Overview

URL103.133.104.112/pj/pjpjpjpjp%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23pjpjp.doc
IP 103.133.104.112 (Vietnam)
ASN#135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-26 05:45:54 UTC
StatusLoading report..
IDS alerts1
Blocklist alert2
urlquery alerts No alerts detected
Tags None

Domain Summary (1)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
103.133.104.112 (1) 0 No data No data 505 21558 103.133.104.112

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-05-26 05:45:38 UTC medium Client IP  103.133.104.112 ET INFO Dotted Quad Host DOC Request 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-26 medium 103.133.104.112/pj/pjpjpjpjp%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%2 (...) Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2023-05-25 medium 103.133.104.112 Sinkholed

ThreatFox
 No alerts detected

Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports on ASN: VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-05 16:42:56 UTC 0 - 1 - 1 14.225.254.203/ 14.225.254.203
2023-06-05 16:23:29 UTC 0 - 0 - 2 103.140.251.122/ 103.140.251.122


Last 5 reports on domain: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 07:24:23 UTC 2 - 2 - 1 117.221.183.72:42658/bin.sh 117.221.183.72
2023-06-06 07:24:19 UTC 0 - 2 - 0 www7.edowning.net/down/cfjl.rar 111.177.11.113
2023-06-06 07:23:37 UTC 2 - 8 - 1 223.151.225.220:53094/bin.sh 223.151.225.220
2023-06-06 07:21:51 UTC 0 - 3 - 0 bxzdgx.test.upcdn.net/HJCQ.exe 150.138.39.137
2023-06-06 07:21:41 UTC 0 - 2 - 1 103.160.3.10/bins/Astro.arm5 103.160.3.10

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (1)


Request Response
 
                                        
                                            GET /pj/pjpjpjpjp%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23pjpjp.doc HTTP/1.1 

                                        
                                            
Host: 103.133.104.112 

                                        
                                    
                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
DNT: 1 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
 

                                        
                                    
                                        
                                             103.133.104.112

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/msword 

                                            
                                            
                                            

                                            
                                                
Date: Fri, 26 May 2023 05:45:44 GMT 

                                            
                                                
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 

                                            
                                                
Last-Modified: Thu, 25 May 2023 15:47:26 GMT 

                                            
                                                
ETag: "52f6-5fc86898b9b4e" 

                                            
                                                
Accept-Ranges: bytes 

                                            
                                                
Content-Length: 21238 

                                            
                                                
Keep-Alive: timeout=5, max=100 

                                            
                                                
Connection: Keep-Alive 

                                            
                                                
 

                                            
                                            

                                                

                                                --- Additional Info ---

                                                Magic:  Rich Text Format data, version 1\012- , ISO-8859 text, with very long lines (2751), with CR, LF line terminators

                                                Size:   21238

                                                Md5:    8a5ebebcd8f684d227ba49c392c1654b

                                                Sha1:   6b4c0ccc81a9ef5cd459d98debc2bf9abf89b28f

                                                Sha256: 9462785dd170017ef511412a946a9019b59ae84d7e8fc6758cbdbe94054c5e6a

                                        

                                        
                                            

                                            

                                            
                                                Blocklists:

                                                
                                                      - fortinet: Malware

                                                
                                                      - quad9: Sinkholed

                                                
                                            
                                            
                                            
                                                IDS:

                                                
                                                          - ET INFO Dotted Quad Host DOC Request