Report - 112.199.121.83/download/Req%20for%20Employer%20Accre.zip

Report Overview

Submitted URL
112.199.121.83/download/Req%20for%20Employer%20Accre.zip
IP
112.199.121.83
ASN
#9658 Eastern Telecoms Phils., Inc.
Submitted
2024-04-19 09:44:28
Access
public
Website Title
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
112.199.121.83	unknown	unknown	No data	No data	691 B	50 kB	112.199.121.83
www.ywacorp.com	unknown	2007-05-19	2018-05-25	2023-06-01	266 B	17 kB	112.199.121.82

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-19 09:43:56	medium	Client IP	112.199.121.83	ET INFO Dotted Quad Host ZIP Request

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-19	medium	112.199.121.83	Sinkholed
2024-04-19	medium	112.199.121.83	Sinkholed

ThreatFox

No alerts detected

Files detected

URL
112.199.121.83/download/Req%20for%20Employer%20Accre.zip
IP
112.199.121.83
ASN
#9658 Eastern Telecoms Phils., Inc.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
50 kB (49539 bytes)
Hash
15abdf532641a52214ee77313f74d8da
f908d32918145fdc44c75f2e683cd879d33b0ccf
9fb889135f884110cef5402be94e5161ec44762ed7c393e42076c715d65716d6

Archive (5)

Modified	Filename	Size	Md5	File type
2012-05-24 15:35	CONTINGENCY PLAN TEMPLATE FOR MIDDLE EAST COUNTRIES.doc	30 kB	f9ec360c83135633e8f354231920bde4	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: IO, Template: Normal, Last Saved By: USER, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Last Printed: Wed Sep 28 06:25:00 2011, Create Time/Date: Wed May 23 07:01:00 2012, Last Saved Time/Date: Wed May 23 07:01:00 2012, Number of Pages: 1, Number of Words: 204, Number of Characters: 1169, Security: 0
2012-05-24 15:35	EMPLOYMENT CONTRACT FOR VARIOUS SKILLS.pdf	12 kB	6be1e7d7e63ce6befb9429a18509bc5d	PDF document, version 1.5 (zip deflate encoded)
2012-05-24 15:35	JOB ORDER TEMPLATE.doc	31 kB	bd99c95a627521e7612550a14051282b	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: June 22, 2004, Author: Administration, Template: Normal, Last Saved By: USER, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 09:00, Last Printed: Thu Apr 26 01:37:00 2007, Create Time/Date: Wed May 23 07:00:00 2012, Last Saved Time/Date: Wed May 23 07:03:00 2012, Number of Pages: 1, Number of Words: 121, Number of Characters: 692, Security: 0
2012-05-24 15:35	POEA Documentary Requirements for Employer Accreditation.doc	49 kB	987d1b86277d2a614d088d6850186052	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Author: Anna, Template: Normal, Last Saved By: USER, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 08:00, Last Printed: Thu Jul 8 04:35:00 2010, Create Time/Date: Wed May 23 08:02:00 2012, Last Saved Time/Date: Wed May 23 08:02:00 2012, Number of Pages: 1, Number of Words: 105, Number of Characters: 602, Security: 0
2012-05-24 15:35	SPECIAL POWER OF ATTORNEY TEMPLATE.doc	29 kB	d94397f1ffdd338663ce5983b0e257cc	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: SPECIAL POWER OF ATTORNEY, Author: Administration, Template: Normal, Last Saved By: USER, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Last Printed: Mon Jul 13 06:20:00 2009, Create Time/Date: Wed May 23 07:14:00 2012, Last Saved Time/Date: Wed May 23 07:14:00 2012, Number of Pages: 1, Number of Words: 316, Number of Characters: 1804, Security: 0

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

112.199.121.83/

112.199.121.83

3 B

URL
112.199.121.83/
IP
112.199.121.83:0
ASN
#9658 Eastern Telecoms Phils., Inc.

File type
Unicode text, UTF-8 text, with no line terminators
Size
3 B (3 bytes)
Hash
ecaa88f7fa0bf610a5a26cf545dcd3aa
57218c316b6921e2cd61027a2387edc31a2d9471
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 112.199.121.83
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 19 Apr 2024 09:43:41 GMT
Server: Apache/2.2.22 (Win32) PHP/5.4.3
X-Powered-By: PHP/5.4.3
Location: http://www.ywacorp.com/
Content-Length: 3
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

www.ywacorp.com/

112.199.121.82

17 kB

URL
www.ywacorp.com/
IP
112.199.121.82:0
ASN
#9658 Eastern Telecoms Phils., Inc.

File type
HTML document, ASCII text, with very long lines (759), with CRLF line terminators
Size
17 kB (16872 bytes)
Hash
ac005ba96886355884783f7a4cff8671
7ea63b9314920dd359e671f19f499a5ec044ea02
57fefd4f1e992b331b76b2149e45a223d5a5715397277ff81318ba220f9cbfd7

HTTP Headers

GET / HTTP/1.1
Host: www.ywacorp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 19 Apr 2024 09:44:09 GMT
Server: Apache/1.3.27 (Win32) PHP/4.2.3
X-Powered-By: PHP/4.2.3
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

112.199.121.83/download/Req%20for%20Employer%20Accre.zip

112.199.121.83

50 kB

URL
112.199.121.83/download/Req%20for%20Employer%20Accre.zip
IP
112.199.121.83:0
ASN
#9658 Eastern Telecoms Phils., Inc.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
50 kB (49539 bytes)
Hash
15abdf532641a52214ee77313f74d8da
f908d32918145fdc44c75f2e683cd879d33b0ccf
9fb889135f884110cef5402be94e5161ec44762ed7c393e42076c715d65716d6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO Dotted Quad Host ZIP Request

HTTP Headers

GET /download/Req%20for%20Employer%20Accre.zip HTTP/1.1
Host: 112.199.121.83
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 19 Apr 2024 09:43:43 GMT
Server: Apache/2.2.22 (Win32) PHP/5.4.3
Last-Modified: Thu, 24 May 2012 08:17:14 GMT
ETag: "8000000003dd0-c183-4c0c3e1145e81"
Accept-Ranges: bytes
Content-Length: 49539
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/zip

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (5)

JavaScript (0)

HTTP Transactions (3)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers