Report Overview
Visitedpublic
2025-08-21 12:52:56
Submit Tags
URL
oikjnv.tqgqnobicky.ru/5b4MHEwfyfY@iEmO/$jgomez@slurpmail.net
Finishing URL
oikjnv.tqgqnobicky.ru/2croi74efi9dy4?id=d0d474867a928f36d49cfc33-de65c49df1708-c874d14fb-ef34b916973b780-a31379627b3e-1c3a9213baffab7-43eac0580-40247f73f3b3689-ff71d42f6d0-52013ffd-789514ab61b5e6-adca99a81bb896d-501b7969704f-21f928533dbb38d4
IP / ASN
104.21.96.1
Title
Login To Your Secure Account
Phishing - Microsoft
Suspicious - Anti-debugging code
Phishing - Tycoon Phishing Kit
Detections
urlquery
4
Network Intrusion Detection
1
Threat Detection Systems
1
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
github.com | 40 | 2007-10-09 | 2016-07-13 | 2025-08-20 | 460 B | 15 kB |  140.82.121.4 |    |
challenges.cloudflare.com | 11393 | 2009-02-17 | 2021-10-20 | 2025-08-20 | 7.2 kB | 599 kB | 104.18.95.41 |  |
iavuj.stadrourea.ru 1 alert(s) on this Domain | unknown | unknown | No data | No data | 462 B | 578 B | 104.21.48.1 | |
release-assets.githubusercontent.com | 67648 | 2014-02-06 | 2025-05-11 | 2025-08-20 | 1.3 kB | 11 kB |  185.199.110.133 |    |
cdn.jsdelivr.net | 1678 | 2012-05-16 | 2012-09-30 | 2025-08-20 | 452 B | 5.9 kB | 104.16.174.226 | |
oikjnv.tqgqnobicky.ru 51 alert(s) on this Domain | unknown | 2025-07-30 | 2025-08-21 | 2025-08-21 | 39 kB | 1.0 MB | 104.21.80.1 |    |
ok4static.oktacdn.com | 150296 | 2014-11-11 | 2018-06-15 | 2025-08-20 | 2.0 kB | 268 kB | 3.167.2.106 |   |
cdnjs.cloudflare.com | 1222 | 2009-02-17 | 2012-05-23 | 2025-08-20 | 4.6 kB | 332 kB | 104.17.25.14 | |
code.jquery.com | 4915 | 2005-12-10 | 2012-05-21 | 2025-08-20 | 1.3 kB | 270 kB | 151.101.2.137 | |
get.geojs.io | 99948 | 2017-02-18 | 2017-03-30 | 2025-08-14 | 998 B | 2.4 kB | 172.67.70.233 | |
Amazon S3 (CDN)
Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.Amazon Web Services (PaaS)
Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.GitHub Pages (PaaS)
GitHub Pages is a static site hosting service.Cloudflare (CDN)
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.Varnish (Caching)
Varnish is a reverse caching proxy.Microsoft HTTPAPI:2.0 (Web servers)
Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security.Azure (PaaS)
Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.jQuery CDN (CDN)
jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.jQuery:3.6.0 (JavaScript libraries)
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.cdnjs (CDN)
cdnjs is a free distributed JS library delivery service.crypto-js:4.2.0 (JavaScript libraries)
crypto-js is a JavaScript library of crypto standards.Nginx (Web servers, Reverse proxies)
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.Amazon CloudFront (CDN)
Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
| Timestamp | Severity | Source IP | Destination IP | Alert |
|---|---|---|---|---|
| medium | Client IP | 172.67.70.233 | ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI |
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Nextron YARA rules | oikjnv.tqgqnobicky.ru/2croi74efi9dy4?id=d0d474867a928f36d49cfc33-de65c49df1708-c874d14fb-ef34b916973b780-a31379627b3e-1c3a9213baffab7-43eac0580-40247f73f3b3689-ff71d42f6d0-52013ffd-789514ab61b5e6-adca99a81bb896d-501b7969704f-21f928533dbb38d4 | malware | Detects hex encoded code that has been base64 encoded |
JavaScript (183)
| HASH | FROM | Size | First Seen | Last Seen | |
|---|---|---|---|---|---|
| 086707e4369f60afedcafb16050a7618 | DocumentWrite | 39 B | 2023-03-07 | 2025-08-21 | |
Introduced by DocumentWrite First Seen 2023-03-07 Last Seen 2025-08-21 Times Seen 146256 Size 39 B (39 bytes) MD5 086707e4369f60afedcafb16050a7618 SHA1 8216b0cc6876cbd44f01c158e7dff3833ceccd41 Loading... | |||||
| 62af9f7a01c8320d748d196a7ebb0376 | DocumentWrite | 38 kB | 2025-08-21 | 2025-08-21 | |
Introduced by DocumentWrite First Seen 2025-08-21 Last Seen 2025-08-21 Times Seen 1 Size 38 kB (38261 bytes) MD5 62af9f7a01c8320d748d196a7ebb0376 SHA1 0652a2f0b98e6e34497289f19169b52120594b89 Loading... | |||||
| fa201492b52cd27d93945e5e7f85bda1 | DocumentWrite | 7.1 kB | 2025-08-21 | 2025-08-21 | |
Introduced by DocumentWrite First Seen 2025-08-21 Last Seen 2025-08-21 Times Seen 1 Size 7.1 kB (7081 bytes) MD5 fa201492b52cd27d93945e5e7f85bda1 SHA1 98f691a844473dff34e99f4ae74568c90bd53361 Loading... | |||||
| 50b79cc5edc5c0fe8779f0b0d208771c | DocumentWrite | 247 kB | 2025-08-21 | 2025-08-21 | |
Introduced by DocumentWrite First Seen 2025-08-21 Last Seen 2025-08-21 Times Seen 1 Size 247 kB (246681 bytes) MD5 50b79cc5edc5c0fe8779f0b0d208771c SHA1 21040b3b07eceacf018fef2bbbab243fc4efb492 Loading... | |||||
| 1bc433c4b16d074027196490decc6ae8 | DocumentWrite | 131 kB | 2025-08-21 | 2025-08-21 | |
Introduced by DocumentWrite First Seen 2025-08-21 Last Seen 2025-08-21 Times Seen 1 Size 131 kB (131012 bytes) MD5 1bc433c4b16d074027196490decc6ae8 SHA1 cc53a80e6348c0789c5ed0e2d1c26e345edb039e Loading... | |||||
HTTP Transactions (61)
| URL | IP | Response | Size |
|---|