Report - bnkofoklahonma-help.info/

Report Overview

Visited public
2023-10-29 19:26:54
Tags
URL
bnkofoklahonma-help.info/
Finishing URL
bnkofoklahonma-help.info/
IP / ASN
104.21.87.101
#13335 CLOUDFLARENET
Title
bnkofoklahonma-help.info/

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
bnkofoklahonma-help.info	unknown	2023-05-30	2023-09-26 11:12:36	2023-09-26 11:38:05	958 B	2.5 kB	104.21.87.101
devilsms.live	unknown	2021-09-16	2022-06-09 23:23:15	2023-09-03 18:55:17	1.2 kB	0 B	0.0.0.0

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-10-29	medium	devilsms.live	Sinkholed
2023-10-29	medium	devilsms.live	Sinkholed
2023-10-29	medium	devilsms.live	Sinkholed

ThreatFox

No alerts detected

JavaScript (6)

	URL	From	Size	First Seen	Last Seen
	bnkofoklahonma-help.info/	ScriptElement	235 kB	2023-04-14	2024-08-20
Pretty URL bnkofoklahonma-help.info/ IP 104.21.87.101 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-14 16:31 Last Seen2024-08-20 21:53 Times Seen1 Hash b62e62aa9311819d56aa3d15e35c8168 79301ffd02dada188f5c0b406f8a234c364ea5d3 94c5b6fe37dc59cb37d9b2dd28a6981de6a4a38c537ca808b49756b0a1665607 Loading...

	unknown	Function	34 B	2023-04-11	2025-05-09
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:16 Last Seen2025-05-09 10:19 Times Seen67023 Hash 572cb94037fffc2a0a53b465972e15f1 0d679b041a7c1ca45cc99e2d229fc2b86762838d 6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35 Loading...

		Size	First Seen	Last Seen
	#1 Eval - a433f5872699851f7cf0a94b13e02547	143 B	2023-10-24 12:53	2024-08-22 11:17
Pretty Observations First Seen2023-10-24 12:53 Last Seen2024-08-22 11:17 Times Seen2046 Hash a433f5872699851f7cf0a94b13e02547 3cd873c525d3db7b6e5cf90cda48a748c24eb55f 635ba8d7b533e842db8088ce971be784e83e189441498e4eeab919a8351acee4 Loading...

	#2 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07 01:03	2025-05-09 11:48
Pretty Observations First Seen2023-03-07 01:03 Last Seen2025-05-09 11:48 Times Seen368770 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#3 Eval - fd88497e70030ee871bd52cd5529ab83	1.0 kB	2024-08-20 21:53	2024-08-20 21:53
Pretty Observations First Seen2024-08-20 21:53 Last Seen2024-08-20 21:53 Times Seen1 Hash fd88497e70030ee871bd52cd5529ab83 2bb16bd7cf99c214a94be32b1ed57b2387bf9fda 9d7577649758db8c2c3a3b5614e67ace9308566199e3cbdeeebc584fdeae2088 Loading...

		Size	First Seen	Last Seen
	#1 Write - 98d1833e3c21c6da0e3f49e9ca981aca	3.6 kB	2023-10-24 05:18	2024-08-22 11:17
Pretty Observations First Seen2023-10-24 05:18 Last Seen2024-08-22 11:17 Times Seen12094 Hash 98d1833e3c21c6da0e3f49e9ca981aca 350b50bb799b637ad15037ee5624f57b2e81ccb4 c7fd47b0c660305151be872a9cd7c70dd1387941a53bcb479f49a1b379dbb628 Loading...

HTTP Transactions (5)

URL IP Response Size

bnkofoklahonma-help.info/

104.21.87.101

403 Forbidden

0 B

URL User Request GET HTTP/2
bnkofoklahonma-help.info/
IP
104.21.87.101:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectbnkofoklahonma-help.info
Fingerprint98:CA:84:C7:59:1B:BF:8F:A9:B0:F1:DE:54:44:85:20:93:BE:FE:C9
ValidityTue, 26 Sep 2023 08:09:20 GMT - Mon, 25 Dec 2023 08:09:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: bnkofoklahonma-help.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Sun, 29 Oct 2023 19:26:37 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 29 Oct 2023 20:26:37 GMT
Location: https://bnkofoklahonma-help.info/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pYL8NcIMb3NT1MsjHv4HeoOZBw6CGxZaeDLefz6I9CCz6oaVypxhKZGhk6pjePNMYQh%2F5O11PMQLGF1srKoRD2PJwXGWfj5tcKCo0k1ovbzgyGRla76U5gst18bzcrhuZTkS3UeN6KuV5ZQ%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 81ddcfacfcb35684-OSL
alt-svc: h2=":443"; ma=60

devilsms.live/page/bsc/bsc_000036.js

0.0.0.0

0 B

URL GET
devilsms.live/page/bsc/bsc_000036.js
IP
0.0.0.0:0
ASN
#0

Requested by
https://bnkofoklahonma-help.info/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /page/bsc/bsc_000036.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bnkofoklahonma-help.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

devilsms.live/page/bsc.js

0.0.0.0

0 B

URL GET
devilsms.live/page/bsc.js
IP
0.0.0.0:0
ASN
#0

Requested by
https://bnkofoklahonma-help.info/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /page/bsc.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bnkofoklahonma-help.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

bnkofoklahonma-help.info/favicon.ico

172.67.169.53

404 Not Found

1.2 kB

URL GET HTTP/3
bnkofoklahonma-help.info/favicon.ico
IP
172.67.169.53:443
ASN
#13335 CLOUDFLARENET

Requested by
https://bnkofoklahonma-help.info/
Certificate
IssuerGoogle Trust Services LLC
Subjectbnkofoklahonma-help.info
Fingerprint98:CA:84:C7:59:1B:BF:8F:A9:B0:F1:DE:54:44:85:20:93:BE:FE:C9
ValidityTue, 26 Sep 2023 08:09:20 GMT - Mon, 25 Dec 2023 08:09:19 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1274), with no line terminators
Size
1.2 kB (1236 bytes)
Hash
8c16945397b2ea2fa974494c910f6d08
87289c714f1955cc0a4b8d0f5319bf0dcf771141
16782bd72a33f1963efb1d59aa17f964a604235a255e51dd4aafe0e0587040c6

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: bnkofoklahonma-help.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bnkofoklahonma-help.info/
Cookie: cf_clearance=fgC4qb9PDqaSlRUpBIi.nIUP0L0DIk8grSWPx7xtWOY-1698607597-0-1-69b0ef05.6b0d8b6b.438cce4a-150.0.0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Sun, 29 Oct 2023 19:26:42 GMT
content-type: text/html
cache-control: private, no-cache, max-age=0
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IjWOxXkREDDOPu5fKDRDs9HGaIdffS%2BXQM1hm38jLjj1SO1Goc31gI8KITUPIHbu6%2BjoAcWsieNfG%2Byv%2Bdw668145LnYY8fFLtVnAvtuh4Tup4WwERmDKf0qkqgfVluJQdk4Y2g8h%2Bhg39M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 81ddcfc91abd5689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

devilsms.live/cleave.js

0.0.0.0

0 B

URL GET
devilsms.live/cleave.js
IP
0.0.0.0:0
ASN
#0

Requested by
https://bnkofoklahonma-help.info/

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cleave.js HTTP/1.1
Host: devilsms.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bnkofoklahonma-help.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers