{"report_id":"c20e71af-bbcd-45f8-ab65-3efe4add3d0b","version":6,"status":"done","tags":[],"date":"2026-05-16T01:22:30Z","url":{"schema":"http","addr":"mail.dambilua.id.vn/MXH1.zip","fqdn":"mail.dambilua.id.vn","domain":"dambilua.id.vn","tld":"id.vn"},"ip":{"addr":"210.211.125.205","port":0,"asn":38731,"as":"CHT Compamy Ltd","country":"Vietnam","country_code":"VN"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing","dom":{"size":3632,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"cab12ec2a37b5d71ba2758f532d72275","sha1":"49995912fddd32ee74dd2ff48ba0caa72c71e2e3","sha256":"c00567cb2129bcbadbf0135034bd1270883253f22b3272448bbe1f37fd732108","sha512":"1fd2866b5e25b2d44ef9777d6c88edf7a5db993567250e5e054cabaa79c1e44141b487ef6913a3be6733433604373a9ad4ec6288f1f7ea353b28810f1d3c150a","ssdeep":"","tlshash":"797146a514f1552718a383a5de81bf1b9f826a07cf8d6a403b9f00f22f97d55887f20d","dom_hash":"domhash03f850468cad29251ed949292c202f85","first_seen":"2026-03-24T08:07:14.410989Z","last_seen":"2026-06-07T08:20:21.550638Z","times_seen":467541,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mail.dambilua.id.vn/MXH1.zip","fqdn":"mail.dambilua.id.vn","domain":"dambilua.id.vn","tld":"id.vn"},"ip":{"addr":"210.211.125.205","port":0,"asn":38731,"as":"CHT Compamy Ltd","country":"Vietnam","country_code":"VN"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-20T01:22:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"mail.dambilua.id.vn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"mail.dambilua.id.vn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"mail.dambilua.id.vn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"mail.dambilua.id.vn","ip":{"addr":"210.211.125.205","port":443,"asn":38731,"as":"CHT Compamy Ltd","country":"Vietnam","country_code":"VN"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-16T01:22:30.373558Z","last_seen":"2026-05-16T01:22:30.373558Z","alert_count":4,"request_count":1,"received_data":188401,"sent_data":496,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"aa91c5f4a889f036fefe422129bccf4a","sha1":"d1e173583b13a0fab86a02ee2767f1efd388d515","sha256":"7791f41705f579c8249da942982d22f82bd0dea15e59c9392a659ba7d8d293a0","sha512":"69b78e4bd72bf5add57899562b9e54bf692754e047d2bd3e059e3474506672b5916d51d8645804a6771fc0a4ff65ef34ff4a833b00d24d85d99ce3b653e27e8f","magic":"Zip archive data, at least v1.0 to extract, compression method=store","size":188026,"url":{"schema":"https","addr":"mail.dambilua.id.vn/MXH1.zip","fqdn":"mail.dambilua.id.vn","domain":"dambilua.id.vn","tld":"id.vn"},"ip":{"addr":"210.211.125.205","port":443,"asn":38731,"as":"CHT Compamy Ltd","country":"Vietnam","country_code":"VN"},"archive":[{"path":"MXH1/-Facebook-login-page-HTML-CSS-main/CSS/style.css","filename":"style.css","modified":"2025-11-25T20:03:07+07:00","Modified":"","magic":"Unicode text, UTF-8 text, with CRLF line terminators","size":4296,"md5":"23922857fd16b062460185b0b09710a0","sha1":"2fe0e2e0bda82a8cced121cba2c47523ba4c18c2","sha256":"ae66b2c526e99842984cdf7ff6bc1a8c8bf1a084dd6e9e408355e039e6924b4b","sha512":"2ae5099a61a8cd38f9efd63bc192ac646f43d565f01f4c199bdc6337068a33b29c98cbd4ebcce4dd443e12b7f5df560ac2af13e09b3431916256ea0392c53444","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/-Facebook-login-page-HTML-CSS-main/images/fb_logo.svg","filename":"fb_logo.svg","modified":"2025-11-25T20:03:35+07:00","Modified":"","magic":"SVG Scalable Vector Graphics image","size":2385,"md5":"ebd8798bc32c86494851a07770e04e63","sha1":"b5461dc8f5f5f848033441d506ee05d48742438b","sha256":"9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce","sha512":"fb376aada13675b405ebbf55c332665b5a89b7a905323d227edfee7729246e37a1b6b338554fff4a0e2bb38dfbeaed59be278bbf6f6bdfdfb4300aa6e54743e7","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/-Facebook-login-page-HTML-CSS-main/index.html","filename":"index.html","modified":"2025-11-25T20:02:50+07:00","Modified":"","magic":"HTML document, Unicode text, UTF-8 text","size":4444,"md5":"2041c2861b3a2a29fc08f67fc5d03d74","sha1":"0bc890e1c446a913ee406f02bd9abf32b1bf49cf","sha256":"9ef532302706cb688f8fcb5d230faf619feaed43017461be874e0c7bf05a1472","sha512":"e82e6f591b0434c8d64797bdd159c18c249f8bbbdc3185bd2aea92362d5384d2b0af442e59b8fdcff2887ef3ea10a628b3c9087662860bc121f5abac12c1959d","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/-Facebook-login-page-HTML-CSS-main/login.php","filename":"login.php","modified":"2025-11-25T20:02:50+07:00","Modified":"","magic":"PHP script, Unicode text, UTF-8 text","size":2854,"md5":"279558a1b485c77c2d3d97b5f5e1bd13","sha1":"903a3417f958d331fcb47a523ebec50987a52377","sha256":"06b2e9cf55a35c839772f5a8a0e875c6f1a1a53555a0dd67a847156813f39623","sha512":"261825a7c16785a623224d71181e22b4c776d297b445a37cc428630f0a53b33e24e8672f5ba5f449260c91be79f6d23f6b6cfe91b688a0aed8362bcb3d27a6b4","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/admin.php","filename":"admin.php","modified":"2025-11-25T20:01:39+07:00","Modified":"","magic":"PHP script, Unicode text, UTF-8 text","size":28493,"md5":"5de5d681c265138c947ddac4a2f1c54f","sha1":"24f677b0b5f091811de55d438c7502b32cf4699a","sha256":"12b748513fc1dda77da734f291dc31a57bc29b692ca2898b2e301dd5a2aa1877","sha512":"62e6649610b61b9f3b1a06a7c78f40daad3f6253900e2bf795e886d35904eb28fb6244df98ae1b7194c4313cc66264efe031c7721915848893662aeded6083ef","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/ADMIN_README.md","filename":"ADMIN_README.md","modified":"2025-11-25T20:01:41+07:00","Modified":"","magic":"Unicode text, UTF-8 text","size":3475,"md5":"5f37b8e60dbd82ad6b9a7539d0606aea","sha1":"2c8775f2d0ddc388ed1cee9dc14bac1d5caaae13","sha256":"f41644044d8eac688a5b59677c2f5bd7d757cc538189dff9c168c1afebf6bea1","sha512":"3d2ec3773a8d334c771822bd5085ea98d3dd7ee3233289f8f30807d2d8a48758ec3a1c313d2adfc404aa6eebf83fc33584b75edb5f862fb74ee1bf0c9d53c9b3","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/cleanup.php","filename":"cleanup.php","modified":"2025-11-25T20:01:41+07:00","Modified":"","magic":"PHP script, Unicode text, UTF-8 text","size":4478,"md5":"8e680876cea1a9342d6173a8fa2d85dd","sha1":"f040ff0f3304640440d2a319d9c0082382418553","sha256":"b2d129b3bdbf259320b1f5e89330444c0dd8ebcea527c65004decf6544437e0e","sha512":"b8d747b321df25594561383dcbdf5631a9df81cab15f2f1c86b7507735e68d99e4c3974bbe70d62a54c78ceffdc32e652822057ff9ea309f4a264125ab03ebca","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/device_parser.php","filename":"device_parser.php","modified":"2025-11-25T20:01:41+07:00","Modified":"","magic":"PHP script, Unicode text, UTF-8 text, with CRLF line terminators","size":4263,"md5":"70a3d236fbfa389b50b71f9e7ee8382c","sha1":"f9d230ba8ce47d4d01f619ccb3d2460bab6225da","sha256":"65369c0c9678c27511ef09e60584dc54f92db778e315ca80bea49d6fa7326a73","sha512":"92ff753c20b478b3a52a9ffa3dd170a81841c5c7804b567da29d785e67b69ed2f5c7a93b9cb99ec9152f11028800446a3b50371e5581a83f349cd750e61fff26","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/fbload.png","filename":"fbload.png","modified":"2025-11-25T20:01:41+07:00","Modified":"","magic":"PNG image data, 828 x 1792, 16-bit/color RGBA, non-interlaced","size":213210,"md5":"d12bfde0ef5f8a0d2c2b9386768ca25e","sha1":"dbf9788d5ca687f971a7c7a409b72359a12294fb","sha256":"1b2dde306a06f5a53fedb8a0b9cef96591b323d4d6fb264c14ca8cdbb93747b7","sha512":"58c6fe58a1a192e7e76a8d14003c5c4e35fbc37c84a8e8c82c31e9ce73658b3a4e688f51e0b0018a11f123947131580573de4773e8281e43fa1928eff3a44bae","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/LUONG_SU_DUNG.md","filename":"LUONG_SU_DUNG.md","modified":"2025-11-25T20:01:42+07:00","Modified":"","magic":"Unicode text, UTF-8 text, with CRLF line terminators","size":18156,"md5":"9e992d6ad51037bf056eacc75cea788b","sha1":"be8d92e662952a322615a9e12afd0f7b089189e0","sha256":"6e01f0f9922ae04a3c9225bc479d726ea18b86b0a38accc83056582bee22d497","sha512":"9c49bb6b7eb6f078fa8ee226b687c02a5029f412d6fbf83be93f0813ee5145298baa30f22e9e00ed6a4f032b7c6b8fe709c0977be916f8e9b5edbde4af12b6f3","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/mxh.html","filename":"mxh.html","modified":"2025-12-13T20:46:16+07:00","Modified":"","magic":"HTML document, Unicode text, UTF-8 text","size":3806,"md5":"5600a463e41e99e37845e58267a47ee5","sha1":"8170be3f03482be79cbff3d35cc840dd41b44768","sha256":"8834dc5696212310b127c90992f062c2282e47bc9a5f1c3c8cc4ce342c8516ec","sha512":"708e56035f94ebd639beb26cbeaa2fd3a1bfcb38a6e9c768fc71f04b750c6756385c59e9869971109d53aad34f8135de06dfb96008b2a8a5a829ecd4bab17ffc","alerts":{"urlquery":null,"analyzer":null}},{"path":"MXH1/upload.php","filename":"upload.php","modified":"2025-11-25T20:01:42+07:00","Modified":"","magic":"PHP script, Unicode text, UTF-8 text","size":2900,"md5":"c550e51d8e37bd0aeee02197c03e07bb","sha1":"fffd62ef594e75a929e65b2362213dc19efadc62","sha256":"4ff4702b9fb9b7cf9ec13a9459bba252f2c31bfcdb4fd9881e0fb4fe9d5dca2f","sha512":"ba7a5a9ba879e31b46043768ebc126ba28820ad248b3c4b662d90bf80bd8b7e37913e5bd3b8fbd345780adcab0340b6c292015be16fdc887b0d85db271fb742c","alerts":{"urlquery":null,"analyzer":null}}],"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"virustotal","sensor_type":"file","title":"VirusTotal","description":"VirusTotal","scan_date":"2026-02-23","alert":"Scan result 16/64","trigger":"7791f41705f579c8249da942982d22f82bd0dea15e59c9392a659ba7d8d293a0","verdict":"malicious","severity":"","comment":"malicious - 16/64","link":"https://www.virustotal.com/gui/file/7791f41705f579c8249da942982d22f82bd0dea15e59c9392a659ba7d8d293a0","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mail.dambilua.id.vn/MXH1.zip","fqdn":"mail.dambilua.id.vn","domain":"dambilua.id.vn","tld":"id.vn"},"ip":{"addr":"210.211.125.205","port":443,"asn":38731,"as":"CHT Compamy Ltd","country":"Vietnam","country_code":"VN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-16T01:22:06.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.dambilua.id.vn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Apr 2026 02:35:18 GMT","end":"Wed, 15 Jul 2026 02:35:17 GMT"},"fingerprint":{"sha1":"61:64:CE:21:BF:50:01:4D:6B:78:99:72:53:72:D8:A2:17:44:AA:D0","sha256":"90:19:80:BF:4D:79:F8:C1:F7:A4:0D:66:95:BA:E8:BB:01:CF:1B:00:E0:9D:15:39:29:8C:EF:63:FE:34:46:77"}}},"request":{"raw":"GET /MXH1.zip HTTP/1.1\r\nHost: mail.dambilua.id.vn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/zip\r\nlast-modified: Sat, 13 Dec 2025 13:51:47 GMT\r\naccept-ranges: bytes\r\ncontent-length: 188026\r\ndate: Sat, 16 May 2026 01:22:06 GMT\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":188026,"size_decoded":0,"mime_type":"application/zip","magic":"Zip archive data, at least v1.0 to extract, compression method=store","md5":"aa91c5f4a889f036fefe422129bccf4a","sha1":"d1e173583b13a0fab86a02ee2767f1efd388d515","sha256":"7791f41705f579c8249da942982d22f82bd0dea15e59c9392a659ba7d8d293a0","sha512":"69b78e4bd72bf5add57899562b9e54bf692754e047d2bd3e059e3474506672b5916d51d8645804a6771fc0a4ff65ef34ff4a833b00d24d85d99ce3b653e27e8f","ssdeep":"3072:gbfZYf/2Uz9QJbfc5nOjkAurC3MIE816LdmXt1/vjrlyvU2s5pwE7Ilk/UQ63K4h:gbxYRhQJD0Olb3M9HLsXjflyvNsDclR1","tlshash":"22041279663edb42d816c2fcf588265df817606ba25b774f5804c81fbc97328287f688","first_seen":"2026-05-16T01:22:35.857531Z","last_seen":"2026-05-16T01:22:35.857531Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3157,"timings":{"blocked":969,"dns":357,"connect":302,"send":0,"wait":609,"receive":609,"ssl":307},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"mail.dambilua.id.vn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"mail.dambilua.id.vn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"mail.dambilua.id.vn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"virustotal","sensor_type":"file","title":"VirusTotal","description":"VirusTotal","scan_date":"2026-02-23","alert":"Scan result 16/64","trigger":"7791f41705f579c8249da942982d22f82bd0dea15e59c9392a659ba7d8d293a0","verdict":"malicious","severity":"","comment":"malicious - 16/64","link":"https://www.virustotal.com/gui/file/7791f41705f579c8249da942982d22f82bd0dea15e59c9392a659ba7d8d293a0","meta":null}],"urlquery":null}}]}