Report - download.adguard-vpn.com/d/18672/adguardVPNInstaller.exe?exid=1ytngs21u6m80c08k0koco888

Report Overview

Visited public
2024-07-15 01:08:17
Tags
URL
download.adguard-vpn.com/d/18672/adguardVPNInstaller.exe?exid=1ytngs21u6m80c08k0koco888
Finishing URL
about:privatebrowsing
IP / ASN
104.18.27.239
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-14 18:12:33	2.3 kB	6.2 kB	23.36.77.32
download.adguard-vpn.com	unknown	2019-08-01	2022-06-07 06:59:18	2024-04-18 07:26:40	541 B	117 kB	104.18.26.239

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-07-15 01:08:00	high	59.93.182.125	Client IP	ET POLICY Executable and linking format (ELF) file download

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
download.adguard-vpn.com/d/18672/adguardVPNInstaller.exe?exid=1ytngs21u6m80c08k0koco888
IP
104.18.26.239
ASN
#13335 CLOUDFLARENET

File type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections
Size
116 kB (116256 bytes)
Hash
88f8ac371826f889e922b8ce8723e87c
255746a55a2bdc91a4e7a3e58031eeee7e039eb2
84ecb8b5211f64d2bd485b25cbc34bc28e908a339c99b087268d462fe15585b9

JavaScript (0)

HTTP Transactions (8)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 59f504b373ca5c60694d89699bf99f9d 98d3531909c87a27c1cedcda49b9450cb398bdc7 7cd67c1e38bf7cf396230f1f4ca4d83bd04fedd7d1258139ecfceda994200568 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "7CD67C1E38BF7CF396230F1F4CA4D83BD04FEDD7D1258139ECFCEDA994200568" Last-Modified: Sat, 13 Jul 2024 01:53:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15165 Expires: Mon, 15 Jul 2024 05:20:36 GMT Date: Mon, 15 Jul 2024 01:07:51 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 309bab809ca002395b203d83805fef51 d43bd0ccefdd620a33dea8eff957395c7373520b f724a88c585de4b49ac6a6b9109dbfd2ba10ecad612c1dc9cfad222ca18d0967 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "F724A88C585DE4B49AC6A6B9109DBFD2BA10ECAD612C1DC9CFAD222CA18D0967" Last-Modified: Sun, 14 Jul 2024 15:27:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6483 Expires: Mon, 15 Jul 2024 02:55:55 GMT Date: Mon, 15 Jul 2024 01:07:52 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 4a4d81b1c193182fe2b1122877e94203 fd1f4427cb5867a8f63ae15825279827bbf768e6 4cd1772d378248e886ee96f55d956ff0856ba3f2eae9f15a10136e68f450ca70 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "4CD1772D378248E886EE96F55D956FF0856BA3F2EAE9F15A10136E68F450CA70" Last-Modified: Fri, 12 Jul 2024 11:47:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2690 Expires: Mon, 15 Jul 2024 01:52:42 GMT Date: Mon, 15 Jul 2024 01:07:52 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 1069501beed320ba3e21b591ba8dc5ce 9e6b836cfea33a56e2e2598f27cb528578c8033c 568773d146699ebccbd5d393211720dd1b3d4eeb03bdfd8ad4d32c4720814c31 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "568773D146699EBCCBD5D393211720DD1B3D4EEB03BDFD8AD4D32C4720814C31" Last-Modified: Sun, 14 Jul 2024 16:21:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=2669 Expires: Mon, 15 Jul 2024 01:52:21 GMT Date: Mon, 15 Jul 2024 01:07:52 GMT Connection: keep-alive`

	download.adguard-vpn.com/d/18672/adguardVPNInstaller.exe?exid=1ytngs21u6m80c08k0koco888	104.18.26.239	200 OK	116 kB
URL User Request GET HTTP/2 download.adguard-vpn.com/d/18672/adguardVPNInstaller.exe?exid=1ytngs21u6m80c08k0koco888 IP 104.18.26.239:443 ASN #13335 CLOUDFLARENET Certificate IssuerZeroSSL Subject.adguard-vpn.com FingerprintC6:2C:6B:22:8A:6A:36:BD:16:B2:CD:2C:D5:4D:8C:73:CC:A3:59:A1 ValidityWed, 26 Jun 2024 00:00:00 GMT - Tue, 24 Sep 2024 23:59:59 GMT File type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections Size 116 kB (116256 bytes) Hash 88f8ac371826f889e922b8ce8723e87c 255746a55a2bdc91a4e7a3e58031eeee7e039eb2 84ecb8b5211f64d2bd485b25cbc34bc28e908a339c99b087268d462fe15585b9 HTTP Headers GET /d/18672/adguardVPNInstaller.exe?exid=1ytngs21u6m80c08k0koco888 HTTP/1.1 Host: download.adguard-vpn.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 200 OK date: Mon, 15 Jul 2024 01:07:52 GMT content-type: application/x-msdos-program content-length: 116256 cf-ray: 8a35dbad59130b06-OSL cf-cache-status: HIT accept-ranges: bytes age: 3027 cache-control: public, max-age=14400 expires: Mon, 15 Jul 2024 05:07:52 GMT last-modified: Thu, 04 Jul 2024 18:06:07 GMT vary: Accept-Encoding content-security-policy: frame-src 'self' .adguard.com .adguard-vpn.com .adguard-dns.com .adguard-dns.io .hcaptcha.com server: cloudflare X-Firefox-Spdy: h2`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 80ee007415e4a9cd9ff180ee56d4fd90 08276896e8774d12a699400ffe88939d02acd056 b76186c793cde690af253f9096553d00dffd54dc33faf5b9a7059b5ce61de651 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "B76186C793CDE690AF253F9096553D00DFFD54DC33FAF5B9A7059B5CE61DE651" Last-Modified: Sat, 13 Jul 2024 05:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3081 Expires: Mon, 15 Jul 2024 01:59:15 GMT Date: Mon, 15 Jul 2024 01:07:54 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 80ee007415e4a9cd9ff180ee56d4fd90 08276896e8774d12a699400ffe88939d02acd056 b76186c793cde690af253f9096553d00dffd54dc33faf5b9a7059b5ce61de651 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "B76186C793CDE690AF253F9096553D00DFFD54DC33FAF5B9A7059B5CE61DE651" Last-Modified: Sat, 13 Jul 2024 05:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3081 Expires: Mon, 15 Jul 2024 01:59:15 GMT Date: Mon, 15 Jul 2024 01:07:54 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 80ee007415e4a9cd9ff180ee56d4fd90 08276896e8774d12a699400ffe88939d02acd056 b76186c793cde690af253f9096553d00dffd54dc33faf5b9a7059b5ce61de651 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "B76186C793CDE690AF253F9096553D00DFFD54DC33FAF5B9A7059B5CE61DE651" Last-Modified: Sat, 13 Jul 2024 05:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3081 Expires: Mon, 15 Jul 2024 01:59:15 GMT Date: Mon, 15 Jul 2024 01:07:54 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

JavaScript (0)

HTTP Transactions (8)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers