Report - fileexe.pages.dev/

Report Overview

URL

fileexe.pages.dev/
IP

172.66.44.119

ASN

#13335 CLOUDFLARENET
Submitted

2023-06-10T12:53:23Z

Access

public
Tags

sinkhole suspicious cloudflare
urlquery detections

Suspicious - Sinkholed / Blocked

Detections

urlquery

3
Network Intrusion Detection

0
Threat Detection Systems

10

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
fileexe.pages.dev (4)	unknown	2023-04-02 20:58:47	2023-06-10 14:36:03	1854	35334	172.66.44.119

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator
2023-06-09	medium	fileexe.pages.dev/
2023-06-09	medium	fileexe.pages.dev/
2023-06-09	medium	fileexe.pages.dev/

PhishTank

Scan Date	Severity	Indicator
2023-06-10	medium	fileexe.pages.dev/
2023-06-10	medium	fileexe.pages.dev/cdn-cgi/styles/cf.errors.css
2023-06-10	medium	fileexe.pages.dev/favicon.ico

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator
2023-06-10	medium	fileexe.pages.dev
2023-06-10	medium	fileexe.pages.dev
2023-06-10	medium	fileexe.pages.dev
2023-06-10	medium	fileexe.pages.dev

ThreatFox

No alerts detected

JavaScript (3)

HTTP Transactions (4)

URL IP Response Size

fileexe.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

172.66.44.119

200 OK

452

URL GET HTTP/2

fileexe.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637
IP

172.66.44.119:443
ASN

#13335 CLOUDFLARENET

Requested by

https://fileexe.pages.dev/
Certificate

IssuerGoogle Trust Services LLC

Subjectfileexe.pages.dev

Fingerprint1D:7F:60:1D:3B:77:E9:C7:2E:DB:B2:3A:63:75:7A:26:72:FE:96:1F

ValidityWed, 31 May 2023 19:10:35 GMT - Tue, 29 Aug 2023 19:10:34 GMT

Magic

PNG image data, 54 x 54, 8-bit colormap, non-interlaced\012- data

Size

452
Hash

c33de66281e933259772399d10a6afe8

b9f9d500f8814381451011d4dcf59cd2d90ad94f

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Sinkholed / Blocked
quad9	Sinkholed

HTTP Headers

                                        GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1
Host: fileexe.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fileexe.pages.dev/cdn-cgi/styles/cf.errors.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:53:06 GMT
content-type: image/png
content-length: 452
last-modified: Tue, 06 Jun 2023 11:54:00 GMT
etag: "647f1e58-1c4"
server: cloudflare
cf-ray: 7d51c1596d03b4f3-OSL
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sat, 10 Jun 2023 14:53:06 GMT
cache-control: max-age=7200, public
accept-ranges: bytes
X-Firefox-Spdy: h2

fileexe.pages.dev/

172.66.44.119

200 OK

4389

URL User Request GET HTTP/2

fileexe.pages.dev/
IP

172.66.44.119:443
ASN

#13335 CLOUDFLARENET

Certificate

IssuerGoogle Trust Services LLC

Subjectfileexe.pages.dev

Fingerprint1D:7F:60:1D:3B:77:E9:C7:2E:DB:B2:3A:63:75:7A:26:72:FE:96:1F

ValidityWed, 31 May 2023 19:10:35 GMT - Tue, 29 Aug 2023 19:10:34 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (4633), with no line terminators

Size

4389
Hash

297eaa6a86c903511d08004f50b19c2c

8f1491ca0649390cc8fb132d804a5a9cc92db9c4

a48ca76a50b18cd705480cc382b8802eeb49a73fa6b5d411416ddc3e1136180a

Detections

Analyzer	Verdict	Alert
openphish	Outlook
phishtank	Other
quad9	Sinkholed

HTTP Headers

                                        GET / HTTP/1.1
Host: fileexe.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:53:05 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pM8cr1zd7CMshn%2B9tsnTRAGY53wFDxBTEiRfPrBxsBcqAOLzG6DCweBdKzvr8vuv8%2BKb3gZCQT4sId9FRNz5HSO42Q35ky3XgzVNsvJPAXBG%2FKp5RP%2BXhjd4tEVFxZQmnuwJtg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d51c156b8f2b4f3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

fileexe.pages.dev/cdn-cgi/styles/cf.errors.css

172.66.44.119

200 OK

24132

URL GET HTTP/2

fileexe.pages.dev/cdn-cgi/styles/cf.errors.css
IP

172.66.44.119:443
ASN

#13335 CLOUDFLARENET

Requested by

https://fileexe.pages.dev/
Certificate

IssuerGoogle Trust Services LLC

Subjectfileexe.pages.dev

Fingerprint1D:7F:60:1D:3B:77:E9:C7:2E:DB:B2:3A:63:75:7A:26:72:FE:96:1F

ValidityWed, 31 May 2023 19:10:35 GMT - Tue, 29 Aug 2023 19:10:34 GMT

Magic

ASCII text, with very long lines (24131)

Size

24132
Hash

a1cedc21f16b5a97114857154fab35e9

95e9890a15a4f7f94f7f19d2c297e4b07503c526

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Sinkholed / Blocked
openphish	Outlook
phishtank	Other
quad9	Sinkholed

HTTP Headers

                                        GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Host: fileexe.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fileexe.pages.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:53:06 GMT
content-type: text/css
last-modified: Tue, 06 Jun 2023 11:54:00 GMT
etag: W/"647f1e58-5e44"
server: cloudflare
cf-ray: 7d51c1588be7b4f3-OSL
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sat, 10 Jun 2023 14:53:06 GMT
cache-control: max-age=7200, public
content-encoding: gzip
X-Firefox-Spdy: h2

fileexe.pages.dev/favicon.ico

172.66.44.119

200 OK

4400

URL GET HTTP/2

fileexe.pages.dev/favicon.ico
IP

172.66.44.119:443
ASN

#13335 CLOUDFLARENET

Requested by

https://fileexe.pages.dev/
Certificate

IssuerGoogle Trust Services LLC

Subjectfileexe.pages.dev

Fingerprint1D:7F:60:1D:3B:77:E9:C7:2E:DB:B2:3A:63:75:7A:26:72:FE:96:1F

ValidityWed, 31 May 2023 19:10:35 GMT - Tue, 29 Aug 2023 19:10:34 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (4644), with no line terminators

Size

4400
Hash

944be66ec0987ddc6735695b82d7b1aa

97c0f0991aa4cc65b916fb2a8b58f53c7a199996

513406e1757c19353127c631c999f97b4015a37bfc2ade8adab1e9cc4ba6879a

Detections

Analyzer	Verdict	Alert
openphish	Outlook
phishtank	Other
quad9	Sinkholed

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: fileexe.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fileexe.pages.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Sat, 10 Jun 2023 12:53:06 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DcAV1%2BX6LvModZU5TYtOWkyvIQ5fSpf5MmPr7L%2FncfBh97qAWXhVLdsU%2F%2F2qhOywpT9Qi5p3iXhImamyy14nbDfIOhwSBmB3w4sBJXKTlflzMUe%2FmZxmoaz1YS7k40Kc61r0PA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d51c1597d1ab4f3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

#1 JS:Script (size: 0)

#2 JS:Script (size: 393)

#3 JS:Script (size: 0)

HTTP Transactions (4)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers