Report - 79.127.126.20/MobileAppFiles/images/flight5.png

Report Overview

Visitedpublic

2024-02-01 01:46:31

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
79.127.126.20	unknown	unknown	2023-12-22 20:34:18	2024-01-03 12:45:15	787 B	5.7 kB	79.127.126.20

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-02-01	medium	79.127.126.20	Sinkholed
2024-02-01	medium	79.127.126.20	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET 79.127.126.20/MobileAppFiles/images/flight5.png

79.127.126.20

200 OK

3.7 kB

URL

79.127.126.20/MobileAppFiles/images/flight5.png

IP / ASN

79.127.126.20

#43754 Asiatech Data Transmission company

Requested byN/A

Resource Info

File typePNG image data, 309 x 309, 8-bit colormap, non-interlaced

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size3.7 kB (3730 bytes)

MD5ad2fa799cd7429753a02e488184df863

SHA1a5e929fd74196a1cb000b9aff3fd060a552f920d

SHA25629283538e4f678f698fa24e98b53ec6999ec62806d82bdc3c1ba48b9356b2847

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /MobileAppFiles/images/flight5.png HTTP/1.1
Host: 79.127.126.20
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Tue, 21 Apr 2020 15:47:36 GMT
Accept-Ranges: bytes
ETag: "4e10332ef417d61:0"
Server: Microsoft-IIS/10.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Date: Thu, 01 Feb 2024 01:46:08 GMT
Content-Length: 3730

GET 79.127.126.20/favicon.ico

79.127.126.20

404 Not Found

1.2 kB

URL

79.127.126.20/favicon.ico

IP / ASN

79.127.126.20

#43754 Asiatech Data Transmission company

Requested byhttp://79.127.126.20/MobileAppFiles/images/flight5.png

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-03-09

Last Seen2025-08-02

Times Seen22119

Size1.2 kB (1245 bytes)

MD55343c1a8b203c162a3bf3870d9f50fd4

SHA104b5b886c20d88b57eea6d8ff882624a4ac1e51d

SHA256dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 79.127.126.20
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://79.127.126.20/MobileAppFiles/images/flight5.png
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/10.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Date: Thu, 01 Feb 2024 01:46:08 GMT
Content-Length: 1245