Report - 135.148.28.56:5001/hwid.txt

Report Overview

Visited public
2024-11-29 22:26:08
Tags
URL
135.148.28.56:5001/hwid.txt
Finishing URL
135.148.28.56:5001/hwid.txt
IP / ASN
135.148.28.56
#16276 OVH SAS
Title
135.148.28.56:5001/hwid.txt

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
135.148.28.56	unknown	unknown	No data	No data	752 B	1.2 kB	135.148.28.56

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-11-29	medium	135.148.28.56	Sinkholed
2024-11-29	medium	135.148.28.56	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

135.148.28.56:5001/hwid.txt

135.148.28.56

200 OK

454 B

URL User Request GET HTTP/1.0
135.148.28.56:5001/hwid.txt
IP
135.148.28.56:5001
ASN
#16276 OVH SAS

File type
ASCII text, with CRLF line terminators
Size
454 B (454 bytes)
Hash
e5366110e3caf15ce82870e7d38c0493
7ce28f933663e170e9351c6917a40227cc484309
d0dafa9e4b3ccacb3b2faea67257c1998a200dbe7786794b5c065ae7c0150140

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /hwid.txt HTTP/1.1
Host: 135.148.28.56:5001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.13.0
Date: Fri, 29 Nov 2024 22:25:43 GMT
Content-type: text/plain
Content-Length: 454
Last-Modified: Fri, 29 Nov 2024 07:08:48 GMT

135.148.28.56:5001/favicon.ico

135.148.28.56

404 File not found

335 B

URL GET HTTP/1.0
135.148.28.56:5001/favicon.ico
IP
135.148.28.56:5001
ASN
#16276 OVH SAS

Requested by
http://135.148.28.56:5001/hwid.txt

File type
HTML document, ASCII text
Size
335 B (335 bytes)
Hash
a2ae3eaedf7f44998f3639756a1725cc
2616e0e695487e0f4fc5ddc18c57dcf95ce5851a
860b53ed6ea6a0cf602fae632cfcd28dbcf637f85a8bee28d2ee9c6cc9081669

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 135.148.28.56:5001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://135.148.28.56:5001/hwid.txt
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.0 404 File not found
Server: SimpleHTTP/0.6 Python/3.13.0
Date: Fri, 29 Nov 2024 22:25:44 GMT
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 335

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Mnemonic Secure DNS

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.0

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.0

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers