Report Overview
Visitedpublic
2026-03-14 12:57:38
Tags
Submit Tags
URL
meta-mask.me
Finishing URL
wintermuteloop.com/#/register?ref=686977
IP / ASN
54.215.31.113
Title
WINTERMUTE
Detections
urlquery
0
Network Intrusion Detection
5
Threat Detection Systems
8
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
wintermuteloop.com 60 alert(s) on this Host | unknown | 2025-12-17 | 2026-02-26 | 2026-02-26 | 10 kB | 2.5 MB |  188.114.97.1 |  |
api.wintermuteloop.com 30 alert(s) on this Host | unknown | 2025-12-17 | 2026-02-26 | 2026-02-26 | 5.9 kB | 168 kB | 188.114.97.1 | |
meta-mask.me 2 alert(s) on this Host | unknown | 2025-10-11 | 2026-03-14 | 2026-03-14 | 481 B | 11 kB | 54.215.31.113 | |
ip.ddnspod.com | 4307005 | 2019-10-25 | 2025-04-05 | 2026-03-08 | 1.4 kB | 0 B | 0.0.0.0 | |
fonts.gstatic.com | unknown | 2008-02-11 | 2014-04-02 | 2026-03-08 | 1.7 kB | 65 kB | 142.251.142.227 | |
worldtimeapi.org | 18362 | 2018-06-28 | 2018-11-05 | 2026-03-12 | 1.5 kB | 0 B | 0.0.0.0 | |
sc-static.net | 3142 | 2017-03-16 | 2017-09-05 | 2026-03-11 | 419 B | 59 kB | 3.163.248.4 |   |
telegram.org | 499 | 2003-12-15 | 2013-12-18 | 2026-03-11 | 426 B | 115 kB |  149.154.167.99 |  |
Cloudflare (CDN)
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.Amazon CloudFront (CDN)
Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.Amazon Web Services (PaaS)
Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.Nginx:1.18.0 (Web servers, Reverse proxies)
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
| Timestamp | Severity | Source IP | Destination IP | Alert |
|---|---|---|---|---|
| medium | 104.18.28.108 | Client IP | ET INFO TLS Handshake Failure | |
| medium | 104.18.28.108 | Client IP | ET INFO TLS Handshake Failure | |
| medium | 104.18.29.108 | Client IP | ET INFO TLS Handshake Failure | |
| medium | 104.18.28.108 | Client IP | ET INFO TLS Handshake Failure | |
| medium | 104.18.29.108 | Client IP | ET INFO TLS Handshake Failure |
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Hagezi Threat Feed | wintermuteloop.com | malicious | Sinkholed |
| Quad9 DNS | wintermuteloop.com | malicious | Sinkholed |
| DNS4EU | wintermuteloop.com | malicious | Sinkholed |
| DNS4EU | api.wintermuteloop.com | malicious | Sinkholed |
| Hagezi Threat Feed | api.wintermuteloop.com | malicious | Sinkholed |
| Quad9 DNS | api.wintermuteloop.com | malicious | Sinkholed |
| Quad9 DNS | meta-mask.me | malicious | Sinkholed |
| DNS4EU | meta-mask.me | malicious | Sinkholed |
JavaScript (110)
No JavaScripts
HTTP Transactions (42)
| URL | IP | Response | Size |
|---|