Scan report · 2 months agoPublic

d2tykr04.na1.hubspotlinks.com

104.18.11.201AS13335 · US

Submittedhttps://d2tykR04.na1.hubspotlinks.com/Ctc/2N+113/d2tykR04/VVThcw3tPk-lW7NGnl75HDw7ZW3NdgT55RB1dKN4sL4cH5nXHCW69t95C6lZ3pCW9czvqs1BdFrpW3zgbJ22PH0hgW4Gn6NH5QPwT2W9b12bb8N4pxxW6dM-h-3Jh96-W9fs86T8pZllYV-T28C8bJg9MW8b2Ht38DsyBPW7xsT-k4S3z5HW7HHqwg65Nk9sW2pL-Kn67_RrxW8RmwCR770hgGW5-0-Fl8JdY-YW8pndR_5c82TLW76DSf71PLlMmW1n_70F12L93xW6R3FzP943PDXW5Zm7_J7qBws6N3w7ZMKLXPx_N6wFXYqC017pVQSHLG1cQyF1W3xFlbH1jSfRHW6sxBx-95007VW91g5Cp8W4-hYW91k5fW3-PFXpN4npjJgpkvBMW7YQM0k7-QndCVrPpm31q5rqPW8ZYwVX2M_RSgW3f_SgR8ydcNJV1fLB25LbXt6W7q_9GF6_-LYHN71s71R2FrJzW6pcSgZ4jnzxsW6tCndZ3Zx3HwW2p8v745Wl3Ygf2Zyvh604

Landed onhttps://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/?utm_campaign=CTI%20Newsletter&utm_medium=email&_hsenc=p2ANqtz-8lLpYYSPv2RLbnK3__LSNWdeIIu1TKhsL9GZF477yipRXOSqbinqQOuHm0dbSY6oJsEz2cFxKNe13IEb_QK5EG3MMkhXC5GsFmws0JujLSmRT-zkw&_hsmi=428767348&utm_content=428706993&utm_source=hs_email· 1 redirect

Verdict

0 of 7 enginesCleanAutomated

Own this site?

Looks safe

Automated

It asks you to enter a password. Our automated checks did not find known threat signals on this site at the time of the scan.

What to do

No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.

A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.

Findings

Strongest first

InfoBrand impersonation detected

Google · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

8 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-256b3e7cbcbaeade0a9736a0c7eb15512cf7bf6e59fde3cd28e4b76231e1ba13c3d

Infrastructure

IP: 104.18.11.201CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Oct 21, 2026
Redirects: 1 hop · /Ctc/2N+113/d2tykR04/VVThcw3…Zx3HwW2p8v745Wl3Ygf2Zyvh604 → /news/security/new-spirals-r…8706993&utm_source=hs_email

WHOIS

Registrar: MarkMonitor Inc.
Created: May 26, 2021
Expires: May 26, 2027
Nameservers: adi.ns.cloudflare.comjerome.ns.cloudflare.com

15 malicious4 suspicious

Hashes & fingerprints

Page Hash02fc8fcff3487efc5864dc242627f2e18c41539ac9accdb1efa41705f4178211 Favicon Hashb76cbc969c7c82e75c421e174224d789946300b96001ad530ccf22d630779aa9 DOM Hashe65d92c25fc7e2f3f9d2e0ec30b4c0fa6b1e0c776443285529fa03fe02409f0c Screenshot pHash953f01c188e1fcdd JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint3A5AADB075E4934B322D6F8E3620068A9FB39915 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “New Spirals ransomware encrypts victim network in under 24 hours” · brand shown: Google (low)

Visit Site

Engines

7 · time to verdict