WEBSITE ANALYSIS REPORT

https://usc1.contabostorage.com/da3a79eeefda41b489230d148e08e366:tyuo789/urchandbad.html#GOOGLE@DRIVE.GOOGLE.COM

25 May 2026 · 11:07:28.000 UTCpublic

Report tags: phishing
Submit tags

Request review

Phishing detected

6 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

11:07:06.498 GET 200 document 20.0 KB 790 ms 4 alerts

11:07:07.117 GET 200 stylesheet 6.2 KB 1376 ms 1 alerts

11:07:07.119 GET 200 stylesheet 139.1 KB 1514 ms 1 alerts

11:07:07.120 GET 200 img 5.2 KB 1051 ms 1 alerts

11:07:07.121 GET 200 script 68.0 KB 162 ms —

11:07:07.122 GET 200 script 18.7 KB 91 ms —

11:07:07.123 GET 200 script 47.8 KB 143 ms —

11:07:07.124 GET 200 script 83.6 KB 417 ms —

11:07:07.125 GET 200 script 49.8 KB 54 ms —

11:07:07.126 GET 302 script 39.9 KB 81 ms —

11:07:07.128 GET 200 stylesheet 9.4 KB 57 ms —

11:07:07.299 GET 200 script 39.9 KB 17 ms —

11:07:08.060 GET 200 img 1.0 KB 147 ms 1 alerts

11:07:08.065 GET 200 img 976 B 151 ms 1 alerts

11:07:08.070 GET 200 img 962 B 1276 ms 1 alerts

11:07:08.072 GET 200 img 1.0 KB 1265 ms 1 alerts

11:07:08.076 GET 200 img 320 B 238 ms 1 alerts

11:07:08.078 GET 200 img 450 B 261 ms 1 alerts

11:07:08.086 GET 200 font 22.1 KB 1426 ms 1 alerts

11:07:08.089 GET 200 font 22.4 KB 1423 ms 1 alerts

11:07:08.091 GET 200 font 21.9 KB 1425 ms 1 alerts

11:07:08.953 GET 200 font 31.7 KB 138 ms 1 alerts

Transaction #04

Request / response

URL

GET HTTPS

https://sh001.webhostbox.net:2096/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Semibold-webfont.ttf

IP / ASN

162.241.27.10

AS46606 · UNIFIEDLAYER-AS-1

Requested by: https://usc1.contabostorage.com/da3a79eeefda41b489230d148e08e366:tyuo789/urchandbad.html#GOOGLE@DRIVE.GOOGLE.COM

Resource information

File type: TrueType Font data, 19 tables, 1st "FFTM"
MIME type: application/octet-stream
First seen (UTC): 08 May 2023 · 01:50:41.000 UTC
Last seen (UTC): 21 Oct 2026 · 06:28:31.429 UTC
Times seen: 752

Size: 31.7 KB (32461 bytes)
MD5: 446465d7b4340920bc537dc3504e4143
SHA1: 3604ed0b45909651b33d87a92abbdc21d0c6eb1f
SHA256: 655e2e3e7b0519ea7930fb9df947d62e0d9d423a44ba830b8ce75ae4ccff2122

Certificate information

Issuer: Sectigo Limited · Sectigo Public Server Authentication CA DV R36
Subject: *.webhostbox.net
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 69:92:4B:8A:19:A2:45:C8:80:EB:2E:50:2D:FD:4B:BE:5B:66:72:16
Valid from: Fri, 10 Apr 2026 00:00:00 GMT
Valid until: Sun, 25 Oct 2026 23:59:59 GMT

Technology fingerprints

No technology fingerprints recorded for this response.

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Semibold-webfont.ttf HTTP/1.1
Host: sh001.webhostbox.net:2096
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://usc1.contabostorage.com
DNT: 1
Connection: keep-alive
Referer: https://sh001.webhostbox.net:2096/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 30 Mar 2022 03:16:35 GMT
Date: Mon, 25 May 2026 11:07:09 GMT
Cache-Control: max-age=5184000, public
Expires: Fri, 24 Jul 2026 11:07:09 GMT
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Length: 39476

11:07:08.956 GET 200 font 31.7 KB 142 ms 1 alerts

11:07:08.960 GET 200 font 31.7 KB 138 ms 1 alerts

https://usc1.contabostorage.com/da3a79eeefda41b489230d148e08e366:tyuo789/urchandbad.html#GOOGLE@DRIVE.GOOGLE.COM

Domain graph

Hostnames

Connections

Network requests

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://usc1.contabostorage.com/da3a79eeefda41b489230d148e08e366:tyuo789/urchandbad.html#GOOGLE@DRIVE.GOOGLE.COM

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://usc1.contabostorage.com/da3a79eeefda41b489230d148e08e366:tyuo789/urchandbad.html#GOOGLE@DRIVE.GOOGLE.COM

Domain graph

Network requests