Report - tmpfiles.org/dl/530066/nc.exe

Report Overview

Visited public
2025-01-27 20:20:21
Tags
URL
tmpfiles.org/dl/530066/nc.exe
Finishing URL
tmpfiles.org/dl/530066/nc.exe
IP / ASN
172.67.195.247
#13335 CLOUDFLARENET
Title
Not Found

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
tmpfiles.org	unknown	2015-07-27	2015-07-28	2025-01-21	2.2 kB	3.1 kB	104.21.21.16
fonts.googleapis.com	8877	2005-01-25	2012-05-23	2025-01-22	437 B	1.7 kB	142.250.74.10
fonts.gstatic.com	unknown	2008-02-11	2014-04-02	2025-01-22	533 B	17 kB	142.250.74.35

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-27 20:19:56	low	Client IP	104.21.21.16	ET INFO Observed Temporary File Hosting Domain (tmpfiles .org in TLS SNI)
2025-01-27 20:19:56	medium	Client IP	104.21.21.16	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
2025-01-27 20:19:56	medium	Client IP	104.21.21.16	ET HUNTING Observed Suspicious Request nc.exe in URI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (4)

URL IP Response Size

tmpfiles.org/dl/530066/nc.exe

104.21.21.16

301 Moved Permanently

169 B

URL
tmpfiles.org/dl/530066/nc.exe
IP
104.21.21.16:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with CRLF line terminators
Size
169 B (169 bytes)
Hash
84855c13836b389d5ec7cfd4c9266173
1cf3056ff23c4176fd7ca9816a000ed461d6d323
502083c916ae481cdd413b8d93315300653df5fb3dcc5770c01991de19977eae

Detections

NIDS	Severity	Alert
suricata	medium	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata	medium	ET HUNTING Observed Suspicious Request nc.exe in URI

HTTP Headers

GET /dl/530066/nc.exe HTTP/1.1
Host: tmpfiles.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjJWb0hudWVDdGRRY1pxU2o2WnQwZnc9PSIsInZhbHVlIjoidUYrOVV5TWdRd2Rmd3JRcXhBSXRPNHRiRHpmb0pBWURQOURLODBhci84V25laEhkZ2ZxRUxETGNnbDNkWEg1K3gveG9CNStnOGl0VWNlQlVnT3Vndk1HNnIzYmRwejRtc29aVHdSMldTSStOK2thVmNuaWRFeHp3dm5nNGo1QjUiLCJtYWMiOiI2NTI0MDI0NzRhNGZjYTE1YTdhMmVmNGQ2ZjBjMTQ3NWZlMDIwMWZlNDg1MDVmYjE4ZmFlODlmNjViMTMwYjNmIn0%3D; tmpfiles_session=eyJpdiI6ImtFYTRZSUFKQ1J4S1FZdEl0ck03NGc9PSIsInZhbHVlIjoiMnY0ZmQxdDBhY0FLL3dONkhjeW9KTjFMM1BSVWtGSGV1a3BLRUczdmlnQ1V1VmpYaTVLWE5nL1M1VnoyUy9LLzV6aVRRQ1JrVVlBRmR1a1YvbXpGbHVKYXg5ZitwOEdqVXp3azdJZTVlR2ZPcm9MQmIyWllBMTJpL2IyK3JNTEsiLCJtYWMiOiI0MDdhMGM0OTk1ZjA2ZGJkNDI3ZmQ5MTljMjM2NGQ1YTkzZDYxNzk5NjA2MzAzNGE1MDk0OGQ2MzUxMzFiNzMxIn0%3D
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Mon, 27 Jan 2025 20:19:56 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://tmpfiles.org/dl/530066/nc.exe
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QGfo4Q%2FCnY0NTpWAhc2RLrtIZ6U1t3iWmmuZZlq0GyKI47m8GIY%2Fbtu8PRvTBfAX%2FiXLjb6Aw0fFbdIyXW4prmpWlpqdrSj%2BkmWbLr%2FZB%2ByAhfCygkAAM%2BTQW8Y2Rig%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 908b70c48d275690-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=452&min_rtt=452&rtt_var=226&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=1101&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

fonts.googleapis.com/css2?family=Nunito&display=swap

142.250.74.10

200 OK

1.0 kB

URL
fonts.googleapis.com/css2?family=Nunito&display=swap
IP
142.250.74.10:0
ASN
#15169 GOOGLE

File type
gzip compressed data, max compression
Size
1.0 kB (1028 bytes)
Hash
654e010b536c83687a6666a10fa24bc0
6bdfa920fc5afb629fffdc386686882562548aed
cca5f1882d3b4fa5e65659af8bbf9a676b3a0ece3212e4b14267870615bde3c2

HTTP Headers

GET /css2?family=Nunito&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tmpfiles.org/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Mon, 27 Jan 2025 20:19:56 GMT
date: Mon, 27 Jan 2025 20:19:56 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/nunito/v26/XRXI3I6Li01BKofiOc5wtlZ2di8HDLshdTQ3jw.woff2

142.250.74.35

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/nunito/v26/XRXI3I6Li01BKofiOc5wtlZ2di8HDLshdTQ3jw.woff2
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://tmpfiles.org/dl/530066/nc.exe
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
FingerprintD7:B9:19:BD:66:26:5B:B9:E6:FB:43:87:53:20:86:F1:38:BE:D8:1D
ValidityMon, 06 Jan 2025 08:37:10 GMT - Mon, 31 Mar 2025 08:37:09 GMT

File type
Web Open Font Format (Version 2), TrueType, length 16292, version 1.0
Size
16 kB (16292 bytes)
Hash
ce485a2bdee361bb271bd6d3ce1ee5cd
4f9a446275d160cccd6666addee65f849c9c5a50
923963e0a56b84c4438f2359121e855e147a01a78a2591c471179cfc9bf0e784

HTTP Headers

GET /s/nunito/v26/XRXI3I6Li01BKofiOc5wtlZ2di8HDLshdTQ3jw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://tmpfiles.org
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 16292
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 23 Jan 2025 10:28:44 GMT
expires: Fri, 23 Jan 2026 10:28:44 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 14 Sep 2023 00:41:55 GMT
content-type: font/woff2
age: 381072
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

tmpfiles.org/favicon.ico

104.21.21.16

200 OK

1.2 kB

URL GET HTTP/3
tmpfiles.org/favicon.ico
IP
104.21.21.16:443
ASN
#13335 CLOUDFLARENET

Requested by
https://tmpfiles.org/dl/530066/nc.exe
Certificate
IssuerGoogle Trust Services
Subjecttmpfiles.org
Fingerprint12:05:C7:A5:41:12:AB:6A:21:58:AD:96:DB:56:2D:91:98:54:E3:B3
ValiditySun, 19 Jan 2025 04:44:57 GMT - Sat, 19 Apr 2025 05:43:28 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
641276e2d4d0995c8262223f1fdda3d2
4f3f8f324f842e21d6921fffef2be2370cba9c49
5c039a5032f66daf0ad7ccaf04589686dfcc0b580113c1c6a9cff06ed4ce676d

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: tmpfiles.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://tmpfiles.org/dl/530066/nc.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ilh6V2c5bjFId3IxdkI3blZ2UlFmTnc9PSIsInZhbHVlIjoiU09rSU94Qkk5RlkrM1pQUXRhTlZKaGhXSytKeFpnVkZ4aHdrbVk2VWFxWVBuNmNJZUhkS3UxWlpIOTNQWXZpQ2E5WXMwUElRcjNwS01Wa25ITXFuMWs4bFJLUlMxTWxqSXpzRHRvZWdnUFZzZlJpYVRpK2NsVHZHeFpzOXdZdUsiLCJtYWMiOiIzMWFkMWE2MWNiZjEyOTUxODI2NTFmYWQ5NWE3ZmJlYWE5YWU0NWEyZDkyYTgxODc1OGI3ZDMxYTlmYTVkZDMwIn0%3D; tmpfiles_session=eyJpdiI6ImlEbFZkT2Y3c1N5a2JISG15Z21UV1E9PSIsInZhbHVlIjoiaGRCQ0dVNVo0bmlIcHBmMXVpNlV4WStzVDM1dWROTlBDazNtbTB4VCt6Wlo1Yk55aHlxSHpFOGd1clN2b0RvWVZuWG4zWGpnV083T2R2cER6ZDFMczdNMjlZY2sxOUlWL3NWYjRaVi93eUl2cWhLTGlNU0VpblRMNTBYa205MkkiLCJtYWMiOiJmYTM2ODdiMThkOTdmOTZmMDk2MzJiNWY0YTEyNTgzMjViNjE2NThhM2QxMDhmZDkyMTY0ZDAwNDA0NGJlYzllIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 27 Jan 2025 20:19:56 GMT
content-type: image/x-icon
last-modified: Fri, 10 Feb 2017 21:01:32 GMT
etag: W/"589e2a2c-47e"
cache-control: max-age=14400
cf-cache-status: HIT
age: 4245
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pgSWGSptCtwQ9hPJ0sMSrUI7jMZWO0CAG0DToX0bohudfQmxN5A8rO%2BZASF5W67LU4KP6W6qYlSdXT27lr8BDZSWuCb2YenUdpPvbjRA%2BHqddxKGb2JKZihT1YkgdkM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 908b70c69e9056c1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2792&min_rtt=1297&rtt_var=1635&sent=18&recv=8&lost=0&retrans=0&sent_bytes=7635&recv_bytes=2570&delivery_rate=17359&cwnd=12000&unsent_bytes=0&cid=2bcf77f56c849350&ts=485&x=1", cfExtPri, cfHdrFlush;dur=0

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (4)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers