Scan report · about 2 months agoPublic

loosun.net

154.86.119.228AS197574 · SC

Submittedhttps://loosun.net/r

Engine tags

Verdict

3 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 9.0 s · 1 requests

01 · Visitor opensloosun.net/r

02 · Page shown

loosun.net

03 · File delivered · maliciousDSC_412414182271.lnkHanded over by the page, not served at the scanned address.

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

DSC_412414182271.lnk

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 f7aa1bc21c15e1a729671d3e1f8222f081e4b619882eb3ad961dbfcc6b4de3ec

StrongPage auto-started a file download

DSC_412414182271.zip

The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.

Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousDSC_412414182271.lnk

SHA-256f7aa1bc21c15e1a729671d3e1f8222f081e4b619882eb3ad961dbfcc6b4de3ec

Fromblob:https://loosun[.]net/77880a79-aa40-47fe-a8c9-5a886fd2d833

Infrastructure

IP: 154.86.119.228EXPRESSHOST - ExpressHost Ltd, GB · AS197574SC
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Nov 2, 2026

WHOIS

Registrar: Gname.com Pte. Ltd.
Created: Sep 8, 2009
Expires: Sep 8, 2026
Nameservers: a.dnspod.comc.dnspod.com

57 malicious28 suspicious

Hashes & fingerprints

Page Hasha7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e Screenshot pHashf1d1d0d02e280ed0 JARM2ad2ad0002ad2ad00042d42d0000005d86ccb1a0567e012264097a0315d7a7 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint33E08E8904CBA88353C7DD4E64BB9E12C4C22B3B Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Visit Site

Engines

7 · time to verdict