Report - hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1

Report Overview

Submitted URL
hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
IP
178.254.34.240
ASN
#42730 EVANZO e-commerce GmbH
Submitted
2024-04-23 15:15:47
Access
public
Website Title
MeshCentral - Download
Final URL
hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
Tags
dyndns
urlquery detections
Suspicious - DynDNS domain

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
hssit.dyndns.org	unknown	1998-11-22	2022-09-11	2024-01-24	2.5 kB	406 kB	178.254.34.240

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1	0 B	2023-03-07	2024-05-03
Pretty URL hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1 IP 178.254.34.240 ASN #42730 EVANZO e-commerce GmbH Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-03 20:55:06 Times Seen37315199 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (5)

URL IP Response Size

hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1

178.254.34.240

200 OK

1.9 kB

URL User Request GET HTTP/1.1
hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
IP
178.254.34.240:443
ASN
#42730 EVANZO e-commerce GmbH

Certificate
IssuerLet's Encrypt
Subjecthssit.dyndns.org
Fingerprint58:00:FE:29:A8:65:1D:C5:F9:90:AF:6F:41:C0:4E:4E:F3:1B:02:C4
ValidityTue, 23 Apr 2024 04:30:30 GMT - Mon, 22 Jul 2024 04:30:29 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
1.9 kB (1882 bytes)
Hash
177edbdb97e7facb96beeafc8851a2d4
e28b076406cf897003d04dab507fe9231c63384c
ae0c93db4e4d74dd2c84e05698f2b176e5f99ef40fa0e416dfc7dd1e8daf4b2a

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /userfiles/hssit/Fernwartung.exe?download=1 HTTP/1.1
Host: hssit.dyndns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Referrer-Policy: no-referrer
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' wss://hssit.dyndns.org; img-src 'self' blob: data: data:; style-src 'self' 'unsafe-inline'; frame-src 'self' mcrouter:; media-src 'self'; form-action 'self'; manifest-src 'self'
X-Frame-Options: sameorigin
Strict-Transport-Security: max-age=63072000
Content-Type: text/html; charset=utf-8
ETag: W/"134a-4osHZAbPiXAD0E2rUH/pIxxjOEw"
Set-Cookie: xid=e30=; path=/; samesite=lax; secure; httponly
xid.sig=NkCoujF-NP2-85dJZMpC_sf79z-90Ih3ai05la7GHtCSbFQP0eIXvADs7p9RvQRp; path=/; samesite=lax; secure; httponly
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 23 Apr 2024 15:15:20 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

hssit.dyndns.org/styles/style.css

178.254.34.240

200 OK

11 kB

URL GET HTTP/1.1
hssit.dyndns.org/styles/style.css
IP
178.254.34.240:443
ASN
#42730 EVANZO e-commerce GmbH

Requested by
https://hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
Certificate
IssuerLet's Encrypt
Subjecthssit.dyndns.org
Fingerprint58:00:FE:29:A8:65:1D:C5:F9:90:AF:6F:41:C0:4E:4E:F3:1B:02:C4
ValidityTue, 23 Apr 2024 04:30:30 GMT - Mon, 22 Jul 2024 04:30:29 GMT

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (336), with CRLF line terminators
Size
11 kB (10685 bytes)
Hash
256dbe0c5ec14f20b32c611eb201c30e
c42aff2c98d5bba10f3dfc7171cd4885b2ee6ae9
8e940fbfc81e7eb68a1a0aad4e754ddf82ec57affcc64452f35934d9cecdb6d4

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /styles/style.css HTTP/1.1
Host: hssit.dyndns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: xid=e30=; xid.sig=NkCoujF-NP2-85dJZMpC_sf79z-90Ih3ai05la7GHtCSbFQP0eIXvADs7p9RvQRp
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Referrer-Policy: no-referrer
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' wss://hssit.dyndns.org; img-src 'self' blob: data: data:; style-src 'self' 'unsafe-inline'; frame-src 'self' mcrouter:; media-src 'self'; form-action 'self'; manifest-src 'self'
X-Frame-Options: sameorigin
Strict-Transport-Security: max-age=63072000
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 23 Apr 2024 05:30:44 GMT
ETag: W/"103a1-18f096f5c56"
Content-Type: text/css; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 23 Apr 2024 15:15:21 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

hssit.dyndns.org/images/login/back.png

178.254.34.240

200 OK

276 kB

URL GET HTTP/1.1
hssit.dyndns.org/images/login/back.png
IP
178.254.34.240:443
ASN
#42730 EVANZO e-commerce GmbH

Requested by
https://hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
Certificate
IssuerLet's Encrypt
Subjecthssit.dyndns.org
Fingerprint58:00:FE:29:A8:65:1D:C5:F9:90:AF:6F:41:C0:4E:4E:F3:1B:02:C4
ValidityTue, 23 Apr 2024 04:30:30 GMT - Mon, 22 Jul 2024 04:30:29 GMT

