Overview

URLtibok.lflink.com/tibok.exe
IP52.56.48.231
ASNUnknown
Location United States
Report completed2017-01-12 12:03:39 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1; .NET CLR 3.0.04506; .NET CLR 3.5.21022)
Referer
Pool
Access Levelpublic


Intrusion Detection Systems

Snort /w Sourcefire VRT No alerts detected
Suricata /w Emerging Threats Pro No alerts detected


Blacklists

Fortinet's Web Filter / fortiguard.com
Added / Verified Severity Host Comment
2017-01-122tibok.lflink.com/tibok.exeMalware
MDL / malwaredomainlist.com No alerts detected
DNS-BH / malwaredomains.com No alerts detected
mnemonic secure DNS / mnemonic.no No alerts detected
OpenPhish / openphish.com No alerts detected
PhishTank / phishtank.com No alerts detected
Spamhaus DBL / spamhaus.org No alerts detected


Files Captured



Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 52.56.48.231

Date UQ / IDS / BL URL IP
2017-01-19 20:56:031 - 0 - 1zagruz.dnset.com/MSCN.exe52.56.48.231
2017-01-19 20:49:011 - 0 - 1zagruz.dnset.com/debtm.exe52.56.48.231
2017-01-17 11:14:071 - 0 - 1updatelog.qpoe.com/Cdfsc.exe52.56.48.231
2017-01-17 07:07:291 - 0 - 1dusers.4pu.com/raauser.exe52.56.48.231
2017-01-16 03:59:211 - 0 - 1updatelog.qpoe.com/updpars.exe52.56.48.231
2017-01-12 13:03:091 - 0 - 1tibok.lflink.com/tibok.exe52.56.48.231

Last 6 reports on ASN: Unknown

Date UQ / IDS / BL URL IP
2017-01-22 23:12:470 - 0 - 25criminallawfirm.mobi/Lesley/estateportfolio/adobes/9f9c3cde4b9494be39e1b622543e4d7f/index2.htm107.154.105.196
2017-01-22 23:11:220 - 0 - 1lamaisondeloiselier.com/adobe/adobe.htm185.140.47.101
2017-01-22 23:09:390 - 0 - 0www.netimpact.orghttps:///sites/default/files/webform/TV-Live-show-Packers-v-s-Falcons-st-r.ea- (...)161.47.5.177
2017-01-22 23:09:170 - 0 - 0www.netimpact.orghttps:///sites/default/files/webform/TV-Live-show-Packers-v-s-Falcons-st-r.ea- (...)161.47.5.177
2017-01-22 23:08:130 - 0 - 4load2.sharebox1.ru/194.58.56.214
2017-01-22 23:07:450 - 0 - 2etsselat-ae-vrfffy-accct-blls-chaeck-up-777-ayez.co.nf/185.176.43.54

Last 1 reports on domain: tibok.lflink.com

Date UQ / IDS / BL URL IP
2017-01-12 13:03:091 - 0 - 1tibok.lflink.com/tibok.exe52.56.48.231



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
GET /tibok.exe HTTP/1.1

Host: tibok.lflink.com

User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1; .NET CLR 3.0.04506; .NET CLR 3.5.21022)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 52.56.48.231
HTTP/1.1 200 Ok
Content-Type: application/octet-stream
Content-Length: 117705
Last-Modified: Mon, 26 Dec 2016 17:00:28 GMT
Connection: Keep-Alive
Server: SHS