Report - ppg.zip/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973593&pdata=http:/

Report Overview

Visited public
2025-05-10 09:29:48
Tags
URL
ppg.zip/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973593&pdata=http:/
Finishing URL
paperplatoon.zip/
IP / ASN
104.21.21.115
#13335 CLOUDFLARENET
Title
dotZIP

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ppg.zip	unknown	2024-07-15	2024-12-19	2025-04-27	1.0 kB	36 kB	188.114.96.1
paperplatoon.zip	unknown	2024-07-17	2024-12-16	2025-05-08	2.0 kB	61 kB	193.108.130.12

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-10 09:29:26	low	Client IP	188.114.96.1	ET INFO HTTP Request to a *.zip Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (6)

	URL	From	Size	First Seen	Last Seen
	paperplatoon.zip/	ScriptElement	692 B	2025-05-10	2025-05-10
Pretty URL paperplatoon.zip/ IP 193.108.130.12 ASN #965 WEBHOSTINGHOLDINGS Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-10 09:29 Last Seen2025-05-10 09:29 Times Seen1 Hash 8246d5c8ddc2183d435de9ae0f2759a8 688045b2d3d529ea322e10aed024e26ca8660b48 f6770854c4f9bf48d8fdddcc6962cc8bc65ae7eda62f56688ab4e158ebf0f7dc Loading...

	paperplatoon.zip/	ScriptElement	728 B	2025-05-10	2025-05-10
Pretty URL paperplatoon.zip/ IP 193.108.130.12 ASN #965 WEBHOSTINGHOLDINGS Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-10 09:29 Last Seen2025-05-10 09:29 Times Seen1 Hash 7e903a1d1fb2e1f6cb94cd7bd29827c6 d79a009ab769f30add567b298426aa235efec14c bda3e8c0d888333dbd52b15c45faa522aabd3fbabc1362f184b73b0acf490aa9 Loading...

	paperplatoon.zip/	ScriptElement	2.3 kB	2025-05-10	2025-05-10
Pretty URL paperplatoon.zip/ IP 193.108.130.12 ASN #965 WEBHOSTINGHOLDINGS Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-10 09:29 Last Seen2025-05-10 09:29 Times Seen1 Hash 390145a7d2279b077df0aa93f3c94d4b 7326308a485b8208d2e543e36997d338113af6f7 ae24c5b50838088e0a076163e622fd86b34486f8fd839c5d9a4ff809fbd72147 Loading...

	paperplatoon.zip/	ScriptElement	1.1 kB	2025-05-10	2025-05-10
Pretty URL paperplatoon.zip/ IP 193.108.130.12 ASN #965 WEBHOSTINGHOLDINGS Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-10 09:29 Last Seen2025-05-10 09:29 Times Seen1 Hash ed4997f756d837b90457ddf5a10c62f6 41cdc8f267a39e1347751cb3bf44d0f52596dc1c e60361509143f37e58731a28d5f3bb5922ac069356551f2cb2188903e1a05bbe Loading...

	paperplatoon.zip/	ScriptElement	677 B	2025-05-10	2025-05-10
Pretty URL paperplatoon.zip/ IP 193.108.130.12 ASN #965 WEBHOSTINGHOLDINGS Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-10 09:29 Last Seen2025-05-10 09:29 Times Seen1 Hash 6f7379bf9a34ab7aaeaaf9163d5ef114 072b16d1933e278b8121a1db7d0773c9d9866074 3146b4e218ea5073ce99b69ec46cc49440bcca85699b78c2a48e9a777836dc06 Loading...

	paperplatoon.zip/inc/assets/platoon.js	ScriptElement	23 kB	2023-03-07	2025-05-19
Pretty URL paperplatoon.zip/inc/assets/platoon.js IP 193.108.130.12 ASN #965 WEBHOSTINGHOLDINGS Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:16 Last Seen2025-05-19 22:38 Times Seen1374 Hash 00debcf6cf0789a19cee2278011afcd4 8017f8b1869077db728573f1ca4684a00af69462 faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6 Loading...

HTTP Transactions (6)

URL IP Response Size

ppg.zip/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973593&pdata=http:/

188.114.96.1

302 Found

18 kB

URL User Request GET
ppg.zip/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973593&pdata=http:/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectppg.zip
FingerprintA4:EE:B9:4F:72:2A:47:2E:D5:00:59:2D:04:27:AD:21:F3:2E:54:02
ValidityFri, 02 May 2025 11:05:18 GMT - Thu, 31 Jul 2025 12:03:56 GMT

File type

Size
18 kB (17509 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6973593&pdata=http:/ HTTP/1.1
Host: ppg.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sat, 10 May 2025 09:29:26 GMT
content-length: 0
location: http://ppg.zip/
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KQWt80xwjVJwLBQCvd%2FL1Bnx1OTOPRYkI6zlGegTYozyjUdJ%2FCtCqECUQoh8Uwb6MxN02EVi7mhLr2edG8WMDHFV5aTqRYIWsO9QJOvuHLbILzsdbBCQi9f3"}]}
set-cookie: wssplashchk=4619ed5acde2509f2e32fd59cbd49b84e481b21f.1746872966.0; HttpOnly; SameSite=Lax; Path=/; Domain=ppg.zip; Max-Age=3600
cf-ray: 93d86983395bb529-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ppg.zip/

188.114.96.1

301 Moved Permanently

18 kB

URL User Request GET
ppg.zip/
IP
188.114.96.1:80
ASN
#13335 CLOUDFLARENET

File type

Size
18 kB (17509 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	low	ET INFO HTTP Request to a *.zip Domain

HTTP Headers

GET / HTTP/1.1
Host: ppg.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: wssplashchk=4619ed5acde2509f2e32fd59cbd49b84e481b21f.1746872966.0
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Sat, 10 May 2025 09:29:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
location: https://paperplatoon.zip
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NzZPc2JtOhJRzui9ohJir14HrPG%2BsQSGO8t%2Bkl3hk0UD0SsU5Yy5SK2WzJ8olnq3wY8U7gU7Q5RImimjnWQ6ftsI3BAz8UIGCvYqaq%2BtNIjkBafctROiXiS1"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 93d869841e8cb505-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=578&min_rtt=578&rtt_var=289&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=467&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

paperplatoon.zip/

193.108.130.12

200 OK

18 kB

URL User Request GET
paperplatoon.zip/
IP
193.108.130.12:443
ASN
#965 WEBHOSTINGHOLDINGS

Certificate
IssuerLet's Encrypt
Subjectpaperplatoon.zip
FingerprintBF:4C:AE:29:E2:81:77:D8:32:D7:7F:9E:86:2C:80:29:B2:8C:29:6C
ValidityFri, 09 May 2025 20:50:45 GMT - Thu, 07 Aug 2025 20:50:44 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (1088)
Size
18 kB (17509 bytes)
Hash
d4217dc1a877d898854a907609aa85e5
e8a801fb051bd8028d6f3f32a8e92c37cc8e6794
4fd488a27cb5c5d2acdf14153bcbe6c6271f5cb1c3e58b138c8dc8c415aa8861

HTTP Headers

GET / HTTP/1.1
Host: paperplatoon.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-powered-by: PHP/8.2.28
set-cookie: PHPSESSID=lbmjta25a5hv7norit543roge4; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 4435
content-encoding: br
vary: Accept-Encoding
date: Sat, 10 May 2025 09:29:26 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

paperplatoon.zip/inc/assets/platoon.js

193.108.130.12

200 OK

23 kB

URL GET
paperplatoon.zip/inc/assets/platoon.js
IP
193.108.130.12:443
ASN
#965 WEBHOSTINGHOLDINGS

Requested by
https://paperplatoon.zip/
Certificate
IssuerLet's Encrypt
Subjectpaperplatoon.zip
FingerprintBF:4C:AE:29:E2:81:77:D8:32:D7:7F:9E:86:2C:80:29:B2:8C:29:6C
ValidityFri, 09 May 2025 20:50:45 GMT - Thu, 07 Aug 2025 20:50:44 GMT

File type
ASCII text, with very long lines (23002)
Size
23 kB (23364 bytes)
Hash
00debcf6cf0789a19cee2278011afcd4
8017f8b1869077db728573f1ca4684a00af69462
faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6

HTTP Headers

GET /inc/assets/platoon.js HTTP/1.1
Host: paperplatoon.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://paperplatoon.zip/
Cookie: PHPSESSID=lbmjta25a5hv7norit543roge4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/javascript
last-modified: Mon, 23 Dec 2024 22:55:10 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 5735
date: Sat, 10 May 2025 09:29:26 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

paperplatoon.zip/inc/fonts/Amazdoomright-o1B0.ttf

193.108.130.12

200 OK

14 kB

URL GET
paperplatoon.zip/inc/fonts/Amazdoomright-o1B0.ttf
IP
193.108.130.12:443
ASN
#965 WEBHOSTINGHOLDINGS

Requested by
https://paperplatoon.zip/
Certificate
IssuerLet's Encrypt
Subjectpaperplatoon.zip
FingerprintBF:4C:AE:29:E2:81:77:D8:32:D7:7F:9E:86:2C:80:29:B2:8C:29:6C
ValidityFri, 09 May 2025 20:50:45 GMT - Thu, 07 Aug 2025 20:50:44 GMT

File type
TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1990-1996 ParaGraphRegularAmazDooMRight:Version 1.00Version 1.00 November 28, 2009
Size
14 kB (14044 bytes)
Hash
8b6d3979fc9b12e6d40211e99510f8cb
b66096dd3490f69af3519977436a7f340643a6a8
092816acab6180c270bcb3b7b98d46a6bf3b690453285470bd555d2a1c350fe4

HTTP Headers

GET /inc/fonts/Amazdoomright-o1B0.ttf HTTP/1.1
Host: paperplatoon.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://paperplatoon.zip/
Cookie: PHPSESSID=lbmjta25a5hv7norit543roge4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
cache-control: public, max-age=604800
expires: Sat, 17 May 2025 09:29:26 GMT
content-type: font/ttf
last-modified: Sun, 27 Oct 2024 19:54:56 GMT
accept-ranges: bytes
content-length: 14044
date: Sat, 10 May 2025 09:29:26 GMT
server: LiteSpeed

paperplatoon.zip/inc/favicon.ico

193.108.130.12

200 OK

4.3 kB

URL GET
paperplatoon.zip/inc/favicon.ico
IP
193.108.130.12:443
ASN
#965 WEBHOSTINGHOLDINGS

Requested by
https://paperplatoon.zip/
Certificate
IssuerLet's Encrypt
Subjectpaperplatoon.zip
FingerprintBF:4C:AE:29:E2:81:77:D8:32:D7:7F:9E:86:2C:80:29:B2:8C:29:6C
ValidityFri, 09 May 2025 20:50:45 GMT - Thu, 07 Aug 2025 20:50:44 GMT

File type
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Size
4.3 kB (4286 bytes)
Hash
97c093711b735c5d220e2bc5117fe86a
45faa0ad95a7e99b062efc7808a22135ee4e7595
98a59441b46851adcac9174a33831fc1191c509e7793c4d7768530ac26f84a9a

HTTP Headers

GET /inc/favicon.ico HTTP/1.1
Host: paperplatoon.zip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://paperplatoon.zip/
Cookie: PHPSESSID=lbmjta25a5hv7norit543roge4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
cache-control: public, max-age=604800
expires: Sat, 17 May 2025 09:29:27 GMT
content-type: image/x-icon
last-modified: Wed, 18 Dec 2024 20:56:41 GMT
accept-ranges: bytes
content-length: 4286
date: Sat, 10 May 2025 09:29:27 GMT
server: LiteSpeed

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (6)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET