Report - irbis-nbuv.gov.ua/cgi-bin/irbis64r_81/cgiirbis_64.exe?C21COM=2&I21DBN=ARD&P21DBN=ARD&Z21ID=&Image_file_name=DOC/2011/11OVVSHU.zip&IMAGE_FILE_DOWNLOAD=1

Report Overview

Visited public
2023-11-01 19:03:38
Tags
URL
irbis-nbuv.gov.ua/cgi-bin/irbis64r_81/cgiirbis_64.exe?C21COM=2&I21DBN=ARD&P21DBN=ARD&Z21ID=&Image_file_name=DOC/2011/11OVVSHU.zip&IMAGE_FILE_DOWNLOAD=1
Finishing URL
about:privatebrowsing
IP / ASN
194.44.11.130
#3255 State Enterprise Scientific and Telecommunication Centre Ukrainian Academic and Research Netw
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

4

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
irbis-nbuv.gov.ua	472263	unknown	2012-08-07 20:04:02	2023-11-01 16:21:30	523 B	48 kB	194.44.11.130
firefox-settings-attachments.cdn.mozilla.net	11509	1998-01-31	2019-11-30 10:32:57	2023-11-01 08:15:50	416 B	818 kB	34.117.121.53

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-01 19:03:22	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)
2023-11-01 19:03:22	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)
2023-11-01 19:03:22	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)
2023-11-01 19:03:22	low	Client IP	Internal IP	ETPRO INFO Observed DNS Query for Ukraine Domain (.ua)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
irbis-nbuv.gov.ua/cgi-bin/irbis64r_81/cgiirbis_64.exe?C21COM=2&I21DBN=ARD&P21DBN=ARD&Z21ID=&Image_file_name=DOC/2011/11OVVSHU.zip&IMAGE_FILE_DOWNLOAD=1
IP
194.44.11.130
ASN
#3255 State Enterprise Scientific and Telecommunication Centre Ukrainian Academic and Research Netw

File type
Zip archive data, at least v2.0 to extract, compression method=deflate\012- data
Size
48 kB (47560 bytes)
Hash
521541f6a9c941d4ace7c8ce5261455c
25bce346c005ded67e6545313cbff646bec872f6
020ac855fa897d1325c5ee6b8e332bb3d23f4fe842827308260bcbc2a4b87598

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	irbis-nbuv.gov.ua/cgi-bin/irbis64r_81/cgiirbis_64.exe?C21COM=2&I21DBN=ARD&P21DBN=ARD&Z21ID=&Image_file_name=DOC/2011/11OVVSHU.zip&IMAGE_FILE_DOWNLOAD=1	194.44.11.130	200 OK	48 kB
URL User Request GET HTTP/1.1 irbis-nbuv.gov.ua/cgi-bin/irbis64r_81/cgiirbis_64.exe?C21COM=2&I21DBN=ARD&P21DBN=ARD&Z21ID=&Image_file_name=DOC/2011/11OVVSHU.zip&IMAGE_FILE_DOWNLOAD=1 IP 194.44.11.130:80 ASN #3255 State Enterprise Scientific and Telecommunication Centre Ukrainian Academic and Research Netw File type Zip archive data, at least v2.0 to extract, compression method=deflate\012- data Size 48 kB (47560 bytes) Hash 521541f6a9c941d4ace7c8ce5261455c 25bce346c005ded67e6545313cbff646bec872f6 020ac855fa897d1325c5ee6b8e332bb3d23f4fe842827308260bcbc2a4b87598 HTTP Headers GET /cgi-bin/irbis64r_81/cgiirbis_64.exe?C21COM=2&I21DBN=ARD&P21DBN=ARD&Z21ID=&Image_file_name=DOC/2011/11OVVSHU.zip&IMAGE_FILE_DOWNLOAD=1 HTTP/1.1 Host: irbis-nbuv.gov.ua User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 19:03:02 GMT Server: Apache/2.4.35 (Win64) Content-Disposition: attachment; filename="11OVVSHU.zip" Content: Content-Length: 47560 Keep-Alive: timeout=5, max=50 Connection: Keep-Alive Content-Type: text/plain`

	firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/6c7d9b78-4642-461c-9b2d-b802ccd7a1d5.bin	34.117.121.53		817 kB
URL firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/6c7d9b78-4642-461c-9b2d-b802ccd7a1d5.bin IP 34.117.121.53:0 ASN #15169 GOOGLE File type data Size 817 kB (817083 bytes) Hash 6b5b15372ca108d4b33caf02ed016f3e 13df17583626a0987070dde4340f876d08c401c0 9c890391b90d43bf692755185bfa1780ee051467ae9a2775759d9866f4546664 HTTP Headers `GET /staging/addons-bloomfilters/6c7d9b78-4642-461c-9b2d-b802ccd7a1d5.bin HTTP/1.1 Host: firefox-settings-attachments.cdn.mozilla.net User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site TE: trailers` HTTP/2 200 OK x-guploader-uploadid: ABPtcPqJeb5K4rSm8QgCXHhECp-2B4jCBZylThqv1gweUS3onF0ncBQtvEDZAPJz9rJrX5IIKCiGWxW7gd6dcuJCvo4Lp4zJ4zbP x-goog-generation: 1690223885754624 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 817083 x-goog-hash: crc32c=NmyCHA==, md5=a1sVNyyhCNSzPK8C7QFvPg== x-goog-storage-class: STANDARD accept-ranges: bytes content-length: 817083 server: UploadServer date: Fri, 27 Oct 2023 10:21:36 GMT cache-control: public,max-age=604800 age: 463306 last-modified: Mon, 24 Jul 2023 18:38:05 GMT etag: "6b5b15372ca108d4b33caf02ed016f3e" content-type: application/octet-stream alt-svc: clear X-Firefox-Spdy: h2