Report - 87.120.84.91:222/g.jpg

Report Overview

Submitted URL
87.120.84.91:222/g.jpg
IP
87.120.84.91
ASN
#0
Submitted
2024-04-16 11:30:31
Access
public
Website Title
g.jpg (JPEG Image)
Final URL
87.120.84.91:222/g.jpg
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
87.120.84.91:222	unknown	unknown	No data	No data	740 B	1.2 MB	87.120.84.91

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	87.120.84.91	Sinkholed
2024-04-16	medium	87.120.84.91	Sinkholed

ThreatFox

No alerts detected

Files detected

URL
87.120.84.91:222/g.jpg
IP
87.120.84.91
ASN
#0

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.2 MB (1236175 bytes)
Hash
b9247f13392648daf96eade0fb43ef32
292fc81a14d1257edbdd12da4ad40600769a4854
d9a3af3328dc4293617de54ef9a9f56f1eb0ad012c54cacf0706a2b0f5efc292

Archive (13)

Modified	Filename	Size	Md5	File type
2024-03-16 07:58	app.js	1.4 kB	020931b25df865f336d1fad370483c86	ASCII text, with CRLF line terminators
2024-03-16 07:59	basta.js	1.4 kB	784f1c1543327e48d9ce460f71168a78	ASCII text, with CRLF line terminators
2023-12-31 16:49	Execute.txt	7 B	40cd014b7b6251e3a22e6a45a73a64e1	ASCII text, with no line terminators
2023-12-31 16:53	Framework.txt	520 B	6a08392ecf95df7fc91917dcfaae8da6	ASCII text, with very long lines (520), with no line terminators
2023-12-31 16:57	getMethod.txt	9 B	db37f91f128a82062af0f39f649ea122	ASCII text, with no line terminators
2023-12-31 16:56	Gettype.txt	7 B	9221b7b54ed96de7281d31f8ae35be6a	ASCII text, with no line terminators
2024-03-19 17:28	in.bat	1.1 kB	bb21f82f2d5a609ddbe2c7aad80e7ed2	DOS batch file, ASCII text, with CRLF line terminators
2024-01-09 17:52	Invoke.txt	6 B	5fb833d20ef9f93596f4117a81523536	ASCII text, with no line terminators
2023-12-31 16:56	load.txt	4 B	ec4d1eb36b22d19728e9d1d23ca84d1c	ASCII text, with no line terminators
2024-03-20 07:21	msg.txt	830 kB	ef72e65564cad71bfb9e5ff57ddfc0fe	ASCII text, with very long lines (65536), with no line terminators
2023-12-31 17:08	NewPE2.txt	9 B	8a56a0e23dbfe7a50c5ec927b73ec5f2	ASCII text, with no line terminators
2024-03-19 17:31	run.js	1.7 kB	4047289d1e1a196a5e29d27529e6acac	JavaScript source, ASCII text, with CRLF line terminators
2024-03-20 05:05	runpe.txt	3.8 MB	8da440a7d6880a4e2b3bcd0eaf77e0f8	ASCII text, with very long lines (65536), with no line terminators

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

87.120.84.91:222/g.jpg

87.120.84.91

1.2 MB

URL
87.120.84.91:222/g.jpg
IP
87.120.84.91:0
ASN
#0

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.2 MB (1236175 bytes)
Hash
b9247f13392648daf96eade0fb43ef32
292fc81a14d1257edbdd12da4ad40600769a4854
d9a3af3328dc4293617de54ef9a9f56f1eb0ad012c54cacf0706a2b0f5efc292

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /g.jpg HTTP/1.1
Host: 87.120.84.91:222
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 16 Apr 2024 11:30:05 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Wed, 20 Mar 2024 16:45:25 GMT
ETag: "12dccf-6141a514bad3e"
Accept-Ranges: bytes
Content-Length: 1236175
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg

87.120.84.91:222/favicon.ico

87.120.84.91

404 Not Found

299 B

URL GET HTTP/1.1
87.120.84.91:222/favicon.ico
IP
87.120.84.91:222
ASN
#0

Requested by
http://87.120.84.91:222/g.jpg

File type
HTML document, ASCII text
Size
299 B (299 bytes)
Hash
150a879a9fcbb2f2aa28679b25e1be52
c88c5e0de9d78266098a93f9ae21a926748e69da
d40dfe2c09c0ea3d728f732339e76c8e6c64c459dd4d3c2af9b26243921804e1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 87.120.84.91:222
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://87.120.84.91:222/g.jpg
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Tue, 16 Apr 2024 11:30:07 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Content-Length: 299
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (13)

JavaScript (0)

HTTP Transactions (2)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers