Report - possess-probably-coupon-cure.trycloudflare.com/ksa.hta

Report Overview

Visited public
2025-02-15 12:16:10
Tags
URL
possess-probably-coupon-cure.trycloudflare.com/ksa.hta
Finishing URL
about:privatebrowsing
IP / ASN
104.16.230.132
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
possess-probably-coupon-cure.trycloudflare.com	unknown	2018-07-07	2025-02-13	2025-02-13	520 B	821 B	104.16.230.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-02-15	medium	possess-probably-coupon-cure.trycloudflare.com/ksa.hta	Generic ASP webshell which uses any eval/exec function

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

possess-probably-coupon-cure.trycloudflare.com/ksa.hta

104.16.230.132

200 OK

473 B

URL User Request GET HTTP/2
possess-probably-coupon-cure.trycloudflare.com/ksa.hta
IP
104.16.230.132:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjecttrycloudflare.com
FingerprintA3:91:E4:2F:50:FC:22:0D:84:72:84:EE:DD:EA:F6:A9:31:44:61:CB
ValidityWed, 25 Dec 2024 16:01:25 GMT - Tue, 25 Mar 2025 17:01:15 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
473 B (473 bytes)
Hash
0add2652b2dbc28e5e44d2562344d240
a8e1f1dac4d776704b2fbcfd5df19494e534165a
a4ef09ba22f4216b9d0977b74577f0a2ba000a5cbf3d44d11d250a45f05c9b86

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Generic ASP webshell which uses any eval/exec function

HTTP Headers

GET /ksa.hta HTTP/1.1
Host: possess-probably-coupon-cure.trycloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 15 Feb 2025 12:15:41 GMT
content-type: application/hta
content-length: 473
cf-ray: 912539873a9856bb-OSL
cf-cache-status: DYNAMIC
accept-ranges: bytes
etag: "139ad686d54bc6f07a1002f5638a7b91-1739180860-473"
last-modified: Mon, 10 Feb 2025 09:47:40 GMT
vary: Accept-Encoding
server: cloudflare
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers