Overview

URLtibok.lflink.com/tibok.exe
IP52.56.48.231
ASNUnknown
Location United States
Report completed2017-01-12 12:03:39 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1; .NET CLR 3.0.04506; .NET CLR 3.5.21022)
Referer
Pool
Access Levelpublic


Intrusion Detection Systems

Snort /w Sourcefire VRT No alerts detected
Suricata /w Emerging Threats Pro No alerts detected


Blacklists

Fortinet's Web Filter / fortiguard.com
Added / Verified Severity Host Comment
2017-01-122tibok.lflink.com/tibok.exeMalware
MDL / malwaredomainlist.com No alerts detected
DNS-BH / malwaredomains.com No alerts detected
mnemonic secure DNS / mnemonic.no No alerts detected
OpenPhish / openphish.com No alerts detected
PhishTank / phishtank.com No alerts detected
Spamhaus DBL / spamhaus.org No alerts detected


Files Captured



Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 52.56.48.231

Date UQ / IDS / BL URL IP
2017-02-08 02:10:331 - 0 - 1updatelog.qpoe.com/debt.exe52.56.48.231
2017-02-05 03:38:001 - 0 - 1updatelog.qpoe.com/updparsm.exe52.56.48.231
2017-02-05 02:00:331 - 0 - 1updatelog.qpoe.com/debrbodm.exe52.56.48.231
2017-02-01 23:04:461 - 0 - 1brauser.toh.info/amsql.exe52.56.48.231
2017-01-30 10:24:541 - 0 - 1brauser.toh.info/amsql.exe52.56.48.231
2017-01-28 14:51:561 - 0 - 1dusers.4pu.com/amsql.exe52.56.48.231

Last 6 reports on ASN: Unknown

Date UQ / IDS / BL URL IP
2017-02-21 08:45:010 - 0 - 0emailadvertentie.net/ZSEKCLX8YwOkrOGh/unsubscribe81.171.24.156
2017-02-21 08:44:400 - 0 - 1upgradelive.upgradepcsafesystemset4now.info/?pcl=7a--wJTk8omhhyZLHpMQk1JNg4t-9ge0N3KpBxTxVkI.51.15.145.148
2017-02-21 08:42:060 - 0 - 1stats.devmaxcloud.com/apps.gif?action=update52.216.0.202
2017-02-21 08:41:020 - 0 - 0www.facebook.comhttps:///Fifty-Shades-Darker-Online-2017-Movie-405373773148064/157.240.2.35
2017-02-21 08:41:020 - 0 - 0www.facebook.comhttps:///Fifty-Shades-Darker-Online-2017-Movie-405373773148064/157.240.2.35
2017-02-21 08:40:020 - 0 - 0newsindustryde.com/login/link.php?M=61716&N=84&L=22&F=H138.68.53.233

Last 1 reports on domain: tibok.lflink.com

Date UQ / IDS / BL URL IP
2017-01-12 13:03:091 - 0 - 1tibok.lflink.com/tibok.exe52.56.48.231



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
GET /tibok.exe HTTP/1.1

Host: tibok.lflink.com

User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1; .NET CLR 3.0.04506; .NET CLR 3.5.21022)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 52.56.48.231
HTTP/1.1 200 Ok
Content-Type: application/octet-stream
Content-Length: 117705
Last-Modified: Mon, 26 Dec 2016 17:00:28 GMT
Connection: Keep-Alive
Server: SHS