Report - pkgs.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi

Report Overview

Submitted URL
pkgs.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi
IP
199.38.181.239
ASN
#36236 NETACTUATE
Submitted
2024-05-09 02:34:53
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pkgs.tailscale.com	406879	2017-08-15	2020-03-16	2024-05-07	512 B	362 B	199.38.181.239
dl.tailscale.com	unknown	2017-08-15	2023-08-25	2024-05-06	510 B	1.6 MB	109.105.218.17

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-05-09	medium	dl.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi	Detect files is `SliverFox` malware

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
dl.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi
IP
109.105.218.17
ASN
#40509 FLY

File type
Composite Document File V2 Document, Can't read SAT
Size
1.6 MB (1577357 bytes)
Hash
286edeee77cf9da4e080c8f970e5e79a
2a42661fbaadb68b6b3a01d8d239356bc55803c6
36ae7ebb77e49ca6ef401e4f93a8562ade2d6d760e74b43dc25721765196e1c5

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

pkgs.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi

199.38.181.239

302 Found

87 B

URL User Request GET HTTP/2
pkgs.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi
IP
199.38.181.239:443
ASN
#36236 NETACTUATE

Certificate
IssuerLet's Encrypt
Subjectpkgs.tailscale.com
FingerprintAE:2F:AE:BE:11:79:24:4F:98:20:C1:AB:B1:9B:5B:8E:CD:1F:60:6B
ValidityMon, 18 Mar 2024 11:55:43 GMT - Sun, 16 Jun 2024 11:55:42 GMT

File type
HTML document, ASCII text
Size
87 B (87 bytes)
Hash
a72961310716bbb39e8026808a9e87ee
5dbbc39361b1dff8fb2af7542a5a49d756456736
962eeab688eaf37dcdff840869b940672a4372091a14650c11b9e2459d2434c4

HTTP Headers

GET /stable/tailscale-setup-1.66.0-amd64.msi HTTP/1.1
Host: pkgs.tailscale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: text/html; charset=utf-8
location: https://dl.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi
strict-transport-security: max-age=63072000; includeSubDomains
content-length: 87
date: Thu, 09 May 2024 02:34:28 GMT
X-Firefox-Spdy: h2

dl.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi

109.105.218.17

200 OK

1.6 MB

URL User Request GET HTTP/2
dl.tailscale.com/stable/tailscale-setup-1.66.0-amd64.msi
IP
109.105.218.17:443
ASN
#40509 FLY

Certificate
IssuerLet's Encrypt
Subjectdl.tailscale.com
Fingerprint0A:BC:50:CE:4A:79:76:35:0B:E5:7D:70:E8:EC:62:4B:E4:DA:07:93
ValidityMon, 22 Apr 2024 23:42:46 GMT - Sun, 21 Jul 2024 23:42:45 GMT

File type
Composite Document File V2 Document, Can't read SAT
Size
1.6 MB (1577357 bytes)
Hash
286edeee77cf9da4e080c8f970e5e79a
2a42661fbaadb68b6b3a01d8d239356bc55803c6
36ae7ebb77e49ca6ef401e4f93a8562ade2d6d760e74b43dc25721765196e1c5

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

HTTP Headers

GET /stable/tailscale-setup-1.66.0-amd64.msi HTTP/1.1
Host: dl.tailscale.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-length: 27243008
content-type: application/x-msi
last-modified: Wed, 08 May 2024 21:39:19 GMT
date: Thu, 09 May 2024 02:34:28 GMT
server: Fly/23b6c4a7 (2024-05-07)
via: 2 fly.io
fly-request-id: 01HXDK7F29REDBN432CHW2ZBPP-lhr
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers