Report - acm.eim.ebill.dancetrader.com/iwceti.zip

Report Overview

Visited public
2024-12-30 03:17:58
Tags
Submit Tags
URL
acm.eim.ebill.dancetrader.com/iwceti.zip
Finishing URL
about:privatebrowsing
IP / ASN
203.210.102.72
#63956 5G NETWORK OPERATIONS PTY LTD
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
acm.eim.ebill.dancetrader.com	unknown	unknown	2024-12-30	2024-12-30	494 B	309 kB	203.210.102.72

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
acm.eim.ebill.dancetrader.com/iwceti.zip
IP
203.210.102.72
ASN
#63956 5G NETWORK OPERATIONS PTY LTD

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
309 kB (308847 bytes)
Hash
9c1315e9445bce83e5e9ede133f71630
b542f7152771fa077b5db4b5640013ab4ea6e127
4ed8ccfc4ec5d140a6afef40f4a425595db0894263685e3ab5886974bdb9cb80

Archive (9)

Modified	Filename	Size	Md5	File type
2017-06-03 06:07	analytics.js	26 kB	eed8ec65a6dd9b05eed6d4a02e1439e4	JavaScript source, ASCII text, with very long lines (1703)
2017-06-03 06:07	background.png	199 kB	ae58491f8892486e114d20436e8d396e	PNG image data, 1680 x 1050, 8-bit/color RGBA, non-interlaced
2017-06-03 06:07	blank.gif	43 B	6d22e4f2d2057c6e8d6fab098e76e80f	GIF image data, version 89a, 1 x 1
2017-06-03 06:07	dojo.js	310 kB	ee3e48681e60c7d2679d10b7b3491aba	JavaScript source, ASCII text, with very long lines (65122)
2017-06-03 06:07	greyband.jpg	458 B	b19c7e45fea073e656888325da7f94d6	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 406x30, components 3
2017-06-03 06:07	login.css	6.5 kB	8d5719ca3df0105f08ec17893139ba7d	ASCII text, with very long lines (335), with CRLF, LF line terminators
2017-06-03 06:07	mail.jpg	1.9 kB	75e76695c7d3b0bac879dbab1179dbc8	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 75x75, components 3
2017-06-03 06:07	myetisalat.html	9.4 kB	3de6449b2e4eef6ecf7820d36ec806e4	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (842), with CRLF line terminators
2017-09-06 12:38	post.php	689 B	7210754e7b0cf4ca0b76c615b6f80531	HTML document, ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/59

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET acm.eim.ebill.dancetrader.com/iwceti.zip

203.210.102.72

200 OK

309 kB

URL User Request GET HTTP/2
acm.eim.ebill.dancetrader.com/iwceti.zip
IP
203.210.102.72:443
ASN
#63956 5G NETWORK OPERATIONS PTY LTD

Certificate
IssuerLet's Encrypt
Subjectmail.dancetrader.com
Fingerprint2E:7C:5D:71:20:00:11:65:10:45:85:52:F9:85:09:A9:52:AB:50:2F
ValidityMon, 16 Dec 2024 12:34:24 GMT - Sun, 16 Mar 2025 12:34:23 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
309 kB (308847 bytes)
Hash
9c1315e9445bce83e5e9ede133f71630
b542f7152771fa077b5db4b5640013ab4ea6e127
4ed8ccfc4ec5d140a6afef40f4a425595db0894263685e3ab5886974bdb9cb80

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/59

HTTP Headers

GET /iwceti.zip HTTP/1.1
Host: acm.eim.ebill.dancetrader.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Mon, 30 Dec 2024 03:17:34 GMT
content-type: application/zip
content-length: 308847
last-modified: Tue, 10 Oct 2017 19:34:13 GMT
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (9)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers