Report - www.greatis.com/dbs.zip

Report Overview

Visited public
2024-06-22 01:30:57
Tags
URL
www.greatis.com/dbs.zip
Finishing URL
about:privatebrowsing
IP / ASN
144.217.89.149
#16276 OVH SAS
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-06-21 18:12:54	2.0 kB	5.3 kB	23.36.76.226
www.greatis.com	unknown	2000-02-17	2012-05-24 12:12:28	2023-09-14 15:30:30	477 B	2.5 MB	144.217.89.149

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.greatis.com/dbs.zip
IP
144.217.89.149
ASN
#16276 OVH SAS

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
2.5 MB (2549566 bytes)
Hash
9eb9fea0b8aecbaa2b82d37d513adcbb
d150283e30f065e9d96891d611fa57e31ab89f7b
12b435efb41f6ebc6a305fd0da97bffe72d18aa7ed8dc4a4d40134d203f26c01

Archive (2)

Filename

Md5

File type

dbs.db

64ba38e51c35e528b9e9824387eee74a

SQLite 3.x database, last written using SQLite version 3019003, page size 1024, file counter 23061, database pages 5387, cookie 0x4a, schema 4, UTF-8, version-valid-for 22589

dbswww.ini

6c9917af774d6a4edee4de603611c25e

Generic INItialization configuration [Chat]

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects suspicious PowerShell code that downloads from web sites
Public InfoSec YARA rules	malware	Identifies AutoIT script.

JavaScript (0)

HTTP Transactions (7)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 6d997a3e4c838d12e34de2dd2d4208c3 386abb53e2df86f291b6a86765d9a6feb88ba30b 32e00abd54407308b80a14e2916a119d95d90b1e7842f8cf0e87df306287869c HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "32E00ABD54407308B80A14E2916A119D95D90B1E7842F8CF0E87DF306287869C" Last-Modified: Thu, 20 Jun 2024 13:53:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=6145 Expires: Sat, 22 Jun 2024 03:12:56 GMT Date: Sat, 22 Jun 2024 01:30:31 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash c0fde0756f59aaa5fa85a62f5f528e74 3c2d990e14054ee3b407cc37d77e255533d91ed6 ca44d6619deb0e020993a84c6bfbf1993bf096b13863b706dc8a826499348276 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "CA44D6619DEB0E020993A84C6BFBF1993BF096B13863B706DC8A826499348276" Last-Modified: Wed, 19 Jun 2024 23:47:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15337 Expires: Sat, 22 Jun 2024 05:46:08 GMT Date: Sat, 22 Jun 2024 01:30:31 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 5a3268763aa8247d09e7b12f8a157bb5 fbddec6e9fb707501596ca331266c50e77e23f5b 6095004cca6c22ee09c33dc58574519973f162bb1ee183856ed65675281d551c HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "6095004CCA6C22EE09C33DC58574519973F162BB1EE183856ED65675281D551C" Last-Modified: Wed, 19 Jun 2024 16:21:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10258 Expires: Sat, 22 Jun 2024 04:21:29 GMT Date: Sat, 22 Jun 2024 01:30:31 GMT Connection: keep-alive`

	www.greatis.com/dbs.zip	144.217.89.149	200 OK	2.5 MB
URL User Request GET HTTP/1.1 www.greatis.com/dbs.zip IP 144.217.89.149:443 ASN #16276 OVH SAS Certificate IssuerLet's Encrypt Subjectgreatis.com Fingerprint10:08:28:97:D1:56:C7:B0:88:AD:9C:B1:CA:72:87:2B:67:59:DF:B1 ValiditySat, 25 May 2024 07:58:07 GMT - Fri, 23 Aug 2024 07:58:06 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 2.5 MB (2549566 bytes) Hash 9eb9fea0b8aecbaa2b82d37d513adcbb d150283e30f065e9d96891d611fa57e31ab89f7b 12b435efb41f6ebc6a305fd0da97bffe72d18aa7ed8dc4a4d40134d203f26c01 HTTP Headers `GET /dbs.zip HTTP/1.1 Host: www.greatis.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 01:30:32 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Fri, 21 Jun 2024 19:14:16 GMT ETag: "26e73e-61b6b3cd05b30" Accept-Ranges: bytes Content-Length: 2549566 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 6720792332fb717894b4e5221fdc3d86 f79b1d3611fb53cea950acb15000473ae7174149 67dd6ffe107c77c5f8bea4a3d6771b6026efc51bd4a9b26c66c8791c1ef48965 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "67DD6FFE107C77C5F8BEA4A3D6771B6026EFC51BD4A9B26C66C8791C1EF48965" Last-Modified: Thu, 20 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10306 Expires: Sat, 22 Jun 2024 04:22:20 GMT Date: Sat, 22 Jun 2024 01:30:34 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 6720792332fb717894b4e5221fdc3d86 f79b1d3611fb53cea950acb15000473ae7174149 67dd6ffe107c77c5f8bea4a3d6771b6026efc51bd4a9b26c66c8791c1ef48965 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "67DD6FFE107C77C5F8BEA4A3D6771B6026EFC51BD4A9B26C66C8791C1EF48965" Last-Modified: Thu, 20 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10306 Expires: Sat, 22 Jun 2024 04:22:20 GMT Date: Sat, 22 Jun 2024 01:30:34 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 6720792332fb717894b4e5221fdc3d86 f79b1d3611fb53cea950acb15000473ae7174149 67dd6ffe107c77c5f8bea4a3d6771b6026efc51bd4a9b26c66c8791c1ef48965 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "67DD6FFE107C77C5F8BEA4A3D6771B6026EFC51BD4A9B26C66C8791C1EF48965" Last-Modified: Thu, 20 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10306 Expires: Sat, 22 Jun 2024 04:22:20 GMT Date: Sat, 22 Jun 2024 01:30:34 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (2)

Detections

JavaScript (0)

HTTP Transactions (7)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers