Report - download.qt.io/official

Report Overview

Visitedpublic

2024-12-23 11:59:12

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
download.qt.io	681032	2013-10-05	2017-02-02	2024-12-21	498 B	1.6 kB	77.86.162.2
mirrors.dotsrc.org	411439	2003-04-15	2014-03-19	2024-12-21	512 B	1.7 MB	130.225.254.116

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

mirrors.dotsrc.org/qtproject/official_releases/jom/jom.zip

IP / ASN

130.225.254.116

#1835 FSKNET-DK Forskningsnettet - Danish network for Research and Education

File Overview

File TypeZip archive data, at least v2.0 to extract, compression method=deflate

Size1.7 MB (1696930 bytes)

MD54cd0e6fb721e063b24232bc9ecb6d130

SHA15551d95151dc8a8658d5b8a7ce40c6f64a4697db

SHA256d533c1ef49214229681e90196ed2094691e8c4a0a0bef0b2c901debcb562682b

Archive (5)

Modified	Filename	Size	MD5	File type
2023-08-08 18:49	changelog.txt	9.3 kB	4deb1e4ea18c5dae5ff63446b01dabbb	ASCII text, with CRLF line terminators
2023-06-23 11:46	ibjom.bat	192 B	9928512dbcab8a23f711f7a360379505	DOS batch file, ASCII text, with CRLF line terminators
2023-06-23 12:29	jom.exe	3.9 MB	cbd781462a5768b21eb457f892e84afa	PE32+ executable (console) x86-64, for MS Windows, 7 sections
2023-06-23 11:46	xgejom.bat	238 B	14ba8bc9f91f4a2395cf88c1caae3a12	DOS batch file, ASCII text, with CRLF line terminators
2023-06-23 11:46	xgejom.xml	663 B	889bf543998d378eb004096bbc26dd9b	XML 1.0 document, ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/66

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET download.qt.io/official_releases/jom/jom.zip

77.86.162.2

302 Found

250 B

URL

download.qt.io/official_releases/jom/jom.zip

IP / ASN

77.86.162.2

#29422 Telia Cygate Oy

Requested byN/A

Resource Info

File typeHTML document, ASCII text

First Seen2023-11-17

Last Seen2025-01-31

Times Seen13

Size250 B (250 bytes)

MD52bd2d2670135a41e072aafde9c8ae91a

SHA1cb98f49f57ee5890affe356bc93a0445c066934f

SHA2566dcbc126479d0b585daa6b14cb5544ca6cc14db293528b66ea1232115e235795

Certificate Info

IssuerDigiCert Inc

Subject*.qt.io

Fingerprint8C:26:04:94:5E:5A:3E:7E:97:B2:B1:12:D6:5E:DF:00:0F:24:39:EE

ValidityTue, 30 Jul 2024 00:00:00 GMT - Wed, 20 Aug 2025 23:59:59 GMT

HTTP Headers

GET /official_releases/jom/jom.zip HTTP/1.1
Host: download.qt.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Mon, 23 Dec 2024 11:58:47 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains;
X-Prefix: 91.90.40.0/21
X-AS: 50304
X-MirrorBrain-Mirror: dotsrc.org
X-MirrorBrain-Realm: region
Link: <https://download.qt.io/official_releases/jom/jom.zip.meta4>; rel=describedby; type="application/metalink4+xml", <https://download.qt.io/official_releases/jom/jom.zip.torrent>; rel=describedby; type="application/x-bittorrent", <https://mirrors.dotsrc.org/qtproject/official_releases/jom/jom.zip>; rel=duplicate; pri=1; geo=dk, <https://qt-mirror.dannhauer.de/official_releases/jom/jom.zip>; rel=duplicate; pri=2; geo=de, <https://mirror.accum.se/mirror/qt.io/qtproject/official_releases/jom/jom.zip>; rel=duplicate; pri=3; geo=se, <https://ftp.fau.de/qtproject/official_releases/jom/jom.zip>; rel=duplicate; pri=4; geo=de, <https://www.mirrorservice.org/sites/download.qt-project.org/official_releases/jom/jom.zip>; rel=duplicate; pri=5; geo=gb
Digest: MD5=TNDm+3IeBjskIyvJ7LbRMA==, SHA=VVHZUVHcioZY1binzkDG9kpGl9s=, SHA-256=1TPB70khQiloHpAZbtIJRpHoxKCgvvCyyQHevLViaCs=
Location: https://mirrors.dotsrc.org/qtproject/official_releases/jom/jom.zip
Content-Length: 250
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET mirrors.dotsrc.org/qtproject/official_releases/jom/jom.zip

130.225.254.116

200 OK

1.7 MB

URL

mirrors.dotsrc.org/qtproject/official_releases/jom/jom.zip

IP / ASN

130.225.254.116

#1835 FSKNET-DK Forskningsnettet - Danish network for Research and Education

Requested byN/A

Resource Info

File typeZip archive data, at least v2.0 to extract, compression method=deflate

First Seen2023-09-23

Last Seen2025-05-20

Times Seen37

Size1.7 MB (1696930 bytes)

MD54cd0e6fb721e063b24232bc9ecb6d130

SHA15551d95151dc8a8658d5b8a7ce40c6f64a4697db

SHA256d533c1ef49214229681e90196ed2094691e8c4a0a0bef0b2c901debcb562682b

Certificate Info

IssuerLet's Encrypt

Subjectmirrors.dotsrc.org

Fingerprint19:FA:D8:76:95:A5:60:04:39:D6:84:5F:63:7E:1E:E1:28:05:0F:78

ValidityMon, 28 Oct 2024 04:06:44 GMT - Sun, 26 Jan 2025 04:06:43 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/66

HTTP Headers

GET /qtproject/official_releases/jom/jom.zip HTTP/1.1
Host: mirrors.dotsrc.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0 (Ubuntu)
date: Mon, 23 Dec 2024 11:58:48 GMT
content-type: application/zip
content-length: 1696930
last-modified: Tue, 05 Sep 2023 12:36:25 GMT
etag: "64f720c9-19e4a2"
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin
accept-ranges: bytes
X-Firefox-Spdy: h2