Report - tyb.zzuli.edu.cn/_upload/article/files/46/fe/f519c4134743a4c0e2e1d2468fe4/3ffb9a0b-ad92-4667-8a10-b74b23263ee3.doc

Report Overview

Visited public
2024-05-20 17:16:56
Tags
URL
tyb.zzuli.edu.cn/_upload/article/files/46/fe/f519c4134743a4c0e2e1d2468fe4/3ffb9a0b-ad92-4667-8a10-b74b23263ee3.doc
Finishing URL
about:privatebrowsing
IP / ASN
202.196.0.13
#4538 China Education and Research Network Center
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ocsp.digicert.cn	37572	2006-01-24	2020-03-20 18:45:56	2024-05-20 07:30:12	328 B	970 B	47.246.3.235
tyb.zzuli.edu.cn	unknown	unknown	2017-01-21 06:53:40	2022-12-12 13:38:12	751 B	17 kB	202.196.0.13

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-05-20 17:16:29	medium	Client IP	192.169.69.26	ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
tyb.zzuli.edu.cn/_upload/article/files/46/fe/f519c4134743a4c0e2e1d2468fe4/3ffb9a0b-ad92-4667-8a10-b74b23263ee3.doc
IP
202.196.0.13
ASN
#4538 China Education and Research Network Center

File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 936, Author: Administrator, Template: Normal.dot, Last Saved By: admin, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Wed Sep 6 14:30:00 2017, Last Saved Time/Date: Wed Sep 6 14:31:00 2017, Number of Pages: 7, Number of Words: 464, Number of Characters: 2649, Security: 0
Size
8.3 kB (8310 bytes)
Hash
8b7ceda8b562d50854c501c4002c32da
a21c6cab26734b6fa16906d6d61a6c41f6516cc9
69e21a33edc64982b01d72613ecb6ab81dc91f32301a784b917a5185793fc0d9

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Response	Size
	ocsp.digicert.cn/	47.246.3.235		471 B
URL ocsp.digicert.cn/ IP 47.246.3.235:0 ASN #24429 Zhejiang Taobao Network Co.,Ltd File type data Size 471 B (471 bytes) Hash d20d454fba9e4859ecb31ed26116810b e8069ddfc44fee159b96763468e7f8e72c22e8d1 fa7f31d544184a31256d221e5590436ecdce26f28a5792f8ba45c13f58aa5242 HTTP Headers `POST / HTTP/1.1 Host: ocsp.digicert.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Cache-Control: max-age=7200 Date: Mon, 20 May 2024 17:16:33 GMT Ali-Swift-Global-Savetime: 1716225393 Via: cache17.l2fr1[795,794,200-0,M], cache17.l2fr1[796,0], cache9.ru4[852,852,200-0,M], cache9.ru4[853,0] X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Mon, 20 May 2024 17:16:33 GMT X-Swift-CacheTime: 0 Timing-Allow-Origin: * EagleId: 2ff6039d17162253925418445e`

	tyb.zzuli.edu.cn/	202.196.0.13		7.8 kB
URL tyb.zzuli.edu.cn/ IP 202.196.0.13:0 ASN #4538 China Education and Research Network Center File type JavaScript source, Unicode text, UTF-8 text, with very long lines (466), with CRLF line terminators Size 7.8 kB (7812 bytes) Hash aa61bfaf6f4b421f2e8652da23ff8cd7 21d84d3a7461ced3e2a0b66f33d591b5b64a13f1 f85901defcb2c919753b3e0f706299b22b7a6b73e1246991489fc2cf2db03240 HTTP Headers `GET / HTTP/1.1 Host: tyb.zzuli.edu.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Date: Mon, 20 May 2024 17:16:34 GMT Content-Type: text/html Content-Length: 7812 Connection: keep-alive accept-ranges: bytes vary: Accept-Encoding content-encoding: gzip x-envoy-upstream-service-time: 2`

	tyb.zzuli.edu.cn/_upload/article/files/46/fe/f519c4134743a4c0e2e1d2468fe4/3ffb9a0b-ad92-4667-8a10-b74b23263ee3.doc	202.196.0.13	200 OK	8.3 kB
URL User Request GET HTTP/1.1 tyb.zzuli.edu.cn/_upload/article/files/46/fe/f519c4134743a4c0e2e1d2468fe4/3ffb9a0b-ad92-4667-8a10-b74b23263ee3.doc IP 202.196.0.13:80 ASN #4538 China Education and Research Network Center File type Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 936, Author: Administrator, Template: Normal.dot, Last Saved By: admin, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Wed Sep 6 14:30:00 2017, Last Saved Time/Date: Wed Sep 6 14:31:00 2017, Number of Pages: 7, Number of Words: 464, Number of Characters: 2649, Security: 0 Size 8.3 kB (8310 bytes) Hash 8b7ceda8b562d50854c501c4002c32da a21c6cab26734b6fa16906d6d61a6c41f6516cc9 69e21a33edc64982b01d72613ecb6ab81dc91f32301a784b917a5185793fc0d9 HTTP Headers `GET /_upload/article/files/46/fe/f519c4134743a4c0e2e1d2468fe4/3ffb9a0b-ad92-4667-8a10-b74b23263ee3.doc HTTP/1.1 Host: tyb.zzuli.edu.cn User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: ***** Date: Mon, 20 May 2024 17:16:36 GMT Content-Type: application/msword;charset=UTF-8 Content-Length: 8310 Connection: keep-alive x-application-context: application accept-ranges: bytes etag: W/"31232-1530700606000-gzip" last-modified: Wed, 04 Jul 2018 10:36:46 GMT vary: Accept-Encoding content-encoding: gzip x-envoy-upstream-service-time: 3`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

JavaScript (0)

HTTP Transactions (3)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers