Report - c5.kemono.su/data/27/c0/27c0cb96c56f56393882f965cb1556e75cda4e324001a829d54b8825627af592.zip?f=EWMTBAG-0.1-mac.zip

Report Overview

Visitedpublic

2024-06-07 13:18:54

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
c5.kemono.su	unknown	2022-08-25	2023-10-22 01:01:41	2024-06-04 14:25:19	1.2 kB	965 B	91.149.227.5

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-06-07 13:18:32	medium	Client IP	91.149.227.5	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
2024-06-07 13:18:32	medium	Client IP	91.149.227.5	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

c5.kemono.su/

91.149.227.5

162 B

URL HTTPS

c5.kemono.su/

IP / ASN

91.149.227.5

#200508 Sorok76 Ltd

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-04-05

Last Seen2025-07-11

Times Seen131096

Size162 B (162 bytes)

MD54f8e702cc244ec5d4de32740c0ecbd97

SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

Detections

Analyzer	Verdict	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET / HTTP/1.1
Host: c5.kemono.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 07 Jun 2024 13:18:32 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://c5.kemono.su/

c5.kemono.su/

91.149.227.5

2 B

URL HTTPS

c5.kemono.su/

IP / ASN

91.149.227.5

#200508 Sorok76 Ltd

Requested byN/A

Resource Info

File typeASCII text, with no line terminators

First Seen2023-03-09

Last Seen2025-08-07

Times Seen109695

Size2 B (2 bytes)

MD5e0aa021e21dddbd6d8cecec71e9cf564

SHA19ce3bd4224c8c1780db56b4125ecf3f24bf748b7

SHA256565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Detections

Analyzer	Verdict	Alert
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
suricata	medium	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related

HTTP Headers

GET / HTTP/1.1
Host: c5.kemono.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 07 Jun 2024 13:18:33 GMT
content-type: text/html
content-length: 2
X-Firefox-Spdy: h2

GET c5.kemono.su/data/27/c0/27c0cb96c56f56393882f965cb1556e75cda4e324001a829d54b8825627af592.zip?f=EWMTBAG-0.1-mac.zip

0.0.0.0

0 B

URL User Request GET HTTPS

c5.kemono.su/data/27/c0/27c0cb96c56f56393882f965cb1556e75cda4e324001a829d54b8825627af592.zip?f=EWMTBAG-0.1-mac.zip

IP / ASN

0.0.0.0

Requested byN/A

Resource Info

File typeN/A

First Seen0001-01-01

Last Seen2025-08-07

Times Seen5707014

Size0 B (0 bytes)

MD5d41d8cd98f00b204e9800998ecf8427e

SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate Info

IssuerLet's Encrypt

Subjectc5.kemono.su

FingerprintE0:94:A6:09:AA:F8:57:B4:39:4A:9E:69:CB:C4:A5:C3:54:90:06:22

ValidityWed, 17 Apr 2024 23:30:23 GMT - Tue, 16 Jul 2024 23:30:22 GMT

HTTP Headers

GET /data/27/c0/27c0cb96c56f56393882f965cb1556e75cda4e324001a829d54b8825627af592.zip?f=EWMTBAG-0.1-mac.zip HTTP/1.1
Host: c5.kemono.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 07 Jun 2024 13:18:32 GMT
content-type: application/zip
content-length: 135019668
last-modified: Mon, 13 May 2024 15:05:16 GMT
etag: "66422c2c-80c3c94"
content-disposition: inline; filename=EWMTBAG-0.1-mac.zip
access-control-allow-origin: https://kemono.su
access-control-allow-methods: GET, OPTIONS
access-control-allow-headers: *
cache-control: public, max-age=2592000, s-maxage=2592000
accept-ranges: bytes
X-Firefox-Spdy: h2