Report - wcompsys.co.uk/down/PSA5_608D_Install.zip

Report Overview

Visited public
2023-09-26 09:49:30
Tags
URL
wcompsys.co.uk/down/PSA5_608D_Install.zip
Finishing URL
about:privatebrowsing
IP / ASN
107.180.2.34
#26496 AS-26496-GO-DADDY-COM-LLC
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

1

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
wcompsys.co.uk	unknown	2002-05-29	2015-04-07 14:31:18	2023-05-10 22:50:23	413 B	46 MB	107.180.2.34
ocsp.starfieldtech.com	6616	2003-03-06	2012-06-22 20:08:50	2023-09-25 19:57:24	336 B	2.7 kB	192.124.249.36

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-26 09:49:17	medium	Client IP	192.169.69.25	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
wcompsys.co.uk/down/PSA5_608D_Install.zip
IP
107.180.2.34
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type
Zip archive data, at least v2.0 to extract, compression method=deflate\012- data
Size
46 MB (46234835 bytes)
Hash
d019defba5cca5635bb26cb9e05a65e4
cbcd449204b1a11c1fb3d42233906e4605d8816b
a7f1431b259238540e06e6caa6051f408a8463ec6e899e8f77eecda85ba58a64

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	ocsp.starfieldtech.com/	192.124.249.36		2.1 kB
URL ocsp.starfieldtech.com/ IP 192.124.249.36:0 ASN #30148 SUCURI-SEC File type data Size 2.1 kB (2149 bytes) Hash b771596f8471a77bd9420c101b9826a7 67eb15ad1994e534df766984c3e795d1abc0755a 5f0b5770225133f7cb5a4848ef33ac40a82d665336452145f10a32906b1e007b HTTP Headers `POST / HTTP/1.1 Host: ocsp.starfieldtech.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 76 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Tue, 26 Sep 2023 09:49:13 GMT Content-Type: application/ocsp-response Content-Length: 2149 Connection: keep-alive X-Sucuri-ID: 19036 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Mon, 25 Sep 2023 17:19:41 GMT Expires: Tue, 26 Sep 2023 17:19:41 GMT ETag: "67eb15ad1994e534df766984c3e795d1abc0755a" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"`

	wcompsys.co.uk/down/PSA5_608D_Install.zip	107.180.2.34		46 MB
URL User Request GET wcompsys.co.uk/down/PSA5_608D_Install.zip IP 107.180.2.34:0 ASN #26496 AS-26496-GO-DADDY-COM-LLC File type Zip archive data, at least v2.0 to extract, compression method=deflate\012- data Size 46 MB (46234835 bytes) Hash d019defba5cca5635bb26cb9e05a65e4 cbcd449204b1a11c1fb3d42233906e4605d8816b a7f1431b259238540e06e6caa6051f408a8463ec6e899e8f77eecda85ba58a64 HTTP Headers `GET /down/PSA5_608D_Install.zip HTTP/1.1 Host: wcompsys.co.uk User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Tue, 26 Sep 2023 09:49:13 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Wed, 14 Dec 2022 15:00:59 GMT ETag: "3a0001-2c17cd3-5efcb01176c3d" Accept-Ranges: bytes Content-Length: 46234835 Vary: Accept-Encoding Keep-Alive: timeout=5 Content-Type: application/zip`