{"report_id":"f14048f3-9f7d-433c-9a76-373a0323be12","version":6,"status":"done","tags":[],"date":"2023-12-08T03:22:41Z","url":{"schema":"http","addr":"rb.gy/3lvbuy","fqdn":"rb.gy","domain":"rb.gy","tld":"gy"},"ip":{"addr":"44.195.174.28","port":0,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-26T08:34:27Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"default"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"ia601602.us.archive.org","ip":{"addr":"207.241.227.82","port":443,"asn":7941,"as":"INTERNET-ARCHIVE","country":"United States","country_code":"US"},"domain_registered":"1995-12-14","domain_rank":0,"first_seen":"2012-12-29 00:21:45","last_seen":"2023-12-01 12:06:39","alert_count":0,"request_count":1,"received_data":13381234,"sent_data":555,"comment":"","tags":null,"fingerprints":null},{"fqdn":"archive.org","ip":{"addr":"207.241.224.2","port":443,"asn":7941,"as":"INTERNET-ARCHIVE","country":"United States","country_code":"US"},"domain_registered":"1995-12-14","domain_rank":7266,"first_seen":"2013-04-16 16:52:59","last_seen":"2023-12-06 20:37:54","alert_count":0,"request_count":1,"received_data":13381190,"sent_data":545,"comment":"","tags":null,"fingerprints":null},{"fqdn":"rb.gy","ip":{"addr":"44.207.55.129","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"domain_registered":"2019-09-17","domain_rank":103780,"first_seen":"2019-10-11 21:55:07","last_seen":"2023-12-07 05:31:33","alert_count":0,"request_count":1,"received_data":337,"sent_data":478,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"00d88b02bc3aada70498ec421092c04b","sha1":"2d83d33033e31955497e3e962493b9133e7a2c39","sha256":"e5b98f79e84d434b44fe4dab6b0e7823772d32744249a8fb9fb2288d0b354b21","sha512":"267d2ea6292cd5b0c8485861685547d99114552b6258a8dcc26fd11d64a2ca5d6fbdb11e6a416148b4b1f5ff97118f3cdf1280f46b1677aa54eb1c007e4789d6","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate\\012- data","size":13380830,"url":{"schema":"https","addr":"ia601602.us.archive.org/26/items/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip","fqdn":"ia601602.us.archive.org","domain":"archive.org","tld":"org"},"ip":{"addr":"207.241.227.82","port":443,"asn":7941,"as":"INTERNET-ARCHIVE","country":"United States","country_code":"US"},"archive":null,"alerts":{"urlquery":null,"analyzer":null}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"","description":"","date":"2023-12-08T03:22:29Z","timestamp":1702005749,"ip_dst":{"addr":"Client IP","port":56220,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"44.207.55.129","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"severity":"low","alert":"ET INFO Observed URL Shortening Service SSL/TLS Cert (rb.gy)","source":"{\"timestamp\":\"2023-12-08T03:22:29.394041+0000\",\"flow_id\":2034412392031837,\"in_iface\":\"lxdbr0\",\"event_type\":\"alert\",\"src_ip\":\"44.207.55.129\",\"src_port\":443,\"dest_ip\":\"10.70.215.47\",\"dest_port\":56220,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2036628,\"rev\":2,\"signature\":\"ET INFO Observed URL Shortening Service SSL/TLS Cert (rb.gy)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"created_at\":[\"2022_05_19\"],\"former_category\":[\"POLICY\"],\"updated_at\":[\"2022_05_19\"]}},\"tls\":{\"subject\":\"CN=rb.gy\",\"issuerdn\":\"C=US, O=Amazon, CN=Amazon RSA 2048 M01\",\"serial\":\"04:BA:2B:2F:92:13:2B:1D:84:C2:59:33:F2:E6:9D:B4\",\"fingerprint\":\"db:a6:0c:96:5d:05:26:d6:95:bf:cd:a8:79:39:3c:da:cc:7e:93:a5\",\"sni\":\"rb.gy\",\"version\":\"TLS 1.2\",\"notbefore\":\"2023-08-19T00:00:00\",\"notafter\":\"2024-09-16T23:59:59\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"50a9e7b112931e541503e8a2499252b9\",\"string\":\"771,49199,0-11-65281-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":8,\"pkts_toclient\":7,\"bytes_toserver\":1297,\"bytes_toclient\":5864,\"start\":\"2023-12-08T03:22:28.992861+0000\"}}"}]}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rb.gy/3lvbuy","fqdn":"rb.gy","domain":"rb.gy","tld":"gy"},"ip":{"addr":"44.207.55.129","port":443,"asn":14618,"as":"AMAZON-AES","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-12-08T03:22:28.996Z","timestamp":1702005748996,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PKCS1-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"rb.gy","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Sat, 19 Aug 2023 00:00:00 GMT","end":"Mon, 16 Sep 2024 23:59:59 GMT"},"fingerprint":{"sha1":"DB:A6:0C:96:5D:05:26:D6:95:BF:CD:A8:79:39:3C:DA:CC:7E:93:A5","sha256":"1B:2F:AA:85:6F:81:32:4C:99:59:CA:C0:9E:29:73:5A:60:4C:20:6E:93:EE:5A:3E:2A:39:E6:CA:FF:63:77:E6"}}},"request":{"raw":"GET /3lvbuy HTTP/1.1\r\nHost: rb.gy\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Fri, 08 Dec 2023 03:22:22 GMT\r\ncontent-length: 0\r\nlocation: https://archive.org/download/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip\r\ncache-control: no-cache, no-store\r\nexpires: -1\r\nengine: Rebrandly.redirect, version 2.1\r\nstrict-transport-security: max-age=15552000\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"application/zip","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T05:41:51.623429Z","times_seen":18562553,"resource_available":true,"data":null}},"time_used":939,"timings":{"blocked":399,"dns":1,"connect":130,"send":0,"wait":137,"receive":0,"ssl":269},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ia601602.us.archive.org/26/items/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip","fqdn":"ia601602.us.archive.org","domain":"archive.org","tld":"org"},"ip":{"addr":"207.241.227.82","port":443,"asn":7941,"as":"INTERNET-ARCHIVE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-12-08T03:22:30.068Z","timestamp":1702005750068,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.us.archive.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Thu, 19 Jan 2023 19:33:16 GMT","end":"Tue, 20 Feb 2024 19:33:16 GMT"},"fingerprint":{"sha1":"AD:42:AD:6F:D7:D3:83:11:4E:71:BF:D2:65:2C:78:ED:A6:9E:29:52","sha256":"7D:A5:6B:81:C4:E9:D7:EB:52:35:D0:DA:F6:24:12:D4:64:86:FE:A3:03:8C:73:B1:E4:FC:8D:A1:75:AC:D7:A5"}}},"request":{"raw":"GET /26/items/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip HTTP/1.1\r\nHost: ia601602.us.archive.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.25.1\r\ndate: Fri, 08 Dec 2023 03:22:24 GMT\r\ncontent-type: application/zip\r\ncontent-length: 13380830\r\nlast-modified: Sat, 11 Mar 2023 18:28:22 GMT\r\netag: \"640cc846-cc2cde\"\r\nstrict-transport-security: max-age=15724800\r\nexpires: Fri, 08 Dec 2023 09:22:24 GMT\r\ncache-control: max-age=21600\r\nreferrer-policy: no-referrer-when-downgrade\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":13380830,"size_decoded":0,"mime_type":"application/zip","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate\\012- data","md5":"00d88b02bc3aada70498ec421092c04b","sha1":"2d83d33033e31955497e3e962493b9133e7a2c39","sha256":"e5b98f79e84d434b44fe4dab6b0e7823772d32744249a8fb9fb2288d0b354b21","sha512":"267d2ea6292cd5b0c8485861685547d99114552b6258a8dcc26fd11d64a2ca5d6fbdb11e6a416148b4b1f5ff97118f3cdf1280f46b1677aa54eb1c007e4789d6","ssdeep":"196608:+gSZ6SufMRXuutVFO5GUJKYonj9u5Amo5VLhJ9SPm41t1ojm0M24B20L:+TD9lF/FTYIjYgv9Su41ty/4s0L","tlshash":"5bd633387d64e2d1edd7a33b84e90aaa0ef5036a93940237cdc53ba941d7f5229e7143","first_seen":"2023-08-13T01:01:13Z","last_seen":"2024-08-21T08:55:23.318506Z","times_seen":5,"resource_available":false,"data":null}},"time_used":3482,"timings":{"blocked":500,"dns":182,"connect":155,"send":0,"wait":165,"receive":2317,"ssl":161},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"archive.org/download/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip","fqdn":"archive.org","domain":"archive.org","tld":"org"},"ip":{"addr":"207.241.224.2","port":443,"asn":7941,"as":"INTERNET-ARCHIVE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2023-12-08T03:22:29.537Z","timestamp":1702005749537,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.archive.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Thu, 19 Jan 2023 18:59:49 GMT","end":"Tue, 20 Feb 2024 18:59:49 GMT"},"fingerprint":{"sha1":"B8:AE:C6:B4:93:7D:61:C3:EC:83:3D:EA:8C:B9:55:13:0F:41:C8:96","sha256":"EC:30:BE:D7:59:E6:D4:A9:FE:0D:E6:80:43:57:D7:08:B8:86:46:6C:23:E7:3D:AA:F9:31:7E:6A:F8:16:06:88"}}},"request":{"raw":"GET /download/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip HTTP/1.1\r\nHost: archive.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx/1.25.1\r\ndate: Fri, 08 Dec 2023 03:22:23 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://ia601602.us.archive.org/26/items/ps2bios-by-ps2-bios.com/ps2_bios%20by%20ps2-bios.com.zip\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15724800\r\nreferrer-policy: no-referrer-when-downgrade\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":null,"data":{"size":13380830,"size_decoded":0,"mime_type":"application/zip","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-20T05:41:51.623429Z","times_seen":18562553,"resource_available":true,"data":null}},"time_used":864,"timings":{"blocked":338,"dns":11,"connect":159,"send":0,"wait":188,"receive":0,"ssl":165},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}