Overview

URL config.yypdf.cn/bug/yypdfk/PdfReaderUp.exe
IP27.221.54.22
ASNAS4837 CNCGROUP China169 Backbone
Location China
Report completed2019-03-25 05:35:02 CET
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2019-03-25 2 config.yypdf.cn/bug/yypdfk/PdfReaderUp.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 27.221.54.22

Date UQ / IDS / BL URL IP
2019-04-17 23:52:53 +0200
0 - 0 - 1 download.pdf00.cn/pdfreader/mini/v1.0.1.17/mi (...) 27.221.54.22
2019-04-17 11:26:56 +0200
0 - 0 - 1 download.pdf00.cn/pdfreader/tips/v1.0.2.19/ti (...) 27.221.54.22
2019-04-15 21:00:04 +0200
0 - 0 - 1 down1.7654.com/n/install/version/v2.0.0.3/HNI (...) 27.221.54.22
2019-04-12 23:21:21 +0200
0 - 0 - 1 down.54shubiao.com/dy1109_mfwz.exe 27.221.54.22
2019-04-12 23:19:43 +0200
0 - 0 - 1 dw.xj6x.com/fn/0/hipro.zip 27.221.54.22
2019-04-11 05:14:57 +0200
0 - 0 - 1 download.glzip.cn/n/install/version/v2.8.28.4 (...) 27.221.54.22
2019-04-10 09:58:13 +0200
0 - 0 - 1 opsoft.down.gsxzq.com/download/ChemDraw15.1_1 (...) 27.221.54.22
2019-04-09 17:33:41 +0200
0 - 0 - 1 down1.xiaoyu.shzhanmeng.com/tui/tpop/popnews/ (...) 27.221.54.22
2019-04-09 17:21:18 +0200
0 - 0 - 1 pc6.down.gsxzq.com/download/AutoCAD_30@95272.exe 27.221.54.22
2019-04-07 23:31:58 +0200
0 - 0 - 1 tips-hn.7654.com/n/tui/tips/v1.2.0.12/tips2-4.exe 27.221.54.22

Last 10 reports on ASN: AS4837 CNCGROUP China169 Backbone

Date UQ / IDS / BL URL IP
2019-04-19 20:59:53 +0200
0 - 0 - 1 down.zpnke.cn/xiazai/49842.apk?t=1555689612 119.36.61.195
2019-04-19 20:39:32 +0200
0 - 0 - 1 down.9fs.com/msoft/pretty.mom.apk 42.49.128.24
2019-04-19 20:17:24 +0200
0 - 0 - 1 8dx.pc6.com/ 221.204.166.22
2019-04-19 19:33:34 +0200
0 - 0 - 1 i.kpzip.com/n/tui/mininews/mininews4/v4.1.2.1 (...) 218.11.8.81
2019-04-19 19:04:50 +0200
0 - 0 - 1 sxch.com.cn/map/index.html?lon=111.5177 218.26.178.1
2019-04-19 19:03:27 +0200
0 - 0 - 1 csgo233-1251130179.file.myqcloud.com/Loader.exe 182.118.11.126
2019-04-19 19:02:03 +0200
0 - 0 - 1 sa.105471.com/404005.apk?sid=404005 119.36.61.195
2019-04-19 17:04:57 +0200
0 - 0 - 0 dedecms.com 61.133.125.200
2019-04-19 16:38:05 +0200
0 - 0 - 1 config.myloglist.top/bug/yizip/YiCompressUpda (...) 101.206.209.213
2019-04-19 16:36:54 +0200
0 - 0 - 1 config.cqhbkjzx.com/bug/qdesk/DesktopUpdateEx.exe 220.195.19.69

No other reports on domain: yypdf.cn



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (3)


Request Response
                                        
                                            GET /bug/yypdfk/PdfReaderUp.exe HTTP/1.1 
Host: config.yypdf.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         27.221.54.19
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Server: NWS_TCloud_S1
Connection: keep-alive
Date: Mon, 25 Mar 2019 04:34:29 GMT
Content-Length: 85


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   85
Md5:    660e28bddc4cc9ec5783fe0e995a596c
Sha1:   e6feca85a9a5d77d732e9ff39a792a9819335cfd
Sha256: 978f67958a5107ea51973590a8deafc88cf3498b6a45563e9d28daa7f2875d4a

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: config.yypdf.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         27.221.54.19
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Server: nginx
Connection: keep-alive
Date: Mon, 25 Mar 2019 04:34:30 GMT
Last-Modified: Mon, 25 Mar 2019 04:30:00 GMT
Transfer-Encoding: chunked
X-NWS-UUID-VERIFY: ca76103c2a341e63234df6ee206aa814
X-Daa-Tunnel: hop_count=5
X-NWS-LOG-UUID: 9834318913126217201 e2dbe92a5a9741a288ac9890626bc9b0
X-Cache-Lookup: Hit From Upstream, Hit From Upstream, Hit From Inner Cluster, Hit From Upstream, Hit From Inner Cluster


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   1235
Md5:    c151ff7a50137dcc0607178f6a6df3ef
Sha1:   54193b598aa12808f267a36e05625f548510a343
Sha256: 69eb6102228b21f3a58fc044eea50b57ac473f53f5ea7b191e2cdc8db54f498f
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: config.yypdf.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         27.221.54.19
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Server: NWS_TCloud_S1
Connection: keep-alive
Date: Mon, 25 Mar 2019 04:34:33 GMT
Content-Length: 63
X-NWS-LOG-UUID: 8703505418936991169 e2dbe92a5a9741a288ac9890626bc9b0
X-Cache-Lookup: Hit From 404 Cache, Hit From Inner Cluster
X-Daa-Tunnel: hop_count=1


--- Additional Info ---
Magic:  ASCII English text
Size:   63
Md5:    299abd182747117de0939d51d4952240
Sha1:   3e7d89fa0631675db84a84a8ffc12ae9a10091f4
Sha256: 781a18d070fd8252bf5eb21ce96fbbe69ae1260b3016444ac7d19bf4661b51b4