Report - 529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt

Report Overview

Visited public
2023-09-21 21:09:52
Tags
URL
529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt
Finishing URL
529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt
IP / ASN
54.230.111.49
#16509 AMAZON-02
Title
529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt

Detections

urlquery

0

Network Intrusion Detection

1

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.sectigo.com	487	2018-08-16	2019-11-29 12:50:24	2023-09-21 07:52:14	660 B	1.9 kB	104.18.14.101
529f38d0-3744-4286-b484be860d475d25.usrfiles.com	unknown	2013-05-26	2023-07-31 19:32:03	2023-09-08 16:25:06	1.5 kB	1.8 kB	54.230.111.92

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-21 21:09:48	medium	Client IP	192.169.69.26	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (5)

	URL	IP	Response	Size
	ocsp.sectigo.com/	104.18.14.101		472 B
URL ocsp.sectigo.com/ IP 104.18.14.101:0 ASN #13335 CLOUDFLARENET File type data Size 472 B (472 bytes) Hash 5c96a7c78bc3a8c78be68f3c75f30e5b 85a9c44ffe364c302ac6e1d5532f4b6678aa6739 e50e0813a495dcb7f9d04a5c1e1f88a0f26439564e11430ea198a9399d6ce592 HTTP Headers `POST / HTTP/1.1 Host: ocsp.sectigo.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Thu, 21 Sep 2023 21:09:36 GMT Content-Type: application/ocsp-response Content-Length: 472 Connection: keep-alive Last-Modified: Thu, 21 Sep 2023 01:46:36 GMT Expires: Thu, 28 Sep 2023 01:46:35 GMT Etag: "85a9c44ffe364c302ac6e1d5532f4b6678aa6739" Cache-Control: max-age=535039,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb4 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 80a54a43cabb56c7-OSL`

	529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt	54.230.111.92	403 Forbidden	9 B
URL User Request GET HTTP/1.1 529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt IP 54.230.111.92:80 ASN #16509 AMAZON-02 File type ASCII text, with no line terminators Size 9 B (9 bytes) Hash 722969577a96ca3953e84e3d949dee81 3dab5f6012e3e149b5a939b9cebba4a0b84dc8f5 78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3 HTTP Headers GET /ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt HTTP/1.1 Host: 529f38d0-3744-4286-b484be860d475d25.usrfiles.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 403 Forbidden content-type: text/plain content-length: 9 server: openresty/1.21.4.1 date: Thu, 21 Sep 2023 21:09:36 GMT access-control-allow-origin: * cache-control: no-cache, private, must-revalidate, proxy-revalidate, no-store timing-allow-origin: * x-seen-by: gcp.us-central-1.media-router-f89dc7b48-frmcg via: 1.1 google, 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront) x-cache: Error from cloudfront x-amz-cf-pop: OSL50-P1 alt-svc: h3=":443"; ma=86400 x-amz-cf-id: S5XBNobgh45KG3Kntcs5oWOYGbO1U-_80IdlqUQ9o63AsF4ALaE1kQ== X-Firefox-Spdy: h2

	529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt	54.230.111.109	403 Forbidden	9 B
URL User Request GET HTTP/1.1 529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt IP 54.230.111.109:80 ASN #16509 AMAZON-02 File type ASCII text, with no line terminators Size 9 B (9 bytes) Hash 722969577a96ca3953e84e3d949dee81 3dab5f6012e3e149b5a939b9cebba4a0b84dc8f5 78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3 HTTP Headers `GET /ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt HTTP/1.1 Host: 529f38d0-3744-4286-b484be860d475d25.usrfiles.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 403 Forbidden Content-Type: text/plain Content-Length: 9 Connection: keep-alive Server: openresty/1.21.4.1 Date: Thu, 21 Sep 2023 21:09:36 GMT Access-Control-Allow-Origin: * Cache-Control: no-cache, private, must-revalidate, proxy-revalidate, no-store Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-f89dc7b48-hbqlm Via: 1.1 google, 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront) X-Cache: Error from cloudfront X-Amz-Cf-Pop: OSL50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: dOJaExCMmAUFtts5r31kZcw2hjB_0VBy5R467RswSCx-cGpQsSMuNg==

	ocsp.sectigo.com/	104.18.15.101		472 B
URL ocsp.sectigo.com/ IP 104.18.15.101:0 ASN #13335 CLOUDFLARENET File type data Size 472 B (472 bytes) Hash 5c96a7c78bc3a8c78be68f3c75f30e5b 85a9c44ffe364c302ac6e1d5532f4b6678aa6739 e50e0813a495dcb7f9d04a5c1e1f88a0f26439564e11430ea198a9399d6ce592 HTTP Headers `POST / HTTP/1.1 Host: ocsp.sectigo.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Thu, 21 Sep 2023 21:09:37 GMT Content-Type: application/ocsp-response Content-Length: 472 Connection: keep-alive Last-Modified: Thu, 21 Sep 2023 01:46:36 GMT Expires: Thu, 28 Sep 2023 01:46:35 GMT Etag: "85a9c44ffe364c302ac6e1d5532f4b6678aa6739" Cache-Control: max-age=534418,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb6 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 80a54a485a1a568b-OSL`

	529f38d0-3744-4286-b484be860d475d25.usrfiles.com/favicon.ico	54.230.111.109	403 Forbidden	9 B
URL GET HTTP/1.1 529f38d0-3744-4286-b484be860d475d25.usrfiles.com/favicon.ico IP 54.230.111.109:80 ASN #16509 AMAZON-02 Requested by http://529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt File type ASCII text, with no line terminators Size 9 B (9 bytes) Hash 722969577a96ca3953e84e3d949dee81 3dab5f6012e3e149b5a939b9cebba4a0b84dc8f5 78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3 HTTP Headers `GET /favicon.ico HTTP/1.1 Host: 529f38d0-3744-4286-b484be860d475d25.usrfiles.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: http://529f38d0-3744-4286-b484be860d475d25.usrfiles.com/ugd/529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.txt Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 403 Forbidden Content-Type: text/plain Content-Length: 9 Connection: keep-alive Server: openresty/1.21.4.1 Date: Thu, 21 Sep 2023 21:09:37 GMT Access-Control-Allow-Origin: * Cache-Control: no-cache, private, must-revalidate, proxy-revalidate, no-store Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-f89dc7b48-l67df Via: 1.1 google, 1.1 784cb0c259a6d79800d037bda4e7de86.cloudfront.net (CloudFront) X-Cache: Error from cloudfront X-Amz-Cf-Pop: OSL50-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: u4_j9QgO8W65tsVE0oN5gl0hHkGHpprfsoWrJTmZkBMI5e3yyRaBFQ==