| mondial.relay-bel.com/assets/index-_W_6z8CU.js |  193.143.1.232 | 200 OK | 244 kB |
URL GET mondial.relay-bel.com/assets/index-_W_6z8CU.js IP193.143.1.232:443
Requested byhttps://mondial.relay-bel.com/ CertificateIssuerLet's Encrypt Subjectmondial.relay-bel.com FingerprintE2:79:E8:BF:1F:ED:12:36:02:26:62:80:D9:AD:09:86:C3:3C:5A:80 ValidityWed, 28 May 2025 21:03:48 GMT - Tue, 26 Aug 2025 21:03:47 GMT
File typeJavaScript source, ASCII text, with very long lines (52463) Size244 kB (243826 bytes) Hashe1ac1b75ff505fb138e3f1df9dba4f76 63f351a4d4b5ce7b6167994161bfb19fc27269ac cf054b1d3f7ac81337872230ea12a7f74d25910ec665f4eae5471c300b0ba919
| Analyzer | Verdict | Alert |
|---|
| urlquery | suspicious | Suspicious - Suspicious Javascript code | | YARAhub by abuse.ch | malware | Detects file containing Telegram Bot API | | Quad9 DNS | malicious | Sinkholed |
GET /assets/index-_W_6z8CU.js HTTP/1.1
Host: mondial.relay-bel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mondial.relay-bel.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Thu, 29 May 2025 14:36:55 GMT
etag: "3b872-636473aaa59a5-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: application/javascript
date: Sat, 31 May 2025 16:19:22 GMT
server: Apache
X-Firefox-Spdy: h2
|
| mondial.relay-bel.com/assets/index-a5q-Q5RS.css | 193.143.1.232 | 200 OK | 12 kB |
URL GET mondial.relay-bel.com/assets/index-a5q-Q5RS.css IP193.143.1.232:443
Requested byhttps://mondial.relay-bel.com/ CertificateIssuerLet's Encrypt Subjectmondial.relay-bel.com FingerprintE2:79:E8:BF:1F:ED:12:36:02:26:62:80:D9:AD:09:86:C3:3C:5A:80 ValidityWed, 28 May 2025 21:03:48 GMT - Tue, 26 Aug 2025 21:03:47 GMT
File typeASCII text, with very long lines (12484) Hashe7766e16bb90379841e674fb7edb51dd 54eb1a089fd4f654cfb572886fb361f184c0fe95 87755a1d7514a8d75ae8155fcd66c9adc2e2ec00801b1e7073692467a2744998
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/index-a5q-Q5RS.css HTTP/1.1
Host: mondial.relay-bel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mondial.relay-bel.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Sat, 10 May 2025 15:19:33 GMT
etag: "30c5-634c99c24eb40-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 3299
content-type: text/css
date: Sat, 31 May 2025 16:19:22 GMT
server: Apache
X-Firefox-Spdy: h2
|
| www.mondialrelay.be/media/123440/logomrnotext.svg |  172.64.144.69 | 200 OK | 2.0 kB |
URL GET www.mondialrelay.be/media/123440/logomrnotext.svg IP172.64.144.69:443
Requested byhttps://mondial.relay-bel.com/ CertificateIssuerGoogle Trust Services Subjectmondialrelay.be Fingerprint35:21:D5:8A:05:6E:3A:68:12:C7:B1:F6:65:7A:9E:41:55:84:9D:78 ValidityThu, 22 May 2025 09:47:32 GMT - Wed, 20 Aug 2025 10:47:18 GMT
File typeSVG Scalable Vector Graphics image Hash364651d65bfdf861a4e8babb7833e940 cd34fdc93d095616d4b0fc092197efbc09185c63 e88b42ead9554b0c7aceac9fe0395ca14cf55308cb937fb9bf32764d2f5f77dc
GET /media/123440/logomrnotext.svg HTTP/1.1
Host: www.mondialrelay.be
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mondial.relay-bel.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 31 May 2025 16:19:23 GMT
content-type: image/svg+xml
last-modified: Thu, 23 Jun 2022 09:45:18 GMT
etag: W/"236296f2e586d81:0"
vary: User-Agent, Accept-Encoding
x-powered-by: ASP.NET
server-timing: dtSInfo;desc="1"
cf-cache-status: REVALIDATED
expires: Sat, 31 May 2025 20:19:23 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=UvT32z_1sPbrYfiXdJDXnYxHafI1YQ3D0v_OWG0LaQs-1748708363-1.0.1.1-GDpp3XgrKlNVgc0kRLr5H0dRuNf9gVKatRvXp9m3YQ_FQwCoSaRumJnueuaukljoU5zpPqGYLk0yns8SJy2BYwaDBRupQGvMrzK9qNS4CrU; path=/; expires=Sat, 31-May-25 16:49:23 GMT; domain=.mondialrelay.be; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 9487cae62d8856af-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
|
IP193.143.1.232:443
CertificateIssuerLet's Encrypt Subjectmondial.relay-bel.com FingerprintE2:79:E8:BF:1F:ED:12:36:02:26:62:80:D9:AD:09:86:C3:3C:5A:80 ValidityWed, 28 May 2025 21:03:48 GMT - Tue, 26 Aug 2025 21:03:47 GMT
File typeHTML document, ASCII text Hash262d7f55bc051de5505e05f5199f0980 8a604ca3329387e997bdff7680b0449dced3ec24 75bb77330c7757eb4a246c80fbba83fdc49c49c88a94dd514a6e05f3481c93c5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: mondial.relay-bel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Sat, 10 May 2025 15:18:36 GMT
etag: "218-634c998c1a253-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 351
content-type: text/html
date: Sat, 31 May 2025 16:19:22 GMT
server: Apache
X-Firefox-Spdy: h2
|