GET HTTP/1.1 5.189.176.81/scripts/global/iresponse.min.js
IP
Requested by http://5.189.176.81/auth/login.html
File type ASCII text, with very long lines (28714), with CRLF line terminators
Hash f45784538fa9df6bdf2135d9dfc0bcaa
09a177cc984adceb523d92a8e63fbe309ea344c8
5d8c665eeb5a21b1432418ca72621a21f8296f58d448e94ddfa45cc7669b4b7d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /scripts/global/iresponse.min.js HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "70cf-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 28879
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: application/javascript
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
200 OK 16 kB URL GET HTTP/1.1 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Hash e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15860
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 05 Dec 2023 19:20:03 GMT
Expires: Wed, 04 Dec 2024 19:20:03 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 11 May 2022 19:24:42 GMT
Content-Type: font/woff2
Age: 71319
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
200 OK 16 kB URL GET HTTP/1.1 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 15740, version 1.0\012- data
Hash b9c29351c46f3e8c8631c4002457f48a
e57e59c5780995ff2937ab2b511a769212974a87
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15740
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 05 Dec 2023 02:10:22 GMT
Expires: Wed, 04 Dec 2024 02:10:22 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 11 May 2022 19:24:56 GMT
Content-Type: font/woff2
Age: 133100
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
200 OK 16 kB URL GET HTTP/1.1 fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 15920, version 1.0\012- data
Hash 3a44e06eb954b96aa043227f3534189d
23cef6993ddb2b2979e8e7647fc3763694e2ba7d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://5.189.176.81
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 15920
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 29 Nov 2023 21:50:21 GMT
Expires: Thu, 28 Nov 2024 21:50:21 GMT
Cache-Control: public, max-age=31536000
Age: 580701
Last-Modified: Wed, 11 May 2022 19:24:45 GMT
Content-Type: font/woff2
5.189.176.81/images/logos/iresponse_icon.ico
200 OK 37 kB URL GET HTTP/1.1 5.189.176.81/images/logos/iresponse_icon.ico
IP
Requested by http://5.189.176.81/auth/login.html
File type MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel\012- data
Hash 5fc2ba87deb690a1d385536ac4959faa
1ee17d3a0157eb6aaa92d796383bd4d561869cb0
fbf80f287aab831c4a8c14103b3afa97eef5aa9875b5c07d525d417cc5fb7677
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/logos/iresponse_icon.ico HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/auth/login.html
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:36 GMT
ETag: "9117-5ad3f5e0cdf00"
Accept-Ranges: bytes
Content-Length: 37143
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: image/vnd.microsoft.icon
5.189.176.81/plugins/fontawesome5/webfonts/fa-solid-900.woff2
200 OK 138 kB URL GET HTTP/1.1 5.189.176.81/plugins/fontawesome5/webfonts/fa-solid-900.woff2
IP
Requested by http://5.189.176.81/auth/login.html
File type Web Open Font Format (Version 2), TrueType, length 137704, version 330.-16253\012- data
Size 138 kB (137704 bytes)
Hash e245d7d62db89a9912e17b02bc23e256
48d7c4e403b41453d2df167450e7bcb8cfe4f7cb
68eb827a2fa6f035eab41392f863522ae5dc0d4c0c31d5245362a7f1a5aed46a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /plugins/fontawesome5/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: 5.189.176.81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://5.189.176.81/plugins/fontawesome5/css/all.min.css
Cookie: iresponse_session=c5db3p3fd2qf7bimtf085j6ci6
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 06 Dec 2023 15:08:42 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33
Last-Modified: Wed, 19 Aug 2020 18:42:38 GMT
ETag: "219e8-5ad3f5e2b6380"
Accept-Ranges: bytes
Content-Length: 137704
Cache-Control: max-age=2592000
Expires: Fri, 05 Jan 2024 15:08:42 GMT
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
5.189.176.81
142.250.74.106