File type
PNG image data, 605 x 765, 8-bit/color RGBA, non-interlaced
Size
276 kB (275664 bytes)
Hash
bb1ff664b82f5ab8f393ffeea97e5b21
2cc9efc97b62dbdd5ac2e5340a7702d914a6f7e2
126b1d9d7e55c4120644be9847c814502b6842956332e9b43c01b955ddc15a8a

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /images/login/back.png HTTP/1.1
Host: hssit.dyndns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: xid=e30=; xid.sig=NkCoujF-NP2-85dJZMpC_sf79z-90Ih3ai05la7GHtCSbFQP0eIXvADs7p9RvQRp
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Referrer-Policy: no-referrer
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' wss://hssit.dyndns.org; img-src 'self' blob: data: data:; style-src 'self' 'unsafe-inline'; frame-src 'self' mcrouter:; media-src 'self'; form-action 'self'; manifest-src 'self'
X-Frame-Options: sameorigin
Strict-Transport-Security: max-age=63072000
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 23 Apr 2024 05:30:44 GMT
ETag: W/"434d0-18f096f5e87"
Content-Type: image/png
Content-Length: 275664
Date: Tue, 23 Apr 2024 15:15:21 GMT
Connection: keep-alive
Keep-Alive: timeout=5

hssit.dyndns.org/favicon.ico

178.254.34.240

200 OK

2.0 kB

URL GET HTTP/1.1
hssit.dyndns.org/favicon.ico
IP
178.254.34.240:443
ASN
#42730 EVANZO e-commerce GmbH

Requested by
https://hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
Certificate
IssuerLet's Encrypt
Subjecthssit.dyndns.org
Fingerprint58:00:FE:29:A8:65:1D:C5:F9:90:AF:6F:41:C0:4E:4E:F3:1B:02:C4
ValidityTue, 23 Apr 2024 04:30:30 GMT - Mon, 22 Jul 2024 04:30:29 GMT

File type
MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel
Size
2.0 kB (1983 bytes)
Hash
4f178882c3525096ca61ba75fea3dfa0
350c35a544411500a96409b291e5dbc25ff9305f
91b69e7787ad55eff43a285b843e555bd7ebfb364fcb50206cb32e981bcda074

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: hssit.dyndns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: xid=e30=; xid.sig=NkCoujF-NP2-85dJZMpC_sf79z-90Ih3ai05la7GHtCSbFQP0eIXvADs7p9RvQRp
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Referrer-Policy: no-referrer
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' wss://hssit.dyndns.org; img-src 'self' blob: data: data:; style-src 'self' 'unsafe-inline'; frame-src 'self' mcrouter:; media-src 'self'; form-action 'self'; manifest-src 'self'
X-Frame-Options: sameorigin
Strict-Transport-Security: max-age=63072000
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 23 Apr 2024 05:30:44 GMT
ETag: W/"e36-18f096f5dfd"
Content-Type: image/x-icon
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 23 Apr 2024 15:15:21 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

hssit.dyndns.org/favicon-303x303.png

178.254.34.240

200 OK

112 kB

URL GET HTTP/1.1
hssit.dyndns.org/favicon-303x303.png
IP
178.254.34.240:443
ASN
#42730 EVANZO e-commerce GmbH

Requested by
https://hssit.dyndns.org/userfiles/hssit/Fernwartung.exe?download=1
Certificate
IssuerLet's Encrypt
Subjecthssit.dyndns.org
Fingerprint58:00:FE:29:A8:65:1D:C5:F9:90:AF:6F:41:C0:4E:4E:F3:1B:02:C4
ValidityTue, 23 Apr 2024 04:30:30 GMT - Mon, 22 Jul 2024 04:30:29 GMT

File type
PNG image data, 303 x 303, 8-bit/color RGBA, non-interlaced
Size
112 kB (112227 bytes)
Hash
dd7a598751c76be945ac8f120b226f7f
8e62cff6a909b8d0edece787027ed3eaf0929e51
1b7d9724b4636be4ab88c373af21d5278b9f951acabcc6678c15c9b9ad7bc394

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /favicon-303x303.png HTTP/1.1
Host: hssit.dyndns.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: xid=e30=; xid.sig=NkCoujF-NP2-85dJZMpC_sf79z-90Ih3ai05la7GHtCSbFQP0eIXvADs7p9RvQRp
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Referrer-Policy: no-referrer
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self' wss://hssit.dyndns.org; img-src 'self' blob: data: data:; style-src 'self' 'unsafe-inline'; frame-src 'self' mcrouter:; media-src 'self'; form-action 'self'; manifest-src 'self'
X-Frame-Options: sameorigin
Strict-Transport-Security: max-age=63072000
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Tue, 23 Apr 2024 05:30:44 GMT
ETag: W/"1b663-18f096f5e88"
Content-Type: image/png
Content-Length: 112227
Date: Tue, 23 Apr 2024 15:15:21 GMT
Connection: keep-alive
Keep-Alive: timeout=5

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers