Scan report · about 2 months agoPublic

hotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e.kharwadejewellers.com

216.126.227.232AS14956 · US

Submittedhttps://hotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e.kharwadejewellers.com

Landed onhttps://hotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e.kharwadejewellers.com/

Verdict

2 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.6 s · 3 requests

01 · Visitor openshotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e.kharwadejewellers.com

02 · Page shown

FASTPANEL

03 · File delivered · maliciousgreatthignswithnewworkingskillwithmegreatwithe.hta

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

greatthignswithnewworkingskillwithmegreatwithe.hta

Our Content Inspection engine downloaded the file this URL serves and analyzed it as a real payload — it matched known malware. Do not open or run this file.

Success

SHA-256 825eb1a627f34c3d1fad85cb5904b5ac0fded65f677c5a85fa992e42c450fd99

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileMaliciousgreatthignswithnewworkingskillwithmegreatwithe.hta

SHA-256825eb1a627f34c3d1fad85cb5904b5ac0fded65f677c5a85fa992e42c450fd99

Fromhxxps://hotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e[.]kharwadejewellers[.]com

Infrastructure

IP: 216.126.227.232ROUTERHOSTING - RouterHosting LLC, US · AS14956US
TLS: CN=parking, OU="", O=FASTPANEL, L="", S="", C="" · expires Aug 6, 2027
Redirects: 0 hops · / → /

WHOIS

Registrar: GoDaddy.com, LLC
Created: Feb 16, 2023
Expires: Feb 16, 2027
Nameservers: ns1.bh-58.webhostbox.netns2.bh-58.webhostbox.net

15 malicious1 suspicious

Hashes & fingerprints

Page Hash710bf6d9aa6b270e62b8537e5617e55c11e70cec621e5a60777b94a07378c661 Favicon Hash825eb1a627f34c3d1fad85cb5904b5ac0fded65f677c5a85fa992e42c450fd99 DOM Hash2869fd668c9f2712f6b22e8ba8cf4faf59d4d30f210f2e166c8a0ddeaee55d87 Screenshot pHash81be3e55514a68eb JARM2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356 JA4X2166164053c1_2166164053c1_b06bda150783 Cert Thumbprint5F8AA91B48F323993BF9B0270C7AAFFD72AA4D31 Cert IssuerCN=parking, OU="", O=FASTPANEL, L="", S="", C=""

Page capture

Live

Title “FASTPANEL”

Visit Site

Engines

8 · time to verdict