Report - 146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548

Report Overview

Visited public
2024-01-03 15:07:20
Tags
URL
146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548
Finishing URL
146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548
IP / ASN
146.70.124.102
#0
Title
146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
146.70.124.102	unknown	unknown	No data	No data	858 B	1.8 kB	146.70.124.102

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-01-03 15:06:51	low	146.70.124.102	Client IP	ET INFO Simplehelp Remote Administration Suite Default SSL Certificate Observed
2024-01-03 15:06:51	low	146.70.124.102	Client IP	ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-01-03	medium	146.70.124.102	Sinkholed
2024-01-03	medium	146.70.124.102	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548

146.70.124.102

200 OK

11 B

URL User Request GET HTTP/1.1
146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548
IP
146.70.124.102:80
ASN
#0

File type
ASCII text, with no line terminators
Size
11 B (11 bytes)
Hash
271563b96fbbff5dc3e04656f3f18923
7f6800a9d6112bf5c360d56f3b0c5c616260fee8
b482d2aace7286c78a565879c3ac49b772e9bd9d003bed856542c2cee1049b22

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	low	ET INFO Simplehelp Remote Administration Suite HTTP Server Value in Response

HTTP Headers

GET /access/JWrapper-Windows64JRE-version.txt?time=900425548 HTTP/1.1
Host: 146.70.124.102
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 11
Last-Modified: Mon, 21 Feb 2022 11:56:25 GMT
Cache-Control: private, must-revalidate
Pragma: private
Server: SimpleHelp/SSuite-5-3-20220221-114538

146.70.124.102/favicon.ico

146.70.124.102

200 OK

1.3 kB

URL GET HTTP/1.1
146.70.124.102/favicon.ico
IP
146.70.124.102:80
ASN
#0

Requested by
http://146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.3 kB (1342 bytes)
Hash
7f492bbf27316c2875d877ff4283b4c9
4bd069a28f9b76a1f4d54441b442cf320ebecd7b
d29045c015ebac571f76c7dc33592f4690c817a696d355ad1328ecdeb4511bfc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 146.70.124.102
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://146.70.124.102/access/JWrapper-Windows64JRE-version.txt?time=900425548
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
Content-Length: 1342
Last-Modified: Mon, 21 Feb 2022 11:46:03 GMT
Cache-Control: private, must-revalidate
Pragma: private
Server: SimpleHelp/SSuite-5-3-20220221-114538

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers