Report - 119.245.203.67/.WeTransfer/login.php?cmd_login

Report Overview

Submitted URL
119.245.203.67/.WeTransfer/login.php?cmd_login_submit
IP
119.245.203.67
ASN
#2514 NTT PC Communications, Inc.
Submitted
2024-04-17 14:22:59
Access
public
Website Title
Sign | WETRANSFER
Final URL
119.245.203.67/.WeTransfer/login.php?cmd_login_submit
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ci3.googleusercontent.com	814	2008-11-17	2013-09-20	2024-04-17	1.3 kB	5.6 kB	142.250.74.161
119.245.203.67	unknown	unknown	2015-11-16	2016-05-09	814 B	90 kB	119.245.203.67
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-17	403 B	80 kB	151.101.130.137
icons.iconarchive.com	80681	2000-08-02	2012-06-20	2024-04-13	404 B	4.7 kB	104.21.235.214

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	119.245.203.67	Sinkholed
2024-04-17	medium	119.245.203.67	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	119.245.203.67/.WeTransfer/login.php?cmd_login_submit	398 B	2023-03-07	2024-04-29
Pretty URL 119.245.203.67/.WeTransfer/login.php?cmd_login_submit IP 119.245.203.67 ASN #2514 NTT PC Communications, Inc. Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:28:11 Last Seen2024-04-29 10:11:18 Times Seen152 Hash fafcfcaea3b48bed0fb8e413bbdcb63b 5511b3d584a075447473b3442a8f6848420cc28f 1dd3fbbb59c962bf8cd419fa4a65f60790c8c7eeea8874b4f3acc3e14a31a9ff Loading...

	code.jquery.com/jquery-1.9.1.js	268 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-1.9.1.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:57 Last Seen2024-04-29 10:11:18 Times Seen43966 Hash 08c235d357750c657ac1db7d1cf656a9 9257afd2d46c3a189ec0d40a45722701d47e9ca5 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40 Loading...

	119.245.203.67/.WeTransfer/login.php?cmd_login_submit	1.4 kB	2024-04-13	2024-04-29
Pretty URL 119.245.203.67/.WeTransfer/login.php?cmd_login_submit IP 119.245.203.67 ASN #2514 NTT PC Communications, Inc. Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-13 14:20:41 Last Seen2024-04-29 10:11:18 Times Seen4 Hash f55ed05d01916004b3aa0704901e60c1 92c54c2aee96c5f7fd56e104ab5185c895d9abf7 5b02784f5caf71ce8bb07c3d093a4cd371fa1a0d2ca73a29801d89707d80e99b Loading...

HTTP Transactions (6)

URL IP Response Size

119.245.203.67/.WeTransfer/index_files/myscr584876.js.download

119.245.203.67

404 Not Found

65 B

URL GET HTTP/1.1
119.245.203.67/.WeTransfer/index_files/myscr584876.js.download
IP
119.245.203.67:80
ASN
#2514 NTT PC Communications, Inc.

Requested by
http://119.245.203.67/.WeTransfer/login.php?cmd_login_submit

File type
ASCII text, with no line terminators
Size
65 B (65 bytes)
Hash
8dbdd98b549973fcde57fcc0bac65a35
71e87dea6a7caa3ce388ce4c0e0b1eaee2f9b3df
b63e6e47824197241f27f352128529108cff0e64c2ab38631e63441951b80b5a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /.WeTransfer/index_files/myscr584876.js.download HTTP/1.1
Host: 119.245.203.67
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://119.245.203.67/.WeTransfer/login.php?cmd_login_submit
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Wed, 17 Apr 2024 14:22:36 GMT
Server: Apache
Content-Length: 65
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

119.245.203.67/.WeTransfer/login.php?cmd_login_submit

119.245.203.67

200 OK

90 kB

URL User Request GET HTTP/1.1
119.245.203.67/.WeTransfer/login.php?cmd_login_submit
IP
119.245.203.67:80
ASN
#2514 NTT PC Communications, Inc.

File type
HTML document, ASCII text, with very long lines (61968), with CRLF line terminators
Size
90 kB (89807 bytes)
Hash
ea0821747f1924e5d3d42844ca3423f6
3ada81f720556b9d49502130e5bd482eeddd1378
dad7eee0c1b761812e41b04ad2ee9a88507846e59c9bc6f1d37fa398a5572ade

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /.WeTransfer/login.php?cmd_login_submit HTTP/1.1
Host: 119.245.203.67
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 17 Apr 2024 14:22:35 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

code.jquery.com/jquery-1.9.1.js

151.101.130.137

200 OK

80 kB

URL GET HTTP/2
code.jquery.com/jquery-1.9.1.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
http://119.245.203.67/.WeTransfer/login.php?cmd_login_submit
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text
Size
80 kB (79506 bytes)
Hash
08c235d357750c657ac1db7d1cf656a9
9257afd2d46c3a189ec0d40a45722701d47e9ca5
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

HTTP Headers

GET /jquery-1.9.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://119.245.203.67/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4185d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Wed, 17 Apr 2024 14:22:36 GMT
age: 7939617
x-served-by: cache-lga21952-LGA, cache-hel1410029-HEL
x-cache: HIT, HIT
x-cache-hits: 31, 56813
x-timer: S1713363757.743219,VS0,VE0
vary: Accept-Encoding
content-length: 79506
X-Firefox-Spdy: h2

icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png

104.21.235.214

200 OK

4.0 kB

URL GET HTTP/1.1
icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png
IP
104.21.235.214:80
ASN
#13335 CLOUDFLARENET

Requested by
http://119.245.203.67/.WeTransfer/login.php?cmd_login_submit

File type
PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Size
4.0 kB (4033 bytes)
Hash
3a583cb9b1e02f29498c63dcf6422f68
dc055fd8bc58c384e2d00a677d9581acf5e4775e
98af5967761222708dc79f43df493e4cc2e085376bf8d50be5560d6c6e1fa7de

HTTP Headers

GET /icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png HTTP/1.1
Host: icons.iconarchive.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://119.245.203.67/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 17 Apr 2024 14:22:36 GMT
Content-Type: image/png
Content-Length: 4033
Connection: keep-alive
Last-Modified: Tue, 07 Feb 2023 10:06:28 GMT
ETag: "63e222a4-fc1"
Cache-Control: max-age=5356800
CF-Cache-Status: HIT
Age: 643
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kOMlt4JJdVV46EQ2HpwzvBTFP2Ts2ODax1%2FChttjsB%2FGEXUDFA98r9TskpEMMmwFXjy0fOSX9tdeiFXw36zS8NhlinLF%2FuwtuR0eq82iII2O4HWC1A%2BL3bwZBAVWM%2BAfv1U6G3LS5js%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 875d1178aa6f4185-LHR
alt-svc: h2=":443"; ma=60

ci3.googleusercontent.com/meips/ADKq_NYEcEN_TM-zUcZ-Uece3gZh3-lvlHAYP10E9REHPR8MoZSC5pXWxnOZyjrah5tFxqc2NBIYuZDlXZ5nn5BiiGnBXwenTRyorMhcsTQg7byEhUJpkXN4-kWP5eX-5zAAHGNpzIUntoekfc89YpOM8HATCVl5Sx2ACjWNGRk4jn-9plz04rsrvnmEFRMEhTUjkJQxoKtQvk-H7w=s0-d-e1-ft

142.250.74.161

2.3 kB

URL
ci3.googleusercontent.com/meips/ADKq_NYEcEN_TM-zUcZ-Uece3gZh3-lvlHAYP10E9REHPR8MoZSC5pXWxnOZyjrah5tFxqc2NBIYuZDlXZ5nn5BiiGnBXwenTRyorMhcsTQg7byEhUJpkXN4-kWP5eX-5zAAHGNpzIUntoekfc89YpOM8HATCVl5Sx2ACjWNGRk4jn-9plz04rsrvnmEFRMEhTUjkJQxoKtQvk-H7w=s0-d-e1-ft
IP
142.250.74.161:0
ASN
#15169 GOOGLE

File type
PNG image data, 112 x 60, 8-bit/color RGBA, non-interlaced
Size
2.3 kB (2303 bytes)
Hash
b599fa8eebd35574b59ce3ad55583002
f2592161d52a4ce637e92bf0d5908d0d68f902ca
013d60df53d77cac080bb04033e4f8894e1d4eab89b8043069ab7b45e5c76cb4

HTTP Headers

GET /meips/ADKq_NYEcEN_TM-zUcZ-Uece3gZh3-lvlHAYP10E9REHPR8MoZSC5pXWxnOZyjrah5tFxqc2NBIYuZDlXZ5nn5BiiGnBXwenTRyorMhcsTQg7byEhUJpkXN4-kWP5eX-5zAAHGNpzIUntoekfc89YpOM8HATCVl5Sx2ACjWNGRk4jn-9plz04rsrvnmEFRMEhTUjkJQxoKtQvk-H7w=s0-d-e1-ft HTTP/1.1
Host: ci3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://119.245.203.67/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: attachment;filename="unnamed.png"
x-content-type-options: nosniff
server: fife
content-length: 2303
x-xss-protection: 0
date: Wed, 17 Apr 2024 05:34:51 GMT
cache-control: public, max-age=31536000
content-type: image/png
vary: Origin
age: 31665
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

142.250.74.161

200 OK

2.3 kB

URL GET HTTP/2
ci3.googleusercontent.com/meips/ADKq_NYEcEN_TM-zUcZ-Uece3gZh3-lvlHAYP10E9REHPR8MoZSC5pXWxnOZyjrah5tFxqc2NBIYuZDlXZ5nn5BiiGnBXwenTRyorMhcsTQg7byEhUJpkXN4-kWP5eX-5zAAHGNpzIUntoekfc89YpOM8HATCVl5Sx2ACjWNGRk4jn-9plz04rsrvnmEFRMEhTUjkJQxoKtQvk-H7w=s0-d-e1-ft
IP
142.250.74.161:443
ASN
#15169 GOOGLE

Requested by
http://119.245.203.67/.WeTransfer/login.php?cmd_login_submit
Certificate
IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
FingerprintE0:0C:38:A4:4D:4F:CB:42:05:30:9A:C4:60:B3:64:3F:EF:43:D1:2F
ValidityMon, 04 Mar 2024 07:14:32 GMT - Mon, 27 May 2024 07:14:31 GMT

File type
PNG image data, 112 x 60, 8-bit/color RGBA, non-interlaced
Size
2.3 kB (2303 bytes)
Hash
b599fa8eebd35574b59ce3ad55583002
f2592161d52a4ce637e92bf0d5908d0d68f902ca
013d60df53d77cac080bb04033e4f8894e1d4eab89b8043069ab7b45e5c76cb4

HTTP Headers

GET /meips/ADKq_NYEcEN_TM-zUcZ-Uece3gZh3-lvlHAYP10E9REHPR8MoZSC5pXWxnOZyjrah5tFxqc2NBIYuZDlXZ5nn5BiiGnBXwenTRyorMhcsTQg7byEhUJpkXN4-kWP5eX-5zAAHGNpzIUntoekfc89YpOM8HATCVl5Sx2ACjWNGRk4jn-9plz04rsrvnmEFRMEhTUjkJQxoKtQvk-H7w=s0-d-e1-ft HTTP/1.1
Host: ci3.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://119.245.203.67/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: attachment;filename="unnamed.png"
x-content-type-options: nosniff
server: fife
content-length: 2303
x-xss-protection: 0
date: Wed, 17 Apr 2024 05:34:51 GMT
cache-control: public, max-age=31536000
content-type: image/png
vary: Origin
age: 31665
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (6)

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size