Report - 80.94.95.238/Caf.jpg

Report Overview

Submitted URL
80.94.95.238/Caf.jpg
IP
80.94.95.238
ASN
#204428 SS-Net
Submitted
2024-04-25 07:44:55
Access
public
Website Title
Caf.jpg (JPEG Image)
Final URL
80.94.95.238/Caf.jpg
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
80.94.95.238	unknown	unknown	No data	No data	898 B	1.3 MB	80.94.95.238

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	80.94.95.238	Sinkholed
2024-04-25	medium	80.94.95.238	Sinkholed

ThreatFox

No alerts detected

Files detected

URL
80.94.95.238/Caf.jpg
IP
80.94.95.238
ASN
#204428 SS-Net

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.3 MB (1296064 bytes)
Hash
5ccb7b1f81e481f426304d5ce49de026
d5e45b30144dd875923eeebd89498100e2259291
f038ff12991ab39dcc2856968cee131bf4049c9e7f854187b8e698d5701ce55c

Archive (12)

Modified	Filename	Size	Md5	File type
2024-04-23 20:15	Auto.vbs	435 B	a5b25c095336368b68172d0eec88069e	Unicode text, UTF-8 text, with CRLF line terminators
2024-04-23 20:33	AutoHotkey	339 B	2312ab36e3363bfa8f217c14354aba68	ASCII text, with CRLF line terminators
2024-01-01 03:49	Execute.txt	7 B	40cd014b7b6251e3a22e6a45a73a64e1	ASCII text, with no line terminators
2024-01-01 03:57	getMethod.txt	9 B	db37f91f128a82062af0f39f649ea122	ASCII text, with no line terminators
2024-01-01 03:56	Gettype.txt	7 B	9221b7b54ed96de7281d31f8ae35be6a	ASCII text, with no line terminators
2024-01-10 04:52	Invoke.txt	6 B	5fb833d20ef9f93596f4117a81523536	ASCII text, with no line terminators
2024-01-01 03:56	load.txt	4 B	ec4d1eb36b22d19728e9d1d23ca84d1c	ASCII text, with no line terminators
2024-04-23 21:23	msg.txt	824 kB	aa122206649dcdf58ce7f93088206a69	ASCII text, with very long lines (65536), with no line terminators
2024-01-01 04:08	NewPE2.txt	9 B	8a56a0e23dbfe7a50c5ec927b73ec5f2	ASCII text, with no line terminators
2024-04-23 20:21	node.bat	687 B	52dc8ab7250ca32c7dea8867d6464e5b	DOS batch file, ASCII text, with very long lines (550), with CRLF line terminators
2024-04-23 17:10	run.js	1.3 kB	660c9112523248048eaf7d9f1ee30960	JavaScript source, ASCII text, with CRLF line terminators
2024-01-12 22:01	runpe.txt	4.0 MB	afcc7cacf140469b858eaaca175fd3da	ASCII text, with very long lines (65536), with no line terminators

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

80.94.95.238/Caf.jpg

80.94.95.238

200 OK

1.3 MB

URL User Request GET HTTP/1.1
80.94.95.238/Caf.jpg
IP
80.94.95.238:443
ASN
#204428 SS-Net

Certificate
Issuer
Subjectlocalhost
FingerprintB0:23:8C:54:7A:90:5B:FA:11:9C:4E:8B:AC:CA:EA:CF:36:49:1F:F6
ValidityTue, 10 Nov 2009 23:48:47 GMT - Fri, 08 Nov 2019 23:48:47 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.3 MB (1296064 bytes)
Hash
5ccb7b1f81e481f426304d5ce49de026
d5e45b30144dd875923eeebd89498100e2259291
f038ff12991ab39dcc2856968cee131bf4049c9e7f854187b8e698d5701ce55c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /Caf.jpg HTTP/1.1
Host: 80.94.95.238
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 07:44:31 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Tue, 23 Apr 2024 18:23:25 GMT
ETag: "13c6c0-616c7a652bd98"
Accept-Ranges: bytes
Content-Length: 1296064
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg

80.94.95.238/favicon.ico

80.94.95.238

404 Not Found

299 B

URL GET HTTP/1.1
80.94.95.238/favicon.ico
IP
80.94.95.238:443
ASN
#204428 SS-Net

Requested by
https://80.94.95.238/Caf.jpg
Certificate
Issuer
Subjectlocalhost
FingerprintB0:23:8C:54:7A:90:5B:FA:11:9C:4E:8B:AC:CA:EA:CF:36:49:1F:F6
ValidityTue, 10 Nov 2009 23:48:47 GMT - Fri, 08 Nov 2019 23:48:47 GMT

File type
HTML document, ASCII text
Size
299 B (299 bytes)
Hash
787980a97d042977789fbc8e488327d4
a7f04b160aef9b763d44ee3de53bfbe71b0377ee
017c05450416708499e5a8109f8f19d187f2ae29459e1284d6152a577c49cb96

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 80.94.95.238
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://80.94.95.238/Caf.jpg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 07:44:32 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Content-Length: 299
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (12)

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers