Report - bms-downloads.de/components/components.zip

Report Overview

Visited public
2023-09-20 14:53:24
Tags
URL
bms-downloads.de/components/components.zip
Finishing URL
about:privatebrowsing
IP / ASN
92.205.198.19
#0
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

1

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.starfieldtech.com	6616	2003-03-06	2012-06-22 20:08:50	2023-09-19 19:10:18	336 B	2.7 kB	192.124.249.41
bms-downloads.de	unknown	unknown	2014-11-12 12:24:23	2023-08-04 04:55:05	498 B	691 kB	92.205.198.19

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-20 14:53:18	high	35.205.61.67	Client IP	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
bms-downloads.de/components/components.zip
IP
92.205.198.19
ASN
#0

File type
Zip archive data, at least v2.0 to extract, compression method=deflate\012- data
Size
691 kB (690666 bytes)
Hash
28a895ec3f1dc9c2dc792bcf9c644281
24a79b61e3881ed1306f64a384c9cf43ac730ef4
d18cf304120f5704e0163233f396ac835228993963c6a6ae07a6eda02c045e75

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	ocsp.starfieldtech.com/	192.124.249.41		2.1 kB
URL ocsp.starfieldtech.com/ IP 192.124.249.41:0 ASN #30148 SUCURI-SEC File type data Size 2.1 kB (2149 bytes) Hash 004aaca32ccc68ae238a3fd05197f02b fb059d48962b48505826a390518429cfe84156da 3e7969c4f58707021f886ae0c042846f8840378e064eddd5706f2a0a143c6861 HTTP Headers `POST / HTTP/1.1 Host: ocsp.starfieldtech.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 76 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Wed, 20 Sep 2023 14:53:08 GMT Content-Type: application/ocsp-response Content-Length: 2149 Connection: keep-alive X-Sucuri-ID: 19041 Content-Transfer-Encoding: Binary Cache-Control: public, no-transform, must-revalidate Last-Modified: Wed, 20 Sep 2023 10:50:54 GMT Expires: Thu, 21 Sep 2023 10:50:54 GMT ETag: "fb059d48962b48505826a390518429cfe84156da" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"`

	bms-downloads.de/components/components.zip	92.205.198.19	200 OK	691 kB
URL User Request GET HTTP/2 bms-downloads.de/components/components.zip IP 92.205.198.19:443 ASN #0 Certificate IssuerStarfield Technologies, Inc. Subject.bms-downloads.de Fingerprint8B:5F:4C:A4:7F:F4:A4:B2:85:86:A8:47:6B:9C:AC:5C:22:B1:9F:66 ValidityMon, 05 Jun 2023 07:59:06 GMT - Wed, 03 Jul 2024 13:11:40 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate\012- data Size 691 kB (690666 bytes) Hash 28a895ec3f1dc9c2dc792bcf9c644281 24a79b61e3881ed1306f64a384c9cf43ac730ef4 d18cf304120f5704e0163233f396ac835228993963c6a6ae07a6eda02c045e75 HTTP Headers `GET /components/components.zip HTTP/1.1 Host: bms-downloads.de User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK server: nginx date: Wed, 20 Sep 2023 14:53:07 GMT content-type: application/zip content-length: 690666 last-modified: Tue, 05 Sep 2023 08:43:16 GMT etag: "a89ea-604989e3743bc" x-cache-status: BYPASS accept-ranges: bytes X-Firefox-Spdy: h2`