Overview

URL wahajah-ksa.com/az/a/a.exe
IP104.27.157.137
ASNAS13335 CloudFlare, Inc.
Location United States
Report completed2019-05-22 11:28:02 CEST
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2019-05-22 11:27:30 CEST 1 Client IP  104.27.156.137 ET TROJAN Single char EXE direct download likely trojan (multiple families)
2019-05-22 11:27:30 CEST 2 Client IP  104.27.156.137 ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2019-05-22 2 wahajah-ksa.com/az/a/a.exe Malware
2019-05-22 2 wahajah-ksa.com/az/a/a.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 2 reports on IP: 104.27.157.137

Date UQ / IDS / BL URL IP
2019-05-27 17:21:21 +0200
0 - 2 - 2 wahajah-ksa.com/Az/a/a.exe 104.27.157.137
2018-01-25 01:37:29 +0100
0 - 0 - 19 optik.altervista.org/ 104.27.157.137

Last 10 reports on ASN: AS13335 CloudFlare, Inc.

Date UQ / IDS / BL URL IP
2019-06-25 10:44:19 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/good-trouble (...) 104.16.120.127
2019-06-25 10:44:11 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/putlocker-go (...) 104.16.122.127
2019-06-25 10:44:03 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/watch-good-t (...) 104.16.120.127
2019-06-25 10:43:55 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/full-episode (...) 104.16.121.127
2019-06-25 10:43:33 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/watch-good-t (...) 104.16.124.127
2019-06-25 10:43:24 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/good-trouble (...) 104.16.121.127
2019-06-25 10:43:20 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/watch-good-t (...) 104.16.124.127
2019-06-25 10:43:19 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/full-series- (...) 104.16.123.127
2019-06-25 10:43:12 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/good-trouble (...) 104.16.123.127
2019-06-25 10:26:22 +0200
0 - 0 - 0 https://www.rjavan.me 104.26.2.84

Last 6 reports on domain: wahajah-ksa.com

Date UQ / IDS / BL URL IP
2019-06-04 10:21:45 +0200
0 - 0 - 2 wahajah-ksa.com/Az/a/a.exe 104.27.156.137
2019-05-27 17:21:21 +0200
0 - 2 - 2 wahajah-ksa.com/Az/a/a.exe 104.27.157.137
2019-05-27 13:02:09 +0200
0 - 2 - 2 wahajah-ksa.com/Az/a/a.exe 104.27.156.137
2018-12-04 21:57:06 +0100
0 - 0 - 2 wahajah-ksa.com/AZ/a/a.exe 195.154.151.29
2018-12-04 19:24:39 +0100
0 - 0 - 2 wahajah-ksa.com/AZ/a/a.exe 195.154.151.29
2018-11-21 11:48:40 +0100
0 - 0 - 0 wahajah-ksa.com 195.154.151.29


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (6)


Request Response
                                        
                                            GET /az/a/a.exe HTTP/1.1 
Host: wahajah-ksa.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.27.156.137
HTTP/1.1 301 Moved Permanently
                                        
Date: Wed, 22 May 2019 09:27:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 22 May 2019 10:27:30 GMT
Location: https://wahajah-ksa.com/az/a/a.exe
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4dadc12d8e5ed13b-GOT


--- Additional Info ---

Alerts:
  Blacklists:
    - fortinet: Malware
  IDS:
    - ET TROJAN Single char EXE direct download likely trojan (multiple families)
    - ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=170574
Date: Wed, 22 May 2019 09:27:30 GMT
Etag: "5ce50d50-117"
Expires: Fri, 24 May 2019 08:50:24 GMT
Last-Modified: Wed, 22 May 2019 08:50:24 GMT
Server: nginx
Content-Length: 279


--- Additional Info ---
Magic:  data
Size:   279
Md5:    756ea37291dbc18ebdd8cf8baa9216e5
Sha1:   e59cd5d5c1e8bf6c954a37a36a034e6b9aae007c
Sha256: bcdf7a9e932d83f054c138e0f1337e261a1ddc0fdca105a4a96bc54aea2f2c54
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=168331
Date: Wed, 22 May 2019 09:27:30 GMT
Etag: "5ce4e591-5e3"
Expires: Fri, 24 May 2019 08:13:01 GMT
Last-Modified: Wed, 22 May 2019 06:00:49 GMT
Server: ECS (lcy/1D68)
X-Cache: HIT
Content-Length: 1507


--- Additional Info ---
Magic:  data
Size:   1507
Md5:    ea3a17f40615f96aa1f053af8a64a870
Sha1:   a054f28da9eda43d7332958e051f8509c58cb644
Sha256: a590d427f69de77aa3dc3794d9baeeefb5651e88ae11d8e723e1795502c87099
                                        
                                            GET /az/a/a.exe HTTP/1.1 
Host: wahajah-ksa.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.27.156.137
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 22 May 2019 09:27:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=daf3ac23f1e66f93df69fed00cb8c35e51558517250; expires=Thu, 21-May-20 09:27:30 GMT; path=/; domain=.wahajah-ksa.com; HttpOnly; Secure
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 4dadc13269fad143-GOT
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   253
Md5:    4ebb2684891b2f78f34c1cb6e08c60c0
Sha1:   cec7a9d472d86062ce30950e8d9702680870a623
Sha256: 1d5d93c5090b396730bb0646e8eb21fa67003ce1786e14a4bc912a7acbc48085

Alerts:
  Blacklists:
    - fortinet: Malware
  IDS:
    - ET TROJAN Single char EXE direct download likely trojan (multiple families)
    - ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: wahajah-ksa.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: __cfduid=daf3ac23f1e66f93df69fed00cb8c35e51558517250

                                         
                                         104.27.156.137
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 22 May 2019 09:27:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: HIT
Expires: Wed, 22 May 2019 13:27:34 GMT
Cache-Control: public, max-age=14400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4dadc14618aad133-GOT
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   247
Md5:    8bef991b36c9715500683efd50a9bbfb
Sha1:   183d9bdde200ad66df23e2ab7af0c960ef18b901
Sha256: 682a36bffc64bc684c232df9bc23af34f7c4eafade7b61e21ff2e240d39cc021
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: wahajah-ksa.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: __cfduid=daf3ac23f1e66f93df69fed00cb8c35e51558517250

                                         
                                         104.27.156.137
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Wed, 22 May 2019 09:27:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
CF-Cache-Status: EXPIRED
Expires: Wed, 22 May 2019 13:27:31 GMT
Cache-Control: public, max-age=14400
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4dadc1333b87d143-GOT
Content-Encoding: gzip


--- Additional Info ---