Report - mhsonsco.com/ab/hon.txt

Report Overview

Submitted URL
mhsonsco.com/ab/hon.txt
IP
103.83.81.68
ASN
#135822 Ovi Hosting Pvt Ltd
Submitted
2024-04-24 03:19:50
Access
public
Website Title
mhsonsco.com/ab/hon.txt
Final URL
mhsonsco.com/ab/hon.txt
Tags
urlquery detections
Suspicious - Base64 encoded file

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mhsonsco.com	unknown	2020-09-09	2020-09-09	2024-04-17	918 B	325 kB	103.83.81.68

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	mhsonsco.com/ab/hon.txt	Detects an base64 encoded executable with reversed characters

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	mhsonsco.com	Sinkholed
2024-04-24	medium	mhsonsco.com	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	mhsonsco.com	Sinkholed
2024-04-24	medium	mhsonsco.com	Sinkholed

ThreatFox

No alerts detected

Files detected

URL
mhsonsco.com/ab/hon.txt
IP
103.83.81.68
ASN
#135822 Ovi Hosting Pvt Ltd

File type
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Size
243 kB (243200 bytes)
Hash
ab696103426e266ed3729c899e11e778
12aa01403e8f348853598d6da5b304da02cc3d57
7151fdf1eb6797e332cdd21c6084e1b338f84fb6652284599370cf609776a676

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

mhsonsco.com/ab/hon.txt

103.83.81.68

200 OK

324 kB

URL User Request GET HTTP/2
mhsonsco.com/ab/hon.txt
IP
103.83.81.68:443
ASN
#135822 Ovi Hosting Pvt Ltd

Certificate
IssuerLet's Encrypt
Subjectmhsonsco.com
Fingerprint7B:E2:27:21:36:02:D4:73:72:9C:4A:97:B7:56:74:5E:65:8F:45:24
ValidityWed, 20 Mar 2024 10:41:22 GMT - Tue, 18 Jun 2024 10:41:21 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
324 kB (324268 bytes)
Hash
0d6fbef49d9f851744bb2f2bbe2f69ae
aecc20031a5032652f3bb9a8f0c2492d12df75a0
0174bbf69f15eda1f7b69a4b102fdecfdf8a3128c52442f9358945f33688d60f

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Base64 encoded file
Public Nextron YARA rules	malware	Detects an base64 encoded executable with reversed characters
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /ab/hon.txt HTTP/1.1
Host: mhsonsco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Wed, 24 Apr 2024 00:33:03 GMT
accept-ranges: bytes
content-length: 324268
content-type: text/plain
date: Wed, 24 Apr 2024 03:23:00 GMT
server: Apache
X-Firefox-Spdy: h2

mhsonsco.com/favicon.ico

103.83.81.68

404 Not Found

315 B

URL GET HTTP/2
mhsonsco.com/favicon.ico
IP
103.83.81.68:443
ASN
#135822 Ovi Hosting Pvt Ltd

Requested by
https://mhsonsco.com/ab/hon.txt
Certificate
IssuerLet's Encrypt
Subjectmhsonsco.com
Fingerprint7B:E2:27:21:36:02:D4:73:72:9C:4A:97:B7:56:74:5E:65:8F:45:24
ValidityWed, 20 Mar 2024 10:41:22 GMT - Tue, 18 Jun 2024 10:41:21 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mhsonsco.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mhsonsco.com/ab/hon.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
content-length: 315
content-type: text/html; charset=iso-8859-1
date: Wed, 24 Apr 2024 03:23:01 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers