Overview

URL checkandswitch.com/afile/7.exe
IP81.177.140.147
ASNAS8342 OJSC RTComm.RU
Location Russian Federation
Report completed2019-03-27 10:04:46 CET
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2019-03-27 10:04:14 CET 1 Client IP  81.177.140.147 ET TROJAN Single char EXE direct download likely trojan (multiple families)


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2019-03-27 2 checkandswitch.com/afile/7.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns
Added / Verified Severity Host Comment
2019-03-27 2 checkandswitch.com Blacklisted
2019-03-27 2 checkandswitch.com Blacklisted
2019-03-27 2 checkandswitch.com Blacklisted


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 81.177.140.147

Date UQ / IDS / BL URL IP
2019-06-10 20:21:01 +0200
0 - 0 - 4 onlydropped.com/press.html 81.177.140.147
2019-05-09 22:00:09 +0200
0 - 0 - 1 checkandswitch.com 81.177.140.147
2019-04-17 06:52:51 +0200
0 - 0 - 1 checkandswitch.com/afile/7.exe 81.177.140.147
2019-04-10 05:26:46 +0200
0 - 0 - 1 checkandswitch.com/afile/6.exe 81.177.140.147
2019-04-08 16:49:16 +0200
0 - 0 - 1 checkandswitch.com/afile/1.exe 81.177.140.147
2019-04-08 16:47:01 +0200
0 - 0 - 1 checkandswitch.com/download/setup.exe 81.177.140.147
2019-04-06 04:23:23 +0200
0 - 0 - 1 checkandswitch.com/afile/9.exe 81.177.140.147
2019-04-03 17:44:57 +0200
0 - 0 - 3 onlydropped.com/press/restomag.html 81.177.140.147
2019-03-27 11:57:39 +0100
0 - 0 - 4 checkandswitch.com/afile/7.exe 81.177.140.147
2019-03-25 06:31:40 +0100
0 - 0 - 3 checkandswitch.com/afile/7.exe 81.177.140.147

Last 10 reports on ASN: AS8342 OJSC RTComm.RU

Date UQ / IDS / BL URL IP
2019-06-27 09:58:45 +0200
0 - 0 - 0 radikal.ru 81.176.238.240
2019-06-26 19:02:54 +0200
0 - 0 - 5 coinspottechrem.com 81.177.141.30
2019-06-18 20:46:35 +0200
0 - 2 - 1 pasta.hurd.club/ 81.177.180.138
2019-06-18 20:37:32 +0200
0 - 1 - 1 aruna.migel.club/ 81.177.180.138
2019-06-18 20:26:57 +0200
0 - 0 - 1 escap.migel.club/ 81.177.180.138
2019-06-18 16:41:34 +0200
0 - 0 - 0 igra.tovsl.ru/cw-pl30/ 81.177.139.41
2019-06-17 21:38:04 +0200
0 - 0 - 1 linera.ru 81.177.140.222
2019-06-17 11:49:32 +0200
0 - 0 - 0 znak-a.ru 81.177.49.68
2019-06-13 17:28:39 +0200
0 - 0 - 0 idntfy.ru 195.161.34.118
2019-06-11 00:49:55 +0200
1 - 0 - 1 learning2live.ru/docs/config/cluster.html 81.177.32.12

Last 10 reports on domain: checkandswitch.com

Date UQ / IDS / BL URL IP
2019-05-09 22:00:09 +0200
0 - 0 - 1 checkandswitch.com 81.177.140.147
2019-04-17 06:52:51 +0200
0 - 0 - 1 checkandswitch.com/afile/7.exe 81.177.140.147
2019-04-10 05:26:46 +0200
0 - 0 - 1 checkandswitch.com/afile/6.exe 81.177.140.147
2019-04-08 16:49:16 +0200
0 - 0 - 1 checkandswitch.com/afile/1.exe 81.177.140.147
2019-04-08 16:47:01 +0200
0 - 0 - 1 checkandswitch.com/download/setup.exe 81.177.140.147
2019-04-06 04:23:23 +0200
0 - 0 - 1 checkandswitch.com/afile/9.exe 81.177.140.147
2019-03-27 11:57:39 +0100
0 - 0 - 4 checkandswitch.com/afile/7.exe 81.177.140.147
2019-03-25 06:31:40 +0100
0 - 0 - 3 checkandswitch.com/afile/7.exe 81.177.140.147
2019-02-14 21:41:41 +0100
0 - 0 - 4 checkandswitch.com/afile/6.exe 81.177.140.147
2019-02-12 03:51:57 +0100
0 - 0 - 4 checkandswitch.com/afile/6.exe 81.177.140.147


JavaScript

Executed Scripts (4)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (17)


Request Response
                                        
                                            GET /afile/7.exe HTTP/1.1 
Host: checkandswitch.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         81.177.140.147
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Date: Wed, 27 Mar 2019 09:04:13 GMT
Content-Length: 601
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   601
Md5:    75cdbe4fca6284cb0594686b77df290f
Sha1:   89d1040474c933de70b75c44326f3e388987e65a
Sha256: 8fe09e2643eca67f25a431ccd015b8e7e5575e186c870967cee08ba07ee32541

Alerts:
  Blacklists:
    - fortinet: Malware
    - mnemonic_dns: Blacklisted
  IDS:
    - ET TROJAN Single char EXE direct download likely trojan (multiple families)
                                        
                                            GET /static/main.js HTTP/1.1 
Host: parking-static.jino.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         195.161.41.160
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Wed, 27 Mar 2019 09:04:14 GMT
Last-Modified: Thu, 13 Sep 2018 09:13:19 GMT
Transfer-Encoding: chunked
Connection: close
Etag: W/"5b9a2a2f-1c0a6"
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   38902
Md5:    b312d355c73a693dcaac004676600eaf
Sha1:   e9b8b5a743ce701232974cfe4847feed35fedece
Sha256: 129c556311b237a3fd0e8297a92b18922099e363b2ef93ef8db0fe3d96cdffb2
                                        
                                            GET /static/components/page/logo.svg HTTP/1.1 
Host: parking-static.jino.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         195.161.41.160
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Wed, 27 Mar 2019 09:04:14 GMT
Last-Modified: Thu, 13 Sep 2018 09:13:19 GMT
Transfer-Encoding: chunked
Connection: close
Etag: W/"5b9a2a2f-a26"
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   1228
Md5:    88684194e02fd159f43ae79a6f761338
Sha1:   09de0a3bc9f9305143ce036c89fb1d34317f850f
Sha256: 014471cfa9a3a4c053aca3bf8071bc6211e97de4dde23fae753d39e687fdbb15
                                        
                                            GET /static/components/page/icons/page_error.svg HTTP/1.1 
Host: parking-static.jino.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         195.161.41.160
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Wed, 27 Mar 2019 09:04:14 GMT
Content-Length: 724
Last-Modified: Thu, 13 Sep 2018 09:13:19 GMT
Connection: close
Etag: "5b9a2a2f-2d4"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines, with no line terminators
Size:   724
Md5:    aeda2ffdebc3c56fa1ea13485304df56
Sha1:   6e114e18eb059d9bbce0bc5614aafeacca872d94
Sha256: 415ca0c5c9edef0fdecb9e5d039a69942dfaa3b741ce409b7204f3d38584d4b1
                                        
                                            GET /metrika/watch.js HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         87.250.251.119
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:14 GMT
Content-Length: 185
Connection: keep-alive
Location: https://mc.yandex.ru/metrika/watch.js


--- Additional Info ---
Magic:  HTML document text
Size:   185
Md5:    cb6ffbb4043c88e63023bdbe1273e7f6
Sha1:   51ab256fee07ae97343aea50861f5b9b0214cac2
Sha256: e2085b8ac766c65a76f7e31e2ee5d257f7728465331a46ee58005fd212575348
                                        
                                            GET /sections/2/720751.js HTTP/1.1 
Host: cache.betweendigital.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         50.7.91.73
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Wed, 27 Mar 2019 09:04:14 GMT
Content-Length: 8807
Connection: keep-alive
Last-Modified: Thu, 05 Jul 2018 10:06:01 GMT
Etag: "5b3ded89-2267"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  UTF-8 Unicode C++ program text, with very long lines, with CR, LF line terminators
Size:   8807
Md5:    8ce59f021ea2b09a2a3bc8e0d096b282
Sha1:   aa3a366f1587767464e683385e97e5f8816ffa53
Sha256: 0ce3cf1ce4b64159e5b4d4a3a0d8c1ef5d4dc4678693bb820a3b6c6d188a4a79
                                        
                                            GET /code/1x1.gif HTTP/1.1 
Host: cache.betweendigital.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         50.7.91.73
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Server: nginx
Date: Wed, 27 Mar 2019 09:04:14 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Fri, 15 Mar 2019 09:36:28 GMT
Etag: "5c8b721c-2b"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1
Size:   43
Md5:    df3e567d6f16d040326c7a0ea29a4f41
Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736
Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                        
                                            POST /gsorganizationvalsha2g2 HTTP/1.1 
Host: ocsp2.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 111
Content-Type: application/ocsp-request

                                         
                                         104.18.20.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 27 Mar 2019 09:04:14 GMT
Content-Length: 1570
Connection: keep-alive
Set-Cookie: __cfduid=ddeaf63565cc099117a1f85ff4b5bdc1f1553677454; expires=Thu, 26-Mar-20 09:04:14 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Wed, 27 Mar 2019 06:38:18 GMT
Expires: Sun, 31 Mar 2019 06:38:18 GMT
Etag: "4b8f38136faa653aeac542cf1b2607993fa7d573"
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4be0321c2e8d4261-OSL


--- Additional Info ---
Magic:  data
Size:   1570
Md5:    d6fbe02aea7ea3a2f53c80a957692b99
Sha1:   4b8f38136faa653aeac542cf1b2607993fa7d573
Sha256: 2e174e0dca77a2f49fc5e9a089b64dcf6350b6cdb44522d62298c27683c73d36
                                        
                                            GET /metrika/watch.js HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         87.250.251.119
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:14 GMT
Content-Length: 43794
Last-Modified: Wed, 20 Mar 2019 15:02:53 GMT
Connection: keep-alive
Etag: "5c92561d-ab12"
Content-Encoding: gzip
Expires: Wed, 27 Mar 2019 10:04:14 GMT
Cache-Control: max-age=3600
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  gzip compressed data, from Unix, max compression
Size:   43794
Md5:    90ae2ca7bbca9fd38adf7e5ba7060f66
Sha1:   2f4e4a66f067e90c1db985f4b4a9b0784d3e1cac
Sha256: 0bc1d62a2073b50f343e12cdc6dc9d3e507f17fa6e0c7fd89f739ee1a0f6c0df
                                        
                                            GET /metrika/advert.gif HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         87.250.251.119
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 61
Last-Modified: Mon, 12 Oct 2015 13:09:09 GMT
Connection: keep-alive
Etag: "561bb0f5-3d"
Content-Encoding: gzip
Expires: Wed, 27 Mar 2019 10:04:15 GMT
Cache-Control: max-age=3600
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  gzip compressed data, was "advert.gif", from Unix, last modified: Mon Oct 12 15:06:12 2015
Size:   61
Md5:    aad2d5e940637a676e25e6cc7a684a83
Sha1:   c77946775d4c1719c48eb691edfbcf873b0738f5
Sha256: d9d219b8ba39a549d43400945b848dde73269f25dab5b75b85439c451ca0a525
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: checkandswitch.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: _ym_uid=1553677455786321411; _ym_d=1553677455

                                         
                                         81.177.140.147
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 601
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   601
Md5:    75cdbe4fca6284cb0594686b77df290f
Sha1:   89d1040474c933de70b75c44326f3e388987e65a
Sha256: 8fe09e2643eca67f25a431ccd015b8e7e5575e186c870967cee08ba07ee32541

Alerts:
  Blacklists:
    - mnemonic_dns: Blacklisted
                                        
                                            OPTIONS /watch/25328195?wmode=7&page-url=http%3A%2F%2Fcheckandswitch.com%2Fafile%2F7.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22noservice%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3A%221.1.0%22%7D&browser-info=ti%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A60%3Ai%3A20190327100414%3Aet%3A1553677456%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A880172848559%3Arqn%3A1%3Arn%3A1026831474%3Ahid%3A897603841%3Agdpr%3A14%3Av%3A1505%3Arqnl%3A1%3Ast%3A1553677456%3Au%3A1553677455786321411%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%BD%D0%B5%20%D0%BE%D0%B1%D1%81%D0%BB%D1%83%D0%B6%D0%B8%D0%B2%D0%B0%D0%B5%D1%82%D1%81%D1%8F HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Origin: http://checkandswitch.com
Access-Control-Request-Method: POST

                                         
                                         87.250.251.119
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1728000
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
                                        
                                            GET /watch/25328195?wmode=5&callback=_ymjsp736949265&page-url=http%3A%2F%2Fcheckandswitch.com%2Fafile%2F7.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22noservice%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3A%221.1.0%22%7D&browser-info=ti%3A6%3Ati%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A60%3Ai%3A20190327100414%3Aet%3A1553677456%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A880172848559%3Arqn%3A1%3Arn%3A1026831474%3Ahid%3A897603841%3Agdpr%3A14%3Av%3A1505%3Arqnl%3A1%3Ast%3A1553677456%3Au%3A1553677455786321411%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%BD%D0%B5%20%D0%BE%D0%B1%D1%81%D0%BB%D1%83%D0%B6%D0%B8%D0%B2%D0%B0%D0%B5%D1%82%D1%81%D1%8F HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe

                                         
                                         87.250.251.119
HTTP/1.1 302 Found
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: yandexuid=7167153831553677455; Expires=Thu, 26-Mar-2020 09:04:15 GMT; Domain=.yandex.ru; Path=/ yabs-sid=658036821553677455; Path=/ i=VMiFJ3a28EqYsTU3UrYtjRnhyrmTCzIza1fauR5nNBQ6VcuQxKrnxcOYW1K7ixJTIX8e3Zn65MPRFwiXAsZ4LGzwkys=; Expires=Thu, 26-Mar-2020 09:04:15 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly yp=1585213455.yrts.1553677455#1585213455.yrtsi.1553677455; Expires=Sat, 24-Mar-2029 09:04:15 GMT; Domain=.yandex.ru; Path=/
Last-Modified: Wed, 27-Mar-2019 09:04:15 GMT
Expires: Wed, 27-Mar-2019 09:04:15 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
Location: /watch/25328195/1?wmode=5&callback=_ymjsp736949265&page-url=http%3A%2F%2Fcheckandswitch.com%2Fafile%2F7.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22noservice%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3A%221.1.0%22%7D&browser-info=ti%3A6%3Ati%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A60%3Ai%3A20190327100414%3Aet%3A1553677456%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A880172848559%3Arqn%3A1%3Arn%3A1026831474%3Ahid%3A897603841%3Agdpr%3A14%3Av%3A1505%3Arqnl%3A1%3Ast%3A1553677456%3Au%3A1553677455786321411%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%BD%D0%B5%20%D0%BE%D0%B1%D1%81%D0%BB%D1%83%D0%B6%D0%B8%D0%B2%D0%B0%D0%B5%D1%82%D1%81%D1%8F
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
                                        
                                            GET /watch/25328195/1?wmode=5&callback=_ymjsp736949265&page-url=http%3A%2F%2Fcheckandswitch.com%2Fafile%2F7.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22noservice%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3A%221.1.0%22%7D&browser-info=ti%3A6%3Ati%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A60%3Ai%3A20190327100414%3Aet%3A1553677456%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A880172848559%3Arqn%3A1%3Arn%3A1026831474%3Ahid%3A897603841%3Agdpr%3A14%3Av%3A1505%3Arqnl%3A1%3Ast%3A1553677456%3Au%3A1553677455786321411%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%BD%D0%B5%20%D0%BE%D0%B1%D1%81%D0%BB%D1%83%D0%B6%D0%B8%D0%B2%D0%B0%D0%B5%D1%82%D1%81%D1%8F HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe
Cookie: yandexuid=7167153831553677455; yabs-sid=658036821553677455; i=VMiFJ3a28EqYsTU3UrYtjRnhyrmTCzIza1fauR5nNBQ6VcuQxKrnxcOYW1K7ixJTIX8e3Zn65MPRFwiXAsZ4LGzwkys=; yp=1585213455.yrts.1553677455#1585213455.yrtsi.1553677455

                                         
                                         87.250.251.119
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 130
Connection: keep-alive
Last-Modified: Wed, 27-Mar-2019 09:04:15 GMT
Expires: Wed, 27-Mar-2019 09:04:15 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   130
Md5:    5116fbb5d53e32a44556327f08c302a9
Sha1:   7aaebee6ae613c49dc1de3989799e1658c6908dd
Sha256: 888d49603b0a67a0c596f60dc6cd8ca7a170a8680e70c7ed7439fa9048945748
                                        
                                            OPTIONS /watch/25328195/1?page-url=http%3A%2F%2Fcheckandswitch.com%2Fafile%2F7.exe&charset=utf-8&browser-info=ti%3A7%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Az%3A60%3Ai%3A20190327100415%3Aet%3A1553677456%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Als%3A880172848559%3Arqn%3A2%3Arn%3A176163221%3Ahid%3A897603841%3Agdpr%3A14%3Av%3A1505%3Arqnl%3A1%3Ast%3A1553677456%3Au%3A1553677455786321411 HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Origin: http://checkandswitch.com
Access-Control-Request-Method: POST

                                         
                                         87.250.251.119
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1728000
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
                                        
                                            GET /watch/25328195/1?page-url=http%3A%2F%2Fcheckandswitch.com%2Fafile%2F7.exe&charset=utf-8&site-info=%7B%22ads%22%3A%22between_video%22%7D&browser-info=ti%3A4%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Az%3A60%3Ai%3A20190327100415%3Aet%3A1553677456%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Als%3A880172848559%3Arqn%3A2%3Arn%3A176163221%3Ahid%3A897603841%3Agdpr%3A14%3Av%3A1505%3Arqnl%3A1%3Ast%3A1553677456%3Au%3A1553677455786321411 HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://checkandswitch.com/afile/7.exe
Cookie: yandexuid=7167153831553677455; yabs-sid=658036821553677455; i=VMiFJ3a28EqYsTU3UrYtjRnhyrmTCzIza1fauR5nNBQ6VcuQxKrnxcOYW1K7ixJTIX8e3Zn65MPRFwiXAsZ4LGzwkys=; yp=1585213455.yrts.1553677455#1585213455.yrtsi.1553677455

                                         
                                         87.250.251.119
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Server: nginx/1.12.2
Date: Wed, 27 Mar 2019 09:04:15 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Wed, 27-Mar-2019 09:04:15 GMT
Expires: Wed, 27-Mar-2019 09:04:15 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1
Size:   43
Md5:    df3e567d6f16d040326c7a0ea29a4f41
Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736
Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: checkandswitch.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: _ym_uid=1553677455786321411; _ym_d=1553677455; _ym_isad=2

                                         
                                         81.177.140.147
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Date: Wed, 27 Mar 2019 09:04:17 GMT
Content-Length: 601
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   601
Md5:    75cdbe4fca6284cb0594686b77df290f
Sha1:   89d1040474c933de70b75c44326f3e388987e65a
Sha256: 8fe09e2643eca67f25a431ccd015b8e7e5575e186c870967cee08ba07ee32541

Alerts:
  Blacklists:
    - mnemonic_dns: Blacklisted