Report - ion-msgid-book-french.trycloudflare.com/kak.hta

Report Overview

Visited public
2025-02-28 23:25:07
Tags
Submit Tags
URL
ion-msgid-book-french.trycloudflare.com/kak.hta
Finishing URL
about:privatebrowsing
IP / ASN
104.16.230.132
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ion-msgid-book-french.trycloudflare.com	unknown	2018-07-07	2025-02-28	2025-02-28	513 B	822 B	104.16.231.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-02-28	medium	ion-msgid-book-french.trycloudflare.com/kak.hta	Generic ASP webshell which uses any eval/exec function

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET ion-msgid-book-french.trycloudflare.com/kak.hta

104.16.231.132

200 OK

474 B

URL User Request GET HTTP/2
ion-msgid-book-french.trycloudflare.com/kak.hta
IP
104.16.231.132:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjecttrycloudflare.com
Fingerprint6D:66:63:23:0C:43:AA:38:11:4C:FA:5E:94:D6:0E:E3:93:A7:16:F5
ValiditySat, 22 Feb 2025 16:19:42 GMT - Fri, 23 May 2025 17:19:31 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
474 B (474 bytes)
Hash
d27d98218e6518457c0334baed573e95
3ac3eb96d37308c2cbb6232fe5a1032694701067
c672cf16f5dae03778c9f754af991591dd7f74e7047c84550238b4d527e86f1a

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Generic ASP webshell which uses any eval/exec function

HTTP Headers

GET /kak.hta HTTP/1.1
Host: ion-msgid-book-french.trycloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 28 Feb 2025 23:24:38 GMT
content-type: application/hta
content-length: 474
cf-ray: 91942b4ebc670b51-OSL
cf-cache-status: DYNAMIC
accept-ranges: bytes
etag: "3c2d0f738ba71040d68b4bd3f0a4123d-1740591616-474"
last-modified: Wed, 26 Feb 2025 17:40:16 GMT
vary: Accept-Encoding
server: cloudflare
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers