Report - d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt

Report Overview

Visited public
2023-09-20 12:03:00
Tags
URL
d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt
Finishing URL
d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt
IP / ASN
54.230.111.16
#16509 AMAZON-02
Title
d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt

Detections

urlquery

0

Network Intrusion Detection

1

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.sectigo.com	487	2018-08-16	2019-11-29 12:50:24	2023-09-19 22:25:16	330 B	964 B	104.18.14.101
d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com	unknown	2013-05-26	2023-07-25 15:55:39	2023-09-19 13:48:52	1.1 kB	4.1 MB	54.230.111.16

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-09-20 12:02:51	high	54.37.238.86	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Response	Size
	ocsp.sectigo.com/	104.18.14.101		472 B
URL ocsp.sectigo.com/ IP 104.18.14.101:0 ASN #13335 CLOUDFLARENET File type data Size 472 B (472 bytes) Hash f121bbe30282b31167562f017a0da0cc 4e6383522d11be1477f4271685ff299f2c6bc4d4 4bb5a014d4a8739d9c18761aa0e09742f1e73a995b9993c565b3ebaa7873e793 HTTP Headers `POST / HTTP/1.1 Host: ocsp.sectigo.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Wed, 20 Sep 2023 12:02:42 GMT Content-Type: application/ocsp-response Content-Length: 472 Connection: keep-alive Last-Modified: Sun, 17 Sep 2023 13:46:40 GMT Expires: Sun, 24 Sep 2023 13:46:39 GMT Etag: "4e6383522d11be1477f4271685ff299f2c6bc4d4" Cache-Control: max-age=352850,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb5 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8099ebc77b08568d-OSL`

	d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt	54.230.111.16	200 OK	4.1 MB
URL User Request GET HTTP/2 d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt IP 54.230.111.16:443 ASN #16509 AMAZON-02 Certificate IssuerSectigo Limited Subject.usrfiles.com Fingerprint15:F4:65:90:B4:A0:48:C6:7D:B3:74:65:0C:F1:AF:70:66:E6:AD:40 ValidityWed, 26 Jul 2023 00:00:00 GMT - Mon, 22 Jan 2024 23:59:59 GMT File type ASCII text, with very long lines (65447), with CRLF line terminators Size 4.1 MB (4129238 bytes) Hash 10c35a153964be038c491a2b26495803 287143e592618a7117bd6ae7cbdf8a93270de136 26f54a1a14877ea91a47a94148a7939f74f87af1b7737450a75a21715b84ed90 HTTP Headers GET /ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt HTTP/1.1 Host: d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK content-type: text/plain content-length: 4129238 server: openresty/1.21.4.1 date: Wed, 16 Aug 2023 14:00:08 GMT expires: Wed, 16 Aug 2023 15:00:08 GMT cache-control: public, max-age=15552000, immutable last-modified: Wed, 16 Aug 2023 12:35:30 GMT etag: "10c35a153964be038c491a2b26495803" accept-ranges: bytes access-control-allow-origin: access-control-expose-headers: Content-Length timing-allow-origin: * x-seen-by: gcp.us-central-1.media-router-f89dc7b48-xgfj4 x-robots-tag: noindex, nofollow via: 1.1 google, 1.1 227a1815a1677b9cf6dd587e443000b8.cloudfront.net (CloudFront) x-cache: Hit from cloudfront x-amz-cf-pop: OSL50-P1 alt-svc: h3=":443"; ma=86400 x-amz-cf-id: rlZz37lNNwL0VN4QyrSOr7PdMA8HoPLaZwWtwloY8jfKHoXmRoBhFg== age: 3016954 X-Firefox-Spdy: h2

	d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/favicon.ico	54.230.111.16	403 Forbidden	9 B
URL GET HTTP/3 d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/favicon.ico IP 54.230.111.16:443 ASN #16509 AMAZON-02 Requested by https://d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt Certificate IssuerSectigo Limited Subject.usrfiles.com Fingerprint15:F4:65:90:B4:A0:48:C6:7D:B3:74:65:0C:F1:AF:70:66:E6:AD:40 ValidityWed, 26 Jul 2023 00:00:00 GMT - Mon, 22 Jan 2024 23:59:59 GMT File type ASCII text, with no line terminators Size 9 B (9 bytes) Hash 722969577a96ca3953e84e3d949dee81 3dab5f6012e3e149b5a939b9cebba4a0b84dc8f5 78342a0905a72ce44da083dcb5d23b8ea0c16992ba2a82eece97e033d76ba3d3 HTTP Headers GET /favicon.ico HTTP/1.1 Host: d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: image/avif,image/webp,/* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://d9e1c3dd-1fee-48c1-9089-09a70580408e.usrfiles.com/ugd/d9e1c3_356ef2bed44c469b88966dc85e16ebee.txt Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers HTTP/3 403 Forbidden content-type: text/plain content-length: 9 alt-svc: h3=":443"; ma=86400 server: openresty/1.21.4.1 date: Wed, 20 Sep 2023 12:02:43 GMT access-control-allow-origin: * cache-control: no-cache, private, must-revalidate, proxy-revalidate, no-store timing-allow-origin: * x-seen-by: gcp.us-central-1.media-router-f89dc7b48-qvpn2 via: 1.1 google, 1.1 d9fb4c3794a085bb4ee2c5798c2cb1b8.cloudfront.net (CloudFront) x-cache: Error from cloudfront x-amz-cf-pop: OSL50-P1 x-amz-cf-id: rSOIev0FAFvC2XcA2xpWma2GjkD8UTKNhxLft0ndFz1xT9fLYtnlHg==