Report - 190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none

Report Overview

Visited public
2025-01-17 16:46:04
Tags
URL
190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe
Finishing URL
190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe
IP / ASN
190.248.34.202
#13489 EPM Telecomunicaciones S.A. E.S.P.
Title
403 Forbidden

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
190.248.34.202	unknown	unknown	No data	No data	1.4 kB	670 B	190.248.34.202

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-17 16:45:40	medium	Client IP	190.248.34.202	ET INFO Executable Download from dotted-quad Host

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-01-17	medium	190.248.34.202	Sinkholed
2025-01-17	medium	190.248.34.202	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe

190.248.34.202

403 Forbidden

146 B

URL User Request GET HTTP/1.1
190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe
IP
190.248.34.202:80
ASN
#13489 EPM Telecomunicaciones S.A. E.S.P.

File type
HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
9fe3cb2b7313dc79bb477bc8fde184a7
4d7b3cb41e90618358d0ee066c45c76227a13747
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO Executable Download from dotted-quad Host

HTTP Headers

GET /filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe HTTP/1.1
Host: 190.248.34.202
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 403 Forbidden
Server: nginx
Date: Fri, 17 Jan 2025 16:45:40 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'

190.248.34.202/favicon.ico

190.248.34.202

404 Not Found

146 B

URL GET HTTP/1.1
190.248.34.202/favicon.ico
IP
190.248.34.202:80
ASN
#13489 EPM Telecomunicaciones S.A. E.S.P.

Requested by
http://190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe

File type
HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 190.248.34.202
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://190.248.34.202/filestreamingservice/files/9f670552-c12f-4ae8-8ad0-8ad085ad9261?P1=1737120043&P2=404&P3=2&P4=jR6M4CMVYdORzg+7xP0CHrqvt5iGxNPkzK0wkZ/JEqWkIcTiImhveRa1If2RvfIO2D9uwTPPoZc7DSY1wzn++w==&cacheHostOrigin=3.tlu.dl.delivery.mp.microsoft.com/wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.22621.1_none_db050381981eadad/notepad.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 17 Jan 2025 16:45:40 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers