Report - mericar.com.br/ConvertedFile.txt

Report Overview

Visitedpublic

2025-05-16 16:52:04

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
mericar.com.br	unknown	2025-04-27	2025-04-28	2025-04-28	952 B	672 kB	45.152.46.171

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-05-16	medium	mericar.com.br/ConvertedFile.txt	Detects an base64 encoded executable with reversed characters

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-05-16	medium	mericar.com.br	Sinkholed
2025-05-16	medium	mericar.com.br	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET mericar.com.br/ConvertedFile.txt

45.152.46.171

200 OK

666 kB

URL User Request GET HTTPS

mericar.com.br/ConvertedFile.txt

IP / ASN

45.152.46.171

#47583 Hostinger International Limited

Requested byN/A

Resource Info

File typeASCII text, with very long lines (65536), with no line terminators

First Seen2025-05-16

Last Seen2025-05-16

Times Seen1

Size666 kB (666284 bytes)

MD5a83587b1527c1ddb73cd3dc5473cc990

SHA1992a6a1b1dfa29fdd255308757e12a7a03c17989

SHA2569add0159d44a388e7931ddcc62431b469a0e58a50e4c91afd905d994ad4700d8

Certificate Info

IssuerLet's Encrypt

Subjectmericar.com.br

FingerprintAF:E6:82:33:EA:27:89:1D:CC:54:19:49:1F:12:B9:AF:B5:7E:9E:CF

ValidityMon, 28 Apr 2025 02:03:07 GMT - Sun, 27 Jul 2025 02:03:06 GMT

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects an base64 encoded executable with reversed characters
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /ConvertedFile.txt HTTP/1.1
Host: mericar.com.br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/plain
last-modified: Wed, 14 May 2025 13:25:06 GMT
etag: "a2aac-682499b2-66fc6c23e5733759;br"
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 327523
date: Fri, 16 May 2025 16:51:33 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

GET mericar.com.br/favicon.ico

45.152.46.171

404 Not Found

4.5 kB

URL GET HTTPS

mericar.com.br/favicon.ico

IP / ASN

45.152.46.171

#47583 Hostinger International Limited

Requested byhttps://mericar.com.br/ConvertedFile.txt

Resource Info

File typeHTML document, ASCII text, with very long lines (371)

First Seen2025-04-22

Last Seen2025-08-06

Times Seen4466

Size4.5 kB (4511 bytes)

MD5b16e9097fc7d3af8ebfcfce7aba0a42d

SHA12af3c8408b8445fe81d9a7c8d7cc8e8a05bf80f5

SHA256e7db95c97a5d45787cc3e40cbcb93b748fefc65bc14e162c746e37f979861729

Certificate Info

IssuerLet's Encrypt

Subjectmericar.com.br

FingerprintAF:E6:82:33:EA:27:89:1D:CC:54:19:49:1F:12:B9:AF:B5:7E:9E:CF

ValidityMon, 28 Apr 2025 02:03:07 GMT - Sun, 27 Jul 2025 02:03:06 GMT

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mericar.com.br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mericar.com.br/ConvertedFile.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
content-type: text/html
last-modified: Tue, 22 Apr 2025 07:57:10 GMT
etag: "119f-68074bd6-60bffde27a88de2;br"
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 1626
date: Fri, 16 May 2025 16:51:35 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"