YARAhub by abuse.ch Detects SocGholish obfuscated variant first observed in July 2022
Verdictmalware
Severitymedium
WEBSITE ANALYSIS REPORT
http://asl.live
public
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://asl.live
- Submitted IP / ASN
104.21.30.34 AS13335 · Cloudflare, Inc.
- Final URL
- https://www.asl.live/
- Final IP / ASN
- 104.21.30.34 AS13335 · CLOUDFLARENET
Final page
- Page title
- ASL Live
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 998 B (998 bytes)
Detections
Activity
- HTTP requests
- 223
- Observed hosts
- 20
- Script records
- 170
Estimated HTTP data
- Sent
- ~238.2 KB
- Received
- ~18.93 MB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
Threat Detection Systems
2DNS4EU Sinkholed
VerdictMalicious
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| use.fontawesome.com | 6983 | 2012-10-18 | 2017-01-30 | 2026-10-05 | 1.6 KB | 207.1 KB | 172.67.142.245 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| fonts.googleapis.com | 313 | 2005-01-25 | 2012-05-23 | 2026-10-04 | 898 B | 74.3 KB |  142.250.178.106 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| www.asl.live 68 alerts | N/A | N/A | N/A | N/A | 40.8 KB | 6.09 MB | 104.21.30.34 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. jQuery Migrate:3.4.1 JavaScript libraries Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9. Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. WordPress Site Editor Page builders Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor. Amazon S3 CDN Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface. Super Page Cache Caching, WordPress plugins Super Page Cache is a static caching plugin for WordPress. Slick JavaScript libraries Not recorded Essential Blocks WordPress plugins Essential Blocks is a Gutenberg Blocks page builder plugin that adds extra functionality to the WordPress Block Editor. Lightbox JavaScript libraries Lightbox is small javascript library used to overlay images on top of the current page. Mailcheck:1.1.2 JavaScript libraries Mailcheck is a JavaScript library designed to address the issue of misspelled email addresses during user input. PHP Programming languages PHP is a general-purpose scripting language used for web development. MySQL Databases MySQL is an open-source relational database management system. jQuery JavaScript libraries jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax. Cloudflare Browser Insights Analytics, RUM Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users. WordPress:7.1.3 CMS, Blogs WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system. WordPress Block Editor Page builders Sites using the WordPress Block Editor, also known as Gutenberg. punycode:1.0.0 JavaScript libraries A robust Punycode converter that fully complies to RFC 3492 and RFC 5891, and works on nearly all JavaScript platforms. |
| 5cf66a75b73e.w.hcaptcha.com | N/A | N/A | N/A | N/A | 491 B | 0 B | Not recorded | |
| www.gstatic.com | 146047 | 2008-02-11 | 2012-05-29 | 2026-10-04 | 2.1 KB | 1.70 MB | 142.250.178.99 | |
| js.stripe.com | 7985 | 1995-09-12 | 2012-09-30 | 2026-10-05 | 6.9 KB | 3.78 MB | 151.101.0.176 | Varnish Caching Varnish is a reverse caching proxy. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Fastly CDN Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video & streaming services. Stripe Payment processors Stripe offers online payment processing for internet businesses as well as fraud prevention, invoicing and subscription management. |
| www.google.com | 22 | 1997-09-15 | 2015-05-10 | 2026-10-04 | 1.2 KB | 56.4 KB | 142.251.155.119 | |
| r.stripe.com | 19942 | 1995-09-12 | 2021-03-08 | 2026-10-09 | 3.0 KB | 0 B | Not recorded | |
| fonts.gstatic.com | N/A | 2008-02-11 | 2014-04-02 | 2026-10-04 | 3.3 KB | 217.3 KB | 142.250.178.99 | |
| www.googletagmanager.com | 283 | 2011-11-11 | 2012-10-04 | 2026-10-04 | 474 B | 792.8 KB | 142.250.178.72 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| www.zeffy.com | 230714 | 2005-03-16 | 2019-07-03 | 2026-10-08 | 83.1 KB | 5.81 MB | 104.18.20.101 | Node.js Programming languages Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Express Web frameworks, Web servers Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs. Plaid Payment processors, Miscellaneous Plaid is a fintech company that facilitates communication between financial services apps and users' banks and credit card providers. Linkedin Ads Advertising Linkedin Ads is a paid marketing tool that offers access to Linkedin social networks through various sponsored posts and other methods. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Canny Issue trackers Canny is a cloud-based solution that helps small to large businesses collect, analyse, prioritise and track user feedback to make informed product decisions. PayPal Payment processors PayPal is an online payments system that supports online money transfers and serves as an electronic alternative to traditional paper methods like checks and money orders. Amazon S3 CDN Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface. Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. Google Tag Manager Tag managers Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app. React JavaScript frameworks React is an open-source JavaScript library for building user interfaces or UI components. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. Webpack Miscellaneous Webpack is an open-source JavaScript module bundler. Next.js JavaScript frameworks, Web frameworks Next.js is a React framework for developing single page Javascript applications. |
| js.hs-scripts.com | 18499 | 2016-07-11 | 2016-08-09 | 2026-10-05 | 456 B | 3.7 KB | 104.16.138.209 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. |
| api.zeffy.com | 1351864 | 2005-03-16 | 2022-04-12 | 2026-10-08 | 1.8 KB | 2.9 KB | 104.18.20.101 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. |
| js.hubspotfeedback.com | 96207 | 2017-12-18 | 2018-02-26 | 2026-10-07 | 465 B | 26.4 KB | 104.17.79.250 | Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Amazon CloudFront CDN Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds. |
| maps.googleapis.com | 3442 | 2005-01-25 | 2012-05-22 | 2026-10-05 | 567 B | 0 B | Not recorded | |
| consentcdn.cookiebot.com | 35798 | 2010-01-21 | 2018-05-23 | 2026-10-05 | 577 B | 1.2 KB |  2.20.163.160 | Akamai CDN Akamai is global content delivery network (CDN) services provider for media and software delivery, and cloud security solutions. |
| zeffy-scripts.s3.ca-central-1.amazonaws.com | 3106774 | 2005-08-18 | 2022-08-14 | 2026-10-07 | 510 B | 2.6 KB |  16.12.5.90 | Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. Amazon S3 CDN Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface. |
| challenges.cloudflare.com | 11393 | 2009-02-17 | 2021-10-20 | 2026-10-04 | 2.5 KB | 85.6 KB | 104.18.95.41 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| asl.live 1 alerts | N/A | N/A | 2026-10-04 | 2026-10-04 | 477 B | 815 B | 104.21.30.34 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| consent.cookiebot.com | 29038 | 2010-01-21 | 2014-02-26 | 2026-10-05 | 1.1 KB | 119.1 KB | 23.33.119.72 |