Overview

URL config.yypdf.cn/bug/yypdfk/PdfReaderUp.exe
IP27.221.54.22
ASNAS4837 CNCGROUP China169 Backbone
Location China
Report completed2019-03-25 05:35:02 CET
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2019-03-25 2 config.yypdf.cn/bug/yypdfk/PdfReaderUp.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 27.221.54.22

Date UQ / IDS / BL URL IP
2019-06-09 10:13:13 +0200
0 - 2 - 1 ou.dodonew.com/F1EF07F6003CC0651D58BC9518768B0A 27.221.54.22
2019-06-09 10:13:10 +0200
0 - 0 - 2 p1.5zdn.com/Phoenix 27.221.54.22
2019-06-06 00:15:14 +0200
0 - 1 - 1 hddown.down.gsxzq.com/download/PPTV_134@34785.exe 27.221.54.22
2019-06-05 21:44:24 +0200
0 - 2 - 0 download.doumaibiji.cn/doumai/appupdui/v1.0.6 (...) 27.221.54.22
2019-06-05 20:08:15 +0200
0 - 1 - 1 down.052intn.cn/new/%E4%B8%87%E8%83%BD%E4%BA% (...) 27.221.54.22
2019-06-05 19:33:59 +0200
0 - 1 - 1 down.ttp1.cn/new/@700_1572_1572-.exe 27.221.54.22
2019-06-05 15:33:54 +0200
0 - 1 - 0 duo.down.gsxzq.com/download/hangul2010%28%E9% (...) 27.221.54.22
2019-06-03 02:12:44 +0200
0 - 3 - 0 d.kpzip.com/kuaizipb/Kuaizip_Setup_xiaoxin3_0 (...) 27.221.54.22
2019-06-03 02:12:35 +0200
0 - 3 - 0 d.kpzip.com/kuaizipb/Kuaizip_Setup_lixjm3_001.exe 27.221.54.22
2019-06-03 02:11:49 +0200
0 - 1 - 0 yesky.down.gsxzq.com/download/%E5%BE%AE%E5%8D (...) 27.221.54.22

Last 10 reports on ASN: AS4837 CNCGROUP China169 Backbone

Date UQ / IDS / BL URL IP
2019-06-25 19:50:44 +0200
0 - 0 - 0 60.215.25.175 60.215.25.175
2019-06-25 18:45:28 +0200
0 - 0 - 0 112.245.185.140//uploads/dede/sys_verifies.ph (...) 112.245.185.140
2019-06-25 18:44:14 +0200
0 - 0 - 0 112.245.185.140 112.245.185.140
2019-06-25 11:27:13 +0200
0 - 0 - 0 www.pc6.com. 1.189.213.92
2019-06-25 02:48:18 +0200
0 - 0 - 0 pro.cdn2.ime.sogou.com/sogou_pinyin_9.3.0.3129.exe 211.91.160.204
2019-06-21 11:38:24 +0200
0 - 0 - 0 58.242.82.3 58.242.82.3
2019-06-20 17:26:34 +0200
0 - 0 - 0 www.newasp.net 101.206.209.243
2019-06-20 17:21:44 +0200
0 - 0 - 0 www.pc6.com 113.1.0.98
2019-06-20 15:41:42 +0200
0 - 0 - 0 175.42.146.20 175.42.146.20
2019-06-20 08:23:06 +0200
0 - 0 - 0 cdn1.ime.sogou.com 1.189.213.208

No other reports on domain: yypdf.cn



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (3)


Request Response
                                        
                                            GET /bug/yypdfk/PdfReaderUp.exe HTTP/1.1 
Host: config.yypdf.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         27.221.54.19
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Server: NWS_TCloud_S1
Connection: keep-alive
Date: Mon, 25 Mar 2019 04:34:29 GMT
Content-Length: 85


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   85
Md5:    660e28bddc4cc9ec5783fe0e995a596c
Sha1:   e6feca85a9a5d77d732e9ff39a792a9819335cfd
Sha256: 978f67958a5107ea51973590a8deafc88cf3498b6a45563e9d28daa7f2875d4a

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: config.yypdf.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         27.221.54.19
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Server: nginx
Connection: keep-alive
Date: Mon, 25 Mar 2019 04:34:30 GMT
Last-Modified: Mon, 25 Mar 2019 04:30:00 GMT
Transfer-Encoding: chunked
X-NWS-UUID-VERIFY: ca76103c2a341e63234df6ee206aa814
X-Daa-Tunnel: hop_count=5
X-NWS-LOG-UUID: 9834318913126217201 e2dbe92a5a9741a288ac9890626bc9b0
X-Cache-Lookup: Hit From Upstream, Hit From Upstream, Hit From Inner Cluster, Hit From Upstream, Hit From Inner Cluster


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   1235
Md5:    c151ff7a50137dcc0607178f6a6df3ef
Sha1:   54193b598aa12808f267a36e05625f548510a343
Sha256: 69eb6102228b21f3a58fc044eea50b57ac473f53f5ea7b191e2cdc8db54f498f
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: config.yypdf.cn
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         27.221.54.19
HTTP/1.1 404 Not Found
Content-Type: text/html
                                        
Server: NWS_TCloud_S1
Connection: keep-alive
Date: Mon, 25 Mar 2019 04:34:33 GMT
Content-Length: 63
X-NWS-LOG-UUID: 8703505418936991169 e2dbe92a5a9741a288ac9890626bc9b0
X-Cache-Lookup: Hit From 404 Cache, Hit From Inner Cluster
X-Daa-Tunnel: hop_count=1


--- Additional Info ---
Magic:  ASCII English text
Size:   63
Md5:    299abd182747117de0939d51d4952240
Sha1:   3e7d89fa0631675db84a84a8ffc12ae9a10091f4
Sha256: 781a18d070fd8252bf5eb21ce96fbbe69ae1260b3016444ac7d19bf4661b51b4