Report - perfilcovid.com/cache/news.php?32','xgaFA','LRMOa','ponseText','8lrbEce','res','Wzrdi','split','return

Report Overview

Visited public
2023-12-07 22:36:08
Tags
URL
perfilcovid.com/cache/news.php?32','xgaFA','LRMOa','ponseText','8lrbEce','res','Wzrdi','split','return
Finishing URL
about:privatebrowsing
IP / ASN
188.127.231.227
#56694 LLC Smart Ape
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
perfilcovid.com	unknown	2020-12-29	2021-01-23 21:43:03	2023-12-07 16:47:24	600 B	112 kB	188.127.231.227

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-07 22:35:57	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-12-07 22:35:57	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-12-07 22:35:57	medium	Client IP	Internal IP	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1
2023-12-07 22:35:57	medium	Client IP	188.127.231.227	ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2023-12-07	medium	perfilcovid.com	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-12-07	medium	perfilcovid.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

perfilcovid.com/cache/news.php?32%27,%27xgaFA%27,%27LRMOa%27,%27ponseText%27,%278lrbEce%27,%27res%27,%27Wzrdi%27,%27split%27,%27return

188.127.231.227

200 OK

112 kB

URL User Request GET HTTP/1.1
perfilcovid.com/cache/news.php?32%27,%27xgaFA%27,%27LRMOa%27,%27ponseText%27,%278lrbEce%27,%27res%27,%27Wzrdi%27,%27split%27,%27return
IP
188.127.231.227:443
ASN
#56694 LLC Smart Ape

Certificate
IssuerLet's Encrypt
Subjectperfilcovid.com
FingerprintAA:01:CE:D5:92:2C:E6:B2:0A:FC:F3:28:32:C0:50:4C:76:66:8B:52
ValidityMon, 04 Dec 2023 13:34:07 GMT - Sun, 03 Mar 2024 13:34:06 GMT

File type
ASCII text, with very long lines (18420), with CRLF line terminators
Size
112 kB (111946 bytes)
Hash
b1bd4ff7b5753e3f2f1c03a363510c9c
f78f58c45bbed5fd9267e8310efe39d8ff357427
8dc3e4e8c26f25b26d21a5c1fd88f6382dd6e003756cda698a151e22959125ee

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cache/news.php?32%27,%27xgaFA%27,%27LRMOa%27,%27ponseText%27,%278lrbEce%27,%27res%27,%27Wzrdi%27,%27split%27,%27return HTTP/1.1
Host: perfilcovid.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 07 Dec 2023 22:35:51 GMT
Content-Type: application/octet-stream
Content-Length: 111946
Connection: keep-alive
Content-Description: File Transfer
Content-Disposition: attachment; filename=Chrome_update.js
Content-Transfer-Encoding: binary
Expires: 0
Cache-Control: must-revalidate
Pragma: public
Access-Control-Allow-Origin: *

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers