DigiCert UltraDNS Sinkholed
VerdictMalicious
Severitymedium
WEBSITE ANALYSIS REPORT
https://mibc-fr-03.mailinblack.com/securelink/?url=https://dub.sh&key=eyJsYW5nIjoiRlIiLCJ1cmwiOiJodHRwczovL2R1Yi5zaC9jNVNhM3Z3IiwidG9rZW4iOiJnQUFBQUFCcXNQWXBWR3RLNEhwWTd5ZGZDb2hqMDZWVWpZMGxQRFFnb1EtdmRtOE5yZkttLU1ZRFRWUnhlcFBmdk1aLU5waU1BVGpBMWdRbmc1SVE0LThMY2FnVEZ4MkZfT1M0cFA2cERWbXJSejlzbGVOb3gySUI5MXpyeG9HSHhwWUozT1k2MUpUVmdlVTFGT3dMdkJlaDNOc2o1UEVfQWJROEJVbVByNmtydGlVWlB3OUFod0JQZ3lkSUNLT3FzR0FXa05TeDhsczQ4V2o3R3g1RG5SOGlwdXVnVVVkaDhUUWhqMGJINDZLY3ItTXZqQU9JYl9SU0xqUG5wcWlkNUFOU0tjLWNTSlI5eWxoSUZBZkJ1ZDM0X0MxakhVRmhWWl9HdnFNbjlqdHVtSmY0VTV0bDVqRmJ3ZnFTeXNzVjB1NTFCdUQ2d0hWTSJ9
public
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://mibc-fr-03.mailinblack.com/securelink/?url=https://dub.sh&key=eyJsYW5nIjoiRlIiLCJ1cmwiOiJodHRwczovL2R1Yi5zaC9jNVNhM3Z3IiwidG9rZW4iOiJnQUFBQUFCcXNQWXBWR3RLNEhwWTd5ZGZDb2hqMDZWVWpZMGxQRFFnb1EtdmRtOE5yZkttLU1ZRFRWUnhlcFBmdk1aLU5waU1BVGpBMWdRbmc1SVE0LThMY2FnVEZ4MkZfT1M0cFA2cERWbXJSejlzbGVOb3gySUI5MXpyeG9HSHhwWUozT1k2MUpUVmdlVTFGT3dMdkJlaDNOc2o1UEVfQWJROEJVbVByNmtydGlVWlB3OUFod0JQZ3lkSUNLT3FzR0FXa05TeDhsczQ4V2o3R3g1RG5SOGlwdXVnVVVkaDhUUWhqMGJINDZLY3ItTXZqQU9JYl9SU0xqUG5wcWlkNUFOU0tjLWNTSlI5eWxoSUZBZkJ1ZDM0X0MxakhVRmhWWl9HdnFNbjlqdHVtSmY0VTV0bDVqRmJ3ZnFTeXNzVjB1NTFCdUQ2d0hWTSJ9
- Submitted IP / ASN
40.89.132.98 AS8075 · Microsoft Corporation
- Final URL
- https://example.com/
- Final IP / ASN
104.20.23.154 AS13335 · CLOUDFLARENET
Final page
- Page title
- Example Domain
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 544 B (544 bytes)
Detections
Activity
- HTTP requests
- 87
- Observed hosts
- 6
- Script records
- 31
Estimated HTTP data
- Sent
- ~86.8 KB
- Received
- ~8.11 MB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
Threat Detection Systems
1Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| href.li 1 alerts | 30988 | N/A | 2012-05-22 | 2026-09-21 | 502 B | 0 B |  192.0.78.26 | |
| mibc-fr-03.mailinblack.com | 2177552 | 2003-05-23 | 2022-06-06 | 2026-09-09 | 78.1 KB | 6.14 MB | 40.89.132.98 | Envoy Reverse proxies Envoy is an open-source edge and service proxy, designed for cloud-native applications. |
| mondigroup.net | N/A | N/A | N/A | N/A | 545 B | 605 B | 172.67.161.187 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| cdn.mailinblack.com | 3392771 | 2003-05-23 | 2019-03-30 | 2026-09-09 | 2.1 KB | 1.39 MB | 13.107.246.53 | Azure Front Door Load balancers Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications. Azure PaaS Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers. |
| dub.sh | 154184 | 2022-08-27 | 2019-07-16 | 2026-09-19 | 3.7 KB | 592.5 KB | 64.239.109.193 | WebAssembly Programming languages WebAssembly (abbreviated Wasm) is a binary instruction format for a stack-based virtual machine. Wasm is designed as a portable compilation target for programming languages, enabling deployment on the web for client and server applications. Vercel PaaS Vercel is a cloud platform for static frontends and serverless functions. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| example.com | 235 | 1995-08-14 | 2013-07-30 | 2026-09-21 | 486 B | 825 B | 104.20.23.154 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |