Overview

URLwearedevs.nethttps:///Assets/Download/Gravity-Switch.exe
IP185.176.40.113
ASNUnknown
Location Unknown
Report completed2017-01-11 23:14:19 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; ar; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18
Referer
Pool
Access Levelpublic


Intrusion Detection Systems

Snort /w Sourcefire VRT No alerts detected
Suricata /w Emerging Threats Pro No alerts detected


Blacklists

Fortinet's Web Filter / fortiguard.com
Added / Verified Severity Host Comment
2017-01-112wearedevs.net/Assets/Download/Gravity-Switch.exeMalware
MDL / malwaredomainlist.com No alerts detected
DNS-BH / malwaredomains.com No alerts detected
mnemonic secure DNS / mnemonic.no No alerts detected
OpenPhish / openphish.com No alerts detected
PhishTank / phishtank.com No alerts detected
Spamhaus DBL / spamhaus.org No alerts detected


Files Captured



Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 185.176.40.113

Date UQ / IDS / BL URL IP
2017-01-14 10:38:430 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 08:12:380 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 02:33:510 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 01:28:020 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 00:56:350 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-13 09:33:550 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113

Last 6 reports on ASN: Unknown

Date UQ / IDS / BL URL IP
2017-01-22 23:17:240 - 0 - 0l.facebook.comhttps:///l.php?u=https%3A%2F%2Fwww.centraltexasfoodbank.org%2Fsites%2Fdefault%2Ff (...)157.240.11.35
2017-01-22 23:17:090 - 0 - 1dlc.applycertain.ru/download/12/YXZgYGY6cG1uayYyMWtHVVtBU0FNTklKRwVDXUtdUUVXW0FGXhlMVkoUWFxKXh8 (...)34.248.229.126
2017-01-22 23:12:470 - 0 - 25criminallawfirm.mobi/Lesley/estateportfolio/adobes/9f9c3cde4b9494be39e1b622543e4d7f/index2.htm107.154.105.196
2017-01-22 23:11:220 - 0 - 1lamaisondeloiselier.com/adobe/adobe.htm185.140.47.101
2017-01-22 23:09:390 - 0 - 0www.netimpact.orghttps:///sites/default/files/webform/TV-Live-show-Packers-v-s-Falcons-st-r.ea- (...)161.47.5.177
2017-01-22 23:09:170 - 0 - 0www.netimpact.orghttps:///sites/default/files/webform/TV-Live-show-Packers-v-s-Falcons-st-r.ea- (...)161.47.5.177

Last 6 reports on domain: wearedevs.net

Date UQ / IDS / BL URL IP
2017-01-14 10:38:430 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 08:12:380 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 02:33:510 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 01:28:020 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-14 00:56:350 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113
2017-01-13 09:33:550 - 0 - 1wearedevs.nethttps:///Assets/Download/Gravity-Switch.exe185.176.40.113



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (2)


Request Response
POST / HTTP/1.1

Host: gp.symcd.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ar; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request
 23.43.139.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Server: nginx/1.10.2
Content-Length: 1415
Content-Transfer-Encoding: binary
Cache-Control: max-age=516387, public, no-transform, must-revalidate
Last-Modified: Tue, 10 Jan 2017 21:40:03 GMT
Expires: Tue, 17 Jan 2017 21:40:03 GMT
Date: Wed, 11 Jan 2017 22:13:36 GMT
Connection: keep-alive
GET /Assets/Download/Gravity-Switch.exe HTTP/1.1

Host: wearedevs.net

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ar; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 185.176.40.113
HTTP/1.1 200 OK
Content-Type: application/x-msdos-program
Date: Wed, 11 Jan 2017 22:13:36 GMT
Server: Apache
Last-Modified: Mon, 26 Dec 2016 20:57:48 GMT
Etag: "18167d50-af400-54495fcfe64f8"
Accept-Ranges: bytes
Content-Length: 717824
Keep-Alive: timeout=4, max=170
Connection: Keep-Alive