Report - 104.234.118.34/ippinstaller.exe

Report Overview

Visited public
2025-01-29 16:06:46
Tags
URL
104.234.118.34/ippinstaller.exe
Finishing URL
104.234.118.34/ippinstaller.exe
IP / ASN
104.234.118.34
#26042 FIBERSTATE
Title
104.234.118.34/ippinstaller.exe

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
104.234.118.34	unknown	unknown	2023-02-16	2023-04-20	780 B	2.3 kB	104.234.118.34

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-29 16:06:16	medium	Client IP	104.234.118.34	ET INFO Executable Download from dotted-quad Host

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-01-29	medium	104.234.118.34	Sinkholed
2025-01-29	medium	104.234.118.34	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

104.234.118.34/ippinstaller.exe

104.234.118.34

200 OK

904 B

URL User Request GET HTTP/1.1
104.234.118.34/ippinstaller.exe
IP
104.234.118.34:80
ASN
#26042 FIBERSTATE

File type
HTML document, ASCII text, with very long lines (2518)
Size
904 B (904 bytes)
Hash
3d1deff9fb9db8efe2e20abc8432ec1c
ca34510ccc4ddf96148061235b2f07ddafdc7acf
4c0f33609acaf9152a6d6370ce5ed427b0bb47815eb553c4f7a8dee41f8d5752

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	medium	ET INFO Executable Download from dotted-quad Host

HTTP Headers

GET /ippinstaller.exe HTTP/1.1
Host: 104.234.118.34
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 29 Jan 2025 16:06:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.27
Content-Encoding: gzip

104.234.118.34/favicon.ico

104.234.118.34

200 OK

904 B

URL GET HTTP/1.1
104.234.118.34/favicon.ico
IP
104.234.118.34:80
ASN
#26042 FIBERSTATE

Requested by
http://104.234.118.34/ippinstaller.exe

File type
HTML document, ASCII text, with very long lines (2518)
Size
904 B (904 bytes)
Hash
3d1deff9fb9db8efe2e20abc8432ec1c
ca34510ccc4ddf96148061235b2f07ddafdc7acf
4c0f33609acaf9152a6d6370ce5ed427b0bb47815eb553c4f7a8dee41f8d5752

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 104.234.118.34
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://104.234.118.34/ippinstaller.exe
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 29 Jan 2025 16:06:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.27
Content-Encoding: gzip

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers