Report - songs.zapto.org/apchub/backdoor.ps1

Report Overview

Submitted URL
songs.zapto.org/apchub/backdoor.ps1
IP
119.194.137.188
ASN
#4766 Korea Telecom
Submitted
2024-04-24 08:11:37
Access
public
Website Title
songs.zapto.org/apchub/backdoor.ps1
Final URL
songs.zapto.org/apchub/backdoor.ps1
Tags
dyndns
urlquery detections
Suspicious - DynDNS domain

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
songs.zapto.org	unknown	unknown	No data	No data	765 B	1.0 kB	119.194.137.188

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

songs.zapto.org/apchub/backdoor.ps1

119.194.137.188

200 OK

262 B

URL User Request GET HTTP/1.1
songs.zapto.org/apchub/backdoor.ps1
IP
119.194.137.188:80
ASN
#4766 Korea Telecom

File type
ASCII text
Size
262 B (262 bytes)
Hash
0cf381d114759fd9d564cb1650664ce8
13d6e7ae73b9d3de2eb85995c366e015b740670b
ad6b69901deabb0d55165026ad8993adb94713121b21986b2be7274e81997fe3

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /apchub/backdoor.ps1 HTTP/1.1
Host: songs.zapto.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 08:11:13 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 22 Apr 2024 05:26:36 GMT
ETag: "106-616a8ae628837"
Accept-Ranges: bytes
Content-Length: 262
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

songs.zapto.org/favicon.ico

119.194.137.188

404 Not Found

277 B

URL GET HTTP/1.1
songs.zapto.org/favicon.ico
IP
119.194.137.188:80
ASN
#4766 Korea Telecom

Requested by
http://songs.zapto.org/apchub/backdoor.ps1

File type
HTML document, ASCII text
Size
277 B (277 bytes)
Hash
cfdc876c4d1524b58e13f262a5992ec2
1d721961b0d2d199cbf6a1cc536df574c8d761b3
c2e38c7ee87f3ee5a574fdab8ff56811ba18fba67e304b419a40d3186941f1da

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: songs.zapto.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://songs.zapto.org/apchub/backdoor.ps1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 08:11:14 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers