Overview

URL www.headdownloadstower.com/K4vniMbEv2DxEyftsZn4ypTbsCPo4d9QCcEv1ruCXG5DDbGpbR0cfHggjkGAPGd_w4LGTCwzmX4NeCcJrHSRfdezJCU3fM22UcnCOk4wc5xZszP3va8GD1pCVKEYbVMzO6zI3bxCIQ3EOOB9034WE0joR%20WgvAYm_QuUlTyCj3%20%20uboHaNzTbnObNxnvhwlNX0xUnDoQKdzgEA_gCOp3ASpKaGG0wKi2G49Od3S6O9XUA7bwpZVT98iVMxonJHdP%20xba7f2gt1TWHHWO%201D%20V4b8LImbTtJMhaNOrMnFduiDn7AKsNe2W8_ZhWhgwDOaj2uyofdCLcQkGgyoANVGbFVTosXICxqP0n4HQmYPrOVEBKf1MQ8=-G0AAAEQ3F5siyPpTkoOGFw8ejnYhhgykkca6D8SNBcWjnT51j_sjnxXFX8ErfUxBAgOsoRQd
IP34.240.64.46
ASN
Location United States
Report completed2017-10-12 17:11:50 CEST
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2017-10-12 17:11:18 CEST 1  23.223.21.94 Client IP ET POLICY PE EXE or DLL Windows file download HTTP
2017-10-12 17:11:19 CEST 3  23.223.21.94 Client IP ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2017-10-12 2 www.headdownloadstower.com/K4vniMbEv2DxEyftsZn4ypTbsCPo4d9QCcEv1ruCXG5DDbGp (...) Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 34.240.64.46

Date UQ / IDS / BL URL IP
2017-10-13 19:48:06 +0200
0 - 1 - 3 www.giftupdatehead.com/SvXXhuVe3osq4s9KbXBhyM (...) 34.240.64.46
2017-10-13 16:06:29 +0200
0 - 0 - 1 www.updatesoftwaresend.com/gHHRR3pN_rI1G3DhbH (...) 34.240.64.46
2017-10-13 14:54:56 +0200
0 - 0 - 1 www.bundleapplicationslaboratory.com/aAKXdp3B (...) 34.240.64.46
2017-10-13 04:06:33 +0200
0 - 0 - 1 www.updatesoftwaresend.com/CPqil_ndLJ55w1IFRS (...) 34.240.64.46
2017-10-13 04:02:13 +0200
0 - 0 - 1 www.centerheadpresent.com/X0J3ZEY6ZbktDm3FSYQ (...) 34.240.64.46
2017-10-13 03:56:09 +0200
0 - 0 - 1 www.filescyclebulk.com/uv7zIB3xBCch2FI1xiuSq7 (...) 34.240.64.46
2017-10-13 03:55:14 +0200
0 - 0 - 1 www.chuckletourscapital.com/J%20kELEFlfeK2gJC (...) 34.240.64.46
2017-10-12 19:46:02 +0200
0 - 0 - 1 www.updatesoftwaresend.com/SB5UtKoIfpk17BmFTb (...) 34.240.64.46
2017-10-12 19:37:08 +0200
0 - 0 - 1 www.updatesoftwaresend.com/i6siDZVqFYxIcEPH9d (...) 34.240.64.46
2017-10-12 18:02:16 +0200
0 - 0 - 1 www.contentfunsigns.com/6DU9kYakFGFs_p1jS2QTe (...) 34.240.64.46

Last 10 reports on ASN:

Date UQ / IDS / BL URL IP
2017-10-20 01:32:19 +0200
0 - 0 - 0 public.mails.zoveelvoordeelmail.com/public/re (...) 185.149.85.33
2017-10-20 01:31:09 +0200
0 - 0 - 2 emporiocestaroli.com.br/wp-content/plugins 191.252.140.210
2017-10-20 01:30:18 +0200
0 - 0 - 1 links.apphale.com/trclink.php?pid=MtThAlwyMdV (...) 52.221.162.176
2017-10-20 01:29:41 +0200
0 - 0 - 1 bun.warspade.bid/launch_v5.php?p= 13.33.99.45
2017-10-20 01:28:32 +0200
0 - 0 - 1 bun.warspade.bid/launch_v5.php?p= 13.33.23.163
2017-10-20 01:27:36 +0200
0 - 0 - 0 link.rm0002.net/go/OM_z-qKTJMbROOO5SHQnkg2/ 52.124.3.8
2017-10-20 01:27:17 +0200
0 - 0 - 0 122.152.195.47 122.152.195.47
2017-10-20 01:25:11 +0200
1 - 0 - 0 peraknamhoi.gbs2u.com/ 104.36.18.143
2017-10-20 01:14:57 +0200
0 - 0 - 3 www.dldyzd.com/ 14.192.4.189
2017-10-20 01:14:51 +0200
0 - 0 - 0 https://www.vidio.com/watch/1003347-full-hd-w (...) 52.77.135.185

No other reports on domain: headdownloadstower.com



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (2)


Request Response
                                        
                                            GET /K4vniMbEv2DxEyftsZn4ypTbsCPo4d9QCcEv1ruCXG5DDbGpbR0cfHggjkGAPGd_w4LGTCwzmX4NeCcJrHSRfdezJCU3fM22UcnCOk4wc5xZszP3va8GD1pCVKEYbVMzO6zI3bxCIQ3EOOB9034WE0joR%20WgvAYm_QuUlTyCj3%20%20uboHaNzTbnObNxnvhwlNX0xUnDoQKdzgEA_gCOp3ASpKaGG0wKi2G49Od3S6O9XUA7bwpZVT98iVMxonJHdP%20xba7f2gt1TWHHWO%201D%20V4b8LImbTtJMhaNOrMnFduiDn7AKsNe2W8_ZhWhgwDOaj2uyofdCLcQkGgyoANVGbFVTosXICxqP0n4HQmYPrOVEBKf1MQ8=-G0AAAEQ3F5siyPpTkoOGFw8ejnYhhgykkca6D8SNBcWjnT51j_sjnxXFX8ErfUxBAgOsoRQd HTTP/1.1 
Host: www.headdownloadstower.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         34.249.147.96
HTTP/1.1 302 Moved Temporarily
                                        
Access-Control-Allow-Origin: *
Date: Thu, 12 Oct 2017 15:11:17 GMT
Location: http://downloads.andyroid.net/installer/v46/Andy_46.16_66_x64.exe
Content-Length: 0
Connection: keep-alive


--- Additional Info ---

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /installer/v46/Andy_46.16_66_x64.exe HTTP/1.1 
Host: downloads.andyroid.net
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         23.223.21.94
HTTP/1.1 200 OK
Content-Type: application/octet-stream
                                        
Server: Apache
Etag: "5da40650361a52288e6d6be90bae4873:1486110217"
Last-Modified: Fri, 03 Feb 2017 08:23:37 GMT
Accept-Ranges: bytes
Content-Length: 490896224
Date: Thu, 12 Oct 2017 15:11:17 GMT
Connection: keep-alive
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *


--- Additional Info ---

Alerts:
  IDS:
    - ET POLICY PE EXE or DLL Windows file download HTTP
    - ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)