Overview

URLgogo804.top/hta_ex/101.php?en=KF7FPPFS
IP103.52.110.2
ASNAS59092 kronos.Co.,Ltd.
Location Japan
Report completed2017-04-21 16:03:03 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentOpera/9.80 (Windows NT 6.1; U; en) Presto/2.5.24 Version/10.54
Referer
Pool
Access Levelpublic


Intrusion Detection Systems

Snort /w Sourcefire VRT No alerts detected
Suricata /w Emerging Threats Pro No alerts detected


Blacklists

Fortinet's Web Filter / fortiguard.com
Added / Verified Severity Host Comment
2017-04-212gogo804.top/hta_ex/101.php?en=KF7FPPFSMalware
MDL / malwaredomainlist.com No alerts detected
DNS-BH / malwaredomains.com No alerts detected
mnemonic secure DNS / mnemonic.no No alerts detected
OpenPhish / openphish.com No alerts detected
PhishTank / phishtank.com No alerts detected
Spamhaus DBL / spamhaus.org No alerts detected


Files Captured



Recent reports on same IP/ASN/Domain

Last 3 reports on IP: 103.52.110.2

Date UQ / IDS / BL URL IP
2017-04-21 16:03:080 - 0 - 1gogo804.top/hta_ex/101.php?en=P446763S103.52.110.2
2017-04-14 21:11:500 - 0 - 1gogo802.top/hta_ex/101.php?en=473684MS103.52.110.2
2017-03-22 20:10:300 - 0 - 1gogo710.com/hta_ex/101.php?en=7F43363S103.52.110.2

Last 6 reports on ASN: AS59092 kronos.Co.,Ltd.

Date UQ / IDS / BL URL IP
2017-04-21 16:03:080 - 0 - 1gogo804.top/hta_ex/101.php?en=P446763S103.52.110.2
2017-04-15 15:09:040 - 0 - 1hta.youtube141.com/hta_p/download41499a4/7YVM42VW103.52.110.5
2017-04-14 21:11:500 - 0 - 1gogo802.top/hta_ex/101.php?en=473684MS103.52.110.2
2017-04-14 18:02:490 - 0 - 0103.52.109.39103.52.109.39
2017-04-14 18:02:420 - 0 - 0103.52.109.85103.52.109.85
2017-04-11 02:42:060 - 0 - 0vmyhm0lqu.ytak8u5a.com/?hfmapzf=1403&lgkey=3680136311e19b&spc=105076153.121.101.142

Last 1 reports on domain: gogo804.top

Date UQ / IDS / BL URL IP
2017-04-21 16:03:080 - 0 - 1gogo804.top/hta_ex/101.php?en=P446763S103.52.110.2



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (1)


Request Response
GET /hta_ex/101.php?en=KF7FPPFS HTTP/1.1

Host: gogo804.top

User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.5.24 Version/10.54
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 103.52.110.2
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Date: Fri, 21 Apr 2017 14:02:06 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.4.30
Set-Cookie: PHPSESSID=9c5t2osf7ob0dbkrif4kkeb7m5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: public
Pragma: no-cache
Content-Disposition: attachment; filename="����������52388307.hta"
Content-Length: 108668
Connection: close