Report - bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/app.exe

Report Overview

Submitted URL
bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/app.exe
IP
104.18.41.40
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-20 14:35:22
Access
public
Website Title
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
2
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link	unknown	unknown	No data	No data	1.3 kB	59 MB	172.64.146.216
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-19	512 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-20 14:34:47	low	Client IP	172.64.146.216	ET INFO Observed IPFS File Service Domain in TLS SNI (nftstorage .link)
2024-04-20 14:34:50	low	Client IP	172.64.146.216	ET INFO Observed IPFS File Service Domain in TLS SNI (nftstorage .link)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/app.exe
IP
172.64.146.216
ASN
#13335 CLOUDFLARENET

File type
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
Size
59 MB (58829498 bytes)
Hash
317f635374371bb4179ba25fc3fb0cf9
cf94a6a3de6f27b8e4e4c81a570a6eb6086dd9e4
05c2ff9b9f02b9ff921bc3f510d6014842d141e83a7130f910aceebbabc501a9

JavaScript (1)

		Size	First Seen	Last Seen
	#1 Eval - d41d8cd98f00b204e9800998ecf8427e	0 B	2023-03-07	2024-05-04
Pretty Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 00:01:35 Times Seen37319225 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (4)

	URL	IP	Response	Size
	bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/	172.64.146.216		167 B
URL bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/ IP 172.64.146.216:0 ASN #13335 CLOUDFLARENET File type HTML document, ASCII text, with CRLF line terminators Size 167 B (167 bytes) Hash 0104c301c5e02bd6148b8703d19b3a73 7436e0b4b1f8c222c38069890b75fa2baf9ca620 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f HTTP Headers `GET / HTTP/1.1 Host: bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 301 Moved Permanently Date: Sat, 20 Apr 2024 14:34:50 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Sat, 20 Apr 2024 15:34:50 GMT Location: https://bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/ Vary: Accept-Encoding Server: cloudflare CF-RAY: 8775db7fde7c0b06-OSL`

	bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/	172.64.146.216		11 kB
URL bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/ IP 172.64.146.216:0 ASN #13335 CLOUDFLARENET File type HTML document, Unicode text, UTF-8 text, with very long lines (1597) Size 11 kB (11227 bytes) Hash 1ce966db807161831887fa1343c5bc07 6667c3b6bab972efd3160baa444818c363cb784e 0a069eec0a842b8686498e26e10bc7cdd072cc3f13201d536fcf7bd279231f3a HTTP Headers `GET / HTTP/1.1 Host: bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK date: Sat, 20 Apr 2024 14:34:51 GMT content-type: text/html cf-ray: 8775db801cb6568d-OSL access-control-allow-origin: * etag: W/"DirIndex-gateway-lib@2.0.2_CID-bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli" vary: Accept-Encoding access-control-allow-methods: GET access-control-expose-headers: Link content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://.w3s.link https://.nftstorage.link https://.dweb.link https://ipfs.io/ipfs/ https://.githubusercontent.com https://polygon-rpc.com https://rpc.testnet.fantom.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://.w3s.link https://.nftstorage.link https://.dweb.link https://ipfs.io/ipfs/ https://.githubusercontent.com https://polygon-rpc.com https://rpc.testnet.fantom.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage reporting-endpoints: csp-endpoint="https://csp-report-to.web3.storage" server-timing: request;dur=979 x-dotstorage-anchor: b9fdc0a4937360352253874a69a5ab4caa9b5e573b7916246e3488f470f9e92b x-dotstorage-resolution-id: https://freeway.dag.haus x-dotstorage-resolution-layer: dotstorage-race x-freeway-version: 2.15.0 server: cloudflare content-encoding: br X-Firefox-Spdy: h2

	aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml	35.244.181.201		444 B
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP 35.244.181.201:0 ASN #396982 GOOGLE-CLOUD-PLATFORM File type XML 1.0 document, ASCII text, with very long lines (332) Size 444 B (444 bytes) Hash 3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463 HTTP Headers `GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site` HTTP/2 200 OK server: nginx rule-id: unknown rule-data-version: unknown content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=QbFAUG1c718XO6tdF4gChI4ekTHfn0pFdf8sKSFIJZ-v_Y-SIlHpk2YgkWFh0JKAsBQ3d1h-O4O_scD4SHFOW1_EhhC8xuYIUGZYq0Jpl5qoUqvgxB1hKkBmXRfVOQGt strict-transport-security: max-age=31536000; x-content-type-options: nosniff content-security-policy: default-src 'none'; frame-ancestors 'none' x-proxy-cache-status: EXPIRED content-encoding: gzip via: 1.1 google date: Sat, 20 Apr 2024 14:35:05 GMT content-type: text/xml; charset=utf-8 vary: Accept-Encoding content-length: 444 age: 1 cache-control: public,max-age=90 alt-svc: clear X-Firefox-Spdy: h2

	bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/app.exe	172.64.146.216		59 MB
URL User Request GET bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link/app.exe IP 172.64.146.216:0 ASN #13335 CLOUDFLARENET Certificate IssuerLet's Encrypt Subjectnftstorage.link Fingerprint9B:66:BA:52:EF:53:AB:A1:89:67:FE:91:A2:0B:1C:23:C3:66:CB:19 ValiditySat, 13 Apr 2024 08:26:05 GMT - Fri, 12 Jul 2024 08:26:04 GMT File type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections Size 59 MB (58829498 bytes) Hash 317f635374371bb4179ba25fc3fb0cf9 cf94a6a3de6f27b8e4e4c81a570a6eb6086dd9e4 05c2ff9b9f02b9ff921bc3f510d6014842d141e83a7130f910aceebbabc501a9 HTTP Headers GET /app.exe HTTP/1.1 Host: bafybeiehidstdgskosvpuygy7hr6vxlkmjojbhvu7hnmjgnh6uw3dwicli.ipfs.nftstorage.link User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK date: Sat, 20 Apr 2024 14:35:01 GMT content-type: application/octet-stream content-length: 58829498 cf-ray: 8775db6d9c0f56b5-OSL access-control-allow-origin: * cache-control: public, max-age=29030400, immutable etag: "bafybeig5qncttx4yo2i6leewzdocniuucqllu3zhnf232wacnjdnsqzela" vary: Accept-Encoding access-control-allow-methods: GET access-control-expose-headers: Link content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://.w3s.link https://.nftstorage.link https://.dweb.link https://ipfs.io/ipfs/ https://.githubusercontent.com https://polygon-rpc.com https://rpc.testnet.fantom.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://.w3s.link https://.nftstorage.link https://.dweb.link https://ipfs.io/ipfs/ https://.githubusercontent.com https://polygon-rpc.com https://rpc.testnet.fantom.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage reporting-endpoints: csp-endpoint="https://csp-report-to.web3.storage" server-timing: request;dur=14000 x-dotstorage-anchor: b9fdc0a4937360352253874a69a5ab4caa9b5e573b7916246e3488f470f9e92b x-dotstorage-resolution-id: https://freeway.dag.haus x-dotstorage-resolution-layer: dotstorage-race x-freeway-version: 2.15.0 server: cloudflare X-Firefox-Spdy: h2