Report - qu.ax/pdXu.zip

Report Overview

Submitted URL
qu.ax/pdXu.zip
IP
176.96.138.90
ASN
#58212 dataforest GmbH
Submitted
2024-04-17 06:21:54
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
qu.ax	unknown	2019-10-23	2019-12-22	2024-04-16	468 B	955 kB	45.145.42.217

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	qu.ax	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	qu.ax	Sinkholed

ThreatFox

No alerts detected

Files detected

URL
qu.ax/pdXu.zip
IP
45.145.42.217
ASN
#58212 dataforest GmbH

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
954 kB (954491 bytes)
Hash
fafccb6be820a1f6bc993637cc0342e4
172ebd52c06ae7a6ac41b4c6218887e1a38b84f5
bd613aa1923d06caedbcc7613a92515bf78c9f7a3d699b3d2ac8e3f9a6fe6198

Archive (42)

Modified	Filename	Size	Md5	File type
2023-09-25 20:52	HelloWorld.py	22 B	0f503dd7574d97c828670d29ceda2a2c	ASCII text
2023-08-22 07:02	boot.py	907 B	f38bf4965382a1ce203f6a890682ac8e	Python script, ASCII text executable
2023-08-22 07:02	Blink.py	298 B	bb68caad01c5baa95845d0f436c69711	Python script, ASCII text executable
2023-08-22 07:02	ButtonAndLed.py	301 B	b7c5700fce8b6a1fae0a7b25936d8500	Python script, ASCII text executable
2023-08-22 07:02	TableLamp.py	393 B	26b645021baf550ed9e7a01c1d393ca8	Python script, ASCII text executable
2023-08-22 07:02	FlowingLight.py	442 B	274bc14a1052f4a27699c6293d2e2d4e	Python script, ASCII text executable
2023-08-22 07:02	BreatheLight.py	300 B	288c917e27896830e6175addc3243854	Python script, ASCII text executable
2023-08-22 07:02	FlowingLight.py	575 B	b7243691cf8c8d0abd3d678ebfbd9efb	Python script, ASCII text executable
2023-08-22 07:02	pwm.py	1.2 kB	e817f8ab0a626abd69d412031339919e	Python script, ASCII text executable
2023-08-22 07:02	RandomColorLight.py	501 B	6cab74a0367af2257306895d24c060b1	Python script, ASCII text executable
2023-08-22 07:02	GradientColorLight.py	916 B	c86945baf61ca5ead3ba8bf2d94d7648	Python script, ASCII text executable
2023-08-22 07:02	Doorbell.py	220 B	3bfbf74a968cb53b8632a78a30c859c7	Python script, ASCII text executable
2023-08-22 07:02	Alertor.py	494 B	f21885344dd7eb3245e58c2363fd0060	Python script, ASCII text executable
2023-08-22 07:02	Serial_Print.py	141 B	a34c4a3f6f7464a69ff73015ac46fc91	ASCII text
2023-08-22 07:02	Serial_Print_by_Usart1.py	317 B	e3f09ff0595867edc3c24a62a7e2a12a	Python script, ASCII text executable
2023-08-22 07:02	Serial_Print_by_Usart2.py	317 B	04b0860459fae9deec165bc3a0a62474	Python script, ASCII text executable
2023-08-22 07:02	Serial_Read_and_Write.py	209 B	7acd41ca0e1e8f42b146990ec2f9e37a	ASCII text
2023-08-22 07:02	Serial_Read_and_Write_by_Usart1.py	492 B	1d719d6ccdc7218761f99960e6a7e888	Python script, ASCII text executable
2023-08-22 07:02	Serial_Read_and_Write_by_Usart2.py	491 B	32a2e2b4533e2bc2c96b855d7fd7fc67	Python script, ASCII text executable
2023-08-22 07:02	AnalogRead.py	391 B	f9dd1e88036852f9b40dca5821a3407c	Python script, ASCII text executable
2023-08-22 07:02	Read_Touch_Sensor.py	162 B	06936b544f0f4c9786323920c205074c	Python script, ASCII text executable
2023-08-22 07:02	TouchLamp.py	718 B	cd6b4846a50b201949d47be34e37216a	Python script, ASCII text executable
2023-08-22 07:02	Soft_LED.py	305 B	077ab0eebb49d12cad99770103fbe0d5	Python script, ASCII text executable
2023-08-22 07:02	NightLamp.py	305 B	077ab0eebb49d12cad99770103fbe0d5	Python script, ASCII text executable
2023-08-22 07:02	Thermometer.py	458 B	5257df2fea7e8af42bc2302ce889a38a	Python script, ASCII text executable
2023-08-22 07:02	BLE.py	3.0 kB	5a36f60c7385277b8f06104185f65d71	Python script, ASCII text executable
2023-08-22 07:02	ble_advertising.py	2.7 kB	33c1eb9dde99df2d8519e055165dc885	Python script, ASCII text executable
2023-08-22 07:02	ble_advertising.py	2.7 kB	33c1eb9dde99df2d8519e055165dc885	Python script, ASCII text executable
2023-08-22 07:02	BLE_LED.py	3.0 kB	33691e0335da1ea939dc4299250c765f	Python script, ASCII text executable
2023-08-22 07:02	Station_mode.py	626 B	4db1f9a0eb8f32b6c9dc5647d850c889	Python script, ASCII text executable
2023-08-22 07:02	AP_mode.py	785 B	67f0b7e5d6472c96b4af184de5c9201f	Python script, ASCII text executable
2023-08-22 07:02	AP+STA_mode.py	1.2 kB	9515d04e4c3d5045409d203c1fb7dc70	Python script, ASCII text executable
2023-08-22 07:02	sketchWiFi.pde	7.1 kB	e97cc6e964970605713063f27feba508	Java source, Unicode text, UTF-8 text
2023-08-22 07:02	TCP_as_Client.py	1.0 kB	48dd94737acd85fcafabbbcfe7a416c2	Python script, ASCII text executable
2023-08-22 07:02	sketchWiFi.pde	7.1 kB	e97cc6e964970605713063f27feba508	Java source, Unicode text, UTF-8 text
2023-08-22 07:02	TCP_as_Server.py	1.3 kB	1e97b4492ed5e35bdbcf86c45a1281d8	Python script, ASCII text executable
2023-08-22 07:02	micropython_camera_feeeb5ea3_esp32_idf4_4.bin	1.4 MB	80c03214bb307522fcf97ee744568af0	DOS executable (COM), start instruction 0xe9030220 18060840
2023-08-22 07:02	__init__.py	11 kB	e23cc482524a347a33978cf34149d669	Python script, ASCII text executable
2023-08-22 07:02	utils.py	791 B	2485648d4f9fe22e5651a079064241f1	Python script, ASCII text executable
2023-08-22 07:02	pkg_resources.py	698 B	2dbacd0bd93a182fa61760880d5a1af8	Python script, ASCII text executable
2023-08-22 07:02	ulogging.py	2.1 kB	b2841aa8bb1b602e66c25bc2752b61ee	Python script, ASCII text executable
2023-08-22 07:02	picoweb_video.py	4.0 kB	c7e316b62647f7a86f2df63c20b3f302	Python script, ASCII text executable

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

qu.ax/pdXu.zip

45.145.42.217

200 OK

954 kB

URL User Request GET HTTP/2
qu.ax/pdXu.zip
IP
45.145.42.217:443
ASN
#58212 dataforest GmbH

Certificate
IssuerLet's Encrypt
Subject*.qu.ax
Fingerprint82:9B:25:4F:F4:5A:4D:E3:20:F2:A0:49:24:38:BA:5B:66:4A:CB:6D
ValidityMon, 18 Mar 2024 05:21:34 GMT - Sun, 16 Jun 2024 05:21:33 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
954 kB (954491 bytes)
Hash
fafccb6be820a1f6bc993637cc0342e4
172ebd52c06ae7a6ac41b4c6218887e1a38b84f5
bd613aa1923d06caedbcc7613a92515bf78c9f7a3d699b3d2ac8e3f9a6fe6198

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pdXu.zip HTTP/1.1
Host: qu.ax
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 17 Apr 2024 06:21:28 GMT
content-type: application/zip
content-length: 954491
last-modified: Thu, 09 Nov 2023 15:05:15 GMT
x-xss-protection: 1; mode=block
alt-svc: h3=":443"; ma=604800
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (42)

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers