Report - blue-aviation.com/

Report Overview

Submitted URL
blue-aviation.com/
IP
160.153.133.155
ASN
#21501 Host Europe GmbH
Submitted
2024-04-18 13:28:51
Access
public
Website Title
blue-aviation.com/
Final URL
blue-aviation.com/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
bind.bestresulttostart.com	unknown	2024-03-04	2024-03-22	2024-04-18	409 B	6.2 kB	193.163.7.113
visit.startfinishthis.com	unknown	2024-03-04	2024-03-04	2024-04-17	852 B	9.9 kB	104.21.64.161
blue-aviation.com	unknown	unknown	No data	No data	913 B	4.1 kB	160.153.133.155

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 13:28:27	high	Client IP	193.163.7.113	ET EXPLOIT_KIT Balada Domain in TLS SNI (bestresulttostart .com)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	bestresulttostart.com	Sinkholed

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	bestresulttostart.com	Sinkholed
2024-04-18	medium	startfinishthis.com	Sinkholed
2024-04-18	medium	startfinishthis.com	Sinkholed

ThreatFox

Scan Date	Severity	Indicator	Alert
2024-04-02	medium	bind.bestresulttostart.com	Unknown malware

JavaScript (4)

	URL	Size	First Seen	Last Seen
	bind.bestresulttostart.com/m67LBk	14 kB	2024-04-08	2024-04-29
Pretty URL bind.bestresulttostart.com/m67LBk IP 193.163.7.113 ASN #204601 Zomro B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-08 14:32:13 Last Seen2024-04-29 12:55:34 Times Seen170 Hash 58d15c8061659ef77d42e8c5d3ff4984 4fefb78331ee102e720c03a36265f3b286df3457 709f60c4e7be64193c1eff6aca024338e157da87200e114e84b061bfed693f98 Loading...

	visit.startfinishthis.com/2L1mRj?q=blue-aviation.com	7.8 kB	2024-04-08	2024-04-29
Pretty URL visit.startfinishthis.com/2L1mRj?q=blue-aviation.com IP 104.21.64.161 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-08 14:51:53 Last Seen2024-04-29 10:08:39 Times Seen142 Hash 02b232562fac1f903859abaf066919c5 eb98b38e5e5af2127e333c0d91efd5f5d2299e0b 5268cd6ccfe14126dda3076f3b128ec20995afdb4875e0494880e71f1cb741d2 Loading...

	visit.startfinishthis.com/fGGy8K	0 B	2023-03-07	2024-05-02
Pretty URL visit.startfinishthis.com/fGGy8K IP 104.21.64.161 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-02 00:43:39 Times Seen37259076 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	blue-aviation.com/	4.0 kB	2024-03-28	2024-04-29
Pretty URL blue-aviation.com/ IP 160.153.133.155 ASN #21501 Host Europe GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-28 05:26:43 Last Seen2024-04-29 23:32:43 Times Seen19 Hash e9d75c0cb231bb40afef85204d4092d4 da3e780e60c016920978a2a2bdb2f1b55ab945bd 35e461f1015a760a5711c96570ba3d7cc3159c94d87aadabbcf446154f2df9af Loading...

HTTP Transactions (5)

URL IP Response Size

blue-aviation.com/

160.153.133.155

200 OK

1.8 kB

URL User Request GET HTTP/2
blue-aviation.com/
IP
160.153.133.155:443
ASN
#21501 Host Europe GmbH

Certificate
IssuerSectigo Limited
Subjectblue-aviation.com
Fingerprint46:07:CA:1C:09:B2:EF:E0:03:26:54:9E:90:16:E4:A2:A1:58:D3:82
ValidityThu, 04 Jan 2024 00:00:00 GMT - Sun, 02 Feb 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (4817), with no line terminators
Size
1.8 kB (1804 bytes)
Hash
754446fe99b0645df6f9e2925a9d7cac
5ec1a177c071e1d1bd36ed3f4d157bd157c7df1e
1621ab0d0c561d41dff8a2b5603bb7c9f1350ec5e4b243984b4203606a4c0fde

HTTP Headers

GET / HTTP/1.1
Host: blue-aviation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
content-encoding: br
content-length: 1804
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 13:28:26 GMT
server: Apache
X-Firefox-Spdy: h2

bind.bestresulttostart.com/m67LBk

193.163.7.113

200 OK

5.9 kB

URL GET HTTP/2
bind.bestresulttostart.com/m67LBk
IP
193.163.7.113:443
ASN
#204601 Zomro B.V.

Requested by
https://blue-aviation.com/
Certificate
IssuerLet's Encrypt
Subjectbestresulttostart.com
FingerprintF4:4C:F5:1D:A8:B6:9F:52:11:56:EC:A1:D7:C6:98:DF:2E:96:E0:4C
ValidityMon, 08 Apr 2024 08:36:22 GMT - Sun, 07 Jul 2024 08:36:21 GMT

File type
JavaScript source, ASCII text, with very long lines (13785)
Size
5.9 kB (5919 bytes)
Hash
58d15c8061659ef77d42e8c5d3ff4984
4fefb78331ee102e720c03a36265f3b286df3457
709f60c4e7be64193c1eff6aca024338e157da87200e114e84b061bfed693f98

Detections

Analyzer	Verdict	Alert
ThreatFox	malicious	Unknown malware
mnemonic secure dns	malicious	Sinkholed
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /m67LBk HTTP/1.1
Host: bind.bestresulttostart.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://blue-aviation.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 18 Apr 2024 13:28:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 5919
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=31536000;
X-Firefox-Spdy: h2

visit.startfinishthis.com/fGGy8K

104.21.64.161

200 OK

0 B

URL GET HTTP/3
visit.startfinishthis.com/fGGy8K
IP
104.21.64.161:443
ASN
#13335 CLOUDFLARENET

Requested by
https://blue-aviation.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectstartfinishthis.com
FingerprintD5:E5:97:E4:E8:D4:53:86:B2:E1:D7:EF:F4:69:83:94:C6:46:E9:8C
ValidityMon, 04 Mar 2024 14:59:39 GMT - Sun, 02 Jun 2024 14:59:38 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /fGGy8K HTTP/1.1
Host: visit.startfinishthis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://blue-aviation.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 18 Apr 2024 13:28:28 GMT
content-type: application/javascript
content-length: 0
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 18 Apr 2024 13:28:28 GMT
set-cookie: _subid=376l60je08td2; expires=Sun, 19 May 2024 13:28:28 GMT; path=/
a4fba=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjQ1XCI6MTcxMzQ0NjkwOH0sXCJjYW1wYWlnbnNcIjp7XCIxNVwiOjE3MTM0NDY5MDh9LFwidGltZVwiOjE3MTM0NDY5MDh9In0.mDp7EplIBgMhFk_P-brXuBMu0N-e3ig-JkCQ8nzfXk0; expires=Fri, 05 Aug 2078 14:56:56 GMT; path=/
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ynfMJG%2BHOG5BZybNiKJKgScFc1Hn8jUrv0OFvb0HHm%2BW3aa6Pok0YuktDC0GzI%2Fl7Xm5WVAJJxaWSLjTl%2BGJ%2B4uCnuofhN6Nf6aoCMpuxbZeTqzOr1OXU76c%2BLTOCCNmiGyM6xn3NBH99tY6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8764ff872db356c3-OSL
alt-svc: h3=":443"; ma=86400

blue-aviation.com/favicon.ico

160.153.133.155

200 OK

1.8 kB

URL GET HTTP/2
blue-aviation.com/favicon.ico
IP
160.153.133.155:443
ASN
#21501 Host Europe GmbH

Requested by
https://blue-aviation.com/
Certificate
IssuerSectigo Limited
Subjectblue-aviation.com
Fingerprint46:07:CA:1C:09:B2:EF:E0:03:26:54:9E:90:16:E4:A2:A1:58:D3:82
ValidityThu, 04 Jan 2024 00:00:00 GMT - Sun, 02 Feb 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (4817), with no line terminators
Size
1.8 kB (1804 bytes)
Hash
754446fe99b0645df6f9e2925a9d7cac
5ec1a177c071e1d1bd36ed3f4d157bd157c7df1e
1621ab0d0c561d41dff8a2b5603bb7c9f1350ec5e4b243984b4203606a4c0fde

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: blue-aviation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://blue-aviation.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-powered-by: PHP/7.4.33
vary: Accept-Encoding
content-encoding: br
content-length: 1804
content-type: text/html; charset=UTF-8
date: Thu, 18 Apr 2024 13:28:27 GMT
server: Apache
X-Firefox-Spdy: h2

visit.startfinishthis.com/2L1mRj?q=blue-aviation.com

104.21.64.161

200 OK

7.8 kB

URL GET HTTP/2
visit.startfinishthis.com/2L1mRj?q=blue-aviation.com
IP
104.21.64.161:443
ASN
#13335 CLOUDFLARENET

Requested by
https://blue-aviation.com/
Certificate
IssuerGoogle Trust Services LLC
Subjectstartfinishthis.com
FingerprintD5:E5:97:E4:E8:D4:53:86:B2:E1:D7:EF:F4:69:83:94:C6:46:E9:8C
ValidityMon, 04 Mar 2024 14:59:39 GMT - Sun, 02 Jun 2024 14:59:38 GMT

File type
JavaScript source, ASCII text, with very long lines (7752), with no line terminators
Size
7.8 kB (7751 bytes)
Hash
36b37c2b32cb60a5f7689fc7bc992368
75c21b11e9d45c0f100caba87985605f0f68749b
e5bd093f5b2293f655d1c324186c2241e2dc972d50c8ad68df56bbaff4d71e12

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /2L1mRj?q=blue-aviation.com HTTP/1.1
Host: visit.startfinishthis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://blue-aviation.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 13:28:27 GMT
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 18 Apr 2024 13:28:27 GMT
set-cookie: _subid=376l60je08tc3; expires=Sun, 19 May 2024 13:28:27 GMT; path=/
a4fba=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjQxXCI6MTcxMzQ0NjkwN30sXCJjYW1wYWlnbnNcIjp7XCIxM1wiOjE3MTM0NDY5MDd9LFwidGltZVwiOjE3MTM0NDY5MDd9In0.E7UkWRFvhq2NtYGiO2XVO0rtOzRtqcUUJLATvTvhlZo; expires=Sat, 06 Aug 2078 02:56:54 GMT; path=/
vary: Accept-Encoding
x-powered-by: PHP/7.4.33
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vhgiu4obBqh3tY91KD9eyvDhE3Aa2D5Jq6itPWeG9iWgPCHEAQr7CyGJDZ0%2BQ7IPchZWgThQhmeJ5bpJ74vR7JCdiUKqPh%2B6Os8lQ8hvbDB04UQTc7BO9DlKU0oPKI9jEcUikmY2EhrRHJ4D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8764ff85fb0c56c4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size