Report - 89.39.224.73/

Report Overview

Visited public
2025-04-25 02:15:27
Tags
URL
89.39.224.73/
Finishing URL
89.39.224.73/
IP / ASN
89.39.224.73
#31638 Lepida S.c.p.A.
Title
MDaemon Webmail

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
89.39.224.73	unknown	unknown	No data	No data	5.0 kB	272 kB	89.39.224.73

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed
2025-04-25	medium	89.39.224.73	Sinkholed

ThreatFox

No alerts detected

JavaScript (6)

	URL	From	Size	First Seen	Last Seen
	about:certerror?e=nssBadCert&u=https%3A//89.39.224.73/&c=UTF-8&d=%20	ScriptElement	111 B	2025-03-02	2025-05-15
Pretty URL about:certerror?e=nssBadCert&u=https%3A//89.39.224.73/&c=UTF-8&d=%20 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2025-03-02 08:59 Last Seen2025-05-15 04:42 Times Seen27627 Hash 1fc778fb81973516c7df9ee7caca05e6 7953945d192422cc2b1d8610d1b0fa1469bb5b7f a09c624476cbe1462a188d07d0ce0a20e258a5e9b7890f44b3c8b68a0a3b26eb Loading...

	89.39.224.73/LookOut/JavaScript/logon.js?v=eea7ca282d	ScriptElement	8.9 kB	2025-04-25	2025-04-25
Pretty URL 89.39.224.73/LookOut/JavaScript/logon.js?v=eea7ca282d IP 89.39.224.73 ASN #31638 Lepida S.c.p.A. Introduced by scriptElement Embedded in HTML false Observations First Seen2025-04-25 02:15 Last Seen2025-04-25 02:15 Times Seen1 Hash c82fb9cce95161d51e075c978d23a3dc ebcf657d7eed143e75951291855c3fa6680d2003 c2393ae1cf1c2d49d95e23b2dcc3ef0255a61aab2941790f1b1985814f7d30d1 Loading...

	89.39.224.73/All/JavaScript/punycode.min.js?v=eea7ca282d	ScriptElement	4.0 kB	2024-08-19	2025-04-25
Pretty URL 89.39.224.73/All/JavaScript/punycode.min.js?v=eea7ca282d IP 89.39.224.73 ASN #31638 Lepida S.c.p.A. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-08-19 15:32 Last Seen2025-04-25 02:15 Times Seen4 Hash 8543713adf041ea49b77a8d05204e90c 9d489fd239c41128b8b0be3d5c2311ea75900788 0e6b3c6f0b0f7ccc16f094778b189d0be9c58eda9af603820537933a767e4ae9 Loading...

	89.39.224.73/All/JavaScript/jquery-latest.js?v=eea7ca282d	ScriptElement	100 kB	2023-03-12	2025-04-25
Pretty URL 89.39.224.73/All/JavaScript/jquery-latest.js?v=eea7ca282d IP 89.39.224.73 ASN #31638 Lepida S.c.p.A. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 20:37 Last Seen2025-04-25 02:15 Times Seen9 Hash 94dad50978324bf7b082d015d230f001 0483c53dd16dc89befdc97540935253daa4e9473 44df5acf102f26a92e19880629b71526fb648cf1e684176622c964a4c0dd8f4b Loading...

	89.39.224.73/	ScriptElement	501 B	2025-04-25	2025-04-25
Pretty URL 89.39.224.73/ IP 89.39.224.73 ASN #31638 Lepida S.c.p.A. Introduced by scriptElement Embedded in HTML true Observations First Seen2025-04-25 02:15 Last Seen2025-04-25 02:15 Times Seen1 Hash 7618e462f58edf2050fd597cb04932d7 8d0026af2006b70e2c530cba4e5483ab81c2e67a 473d88f2d2dbc52cffe53fc8a6f620ff07b81e9b91e3fc4a6367168882244c3b Loading...

	89.39.224.73/LookOut/globals.min.js?v=eea7ca282d	ScriptElement	28 kB	2025-03-11	2025-04-25
Pretty URL 89.39.224.73/LookOut/globals.min.js?v=eea7ca282d IP 89.39.224.73 ASN #31638 Lepida S.c.p.A. Introduced by scriptElement Embedded in HTML false Observations First Seen2025-03-11 18:46 Last Seen2025-04-25 02:15 Times Seen2 Hash 63049731dcb679331f6b6d712aff6603 01069d8a69790cee3d1437ebc559fb971051f33b 8e51f121bf9e8e264b03459b9cb04e4fe31560a074839f903d3f8fcafb16d8bc Loading...

HTTP Transactions (11)

URL IP Response Size

89.39.224.73/

89.39.224.73

200 OK

11 kB

URL User Request GET
89.39.224.73/
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Size
11 kB (10770 bytes)
Hash
95da1dd2bae4119740881e43fb098e7f
a1a34fea933b05c8b50724256238cf4bb6ac36ec
aa66336dd30a8af66580a19fb19a55505872cddbb97449487830c7a4c597f88c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Content-Type: text/html; charset=utf-8
Last-Modified: Fri, 25 Apr 2025 02:15:07 GMT
Expires: 0
Pragma: no-cache
Cache-Control: no-store
Content-Encoding: deflate
Connection: close

89.39.224.73/LookOut/pages/logon.css?v=eea7ca282d

89.39.224.73

200 OK

6.2 kB

URL GET
89.39.224.73/LookOut/pages/logon.css?v=eea7ca282d
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
ASCII text, with CRLF line terminators
Size
6.2 kB (6165 bytes)
Hash
1d1343defcb7263583e5ba1a35799690
239ae5de741a3788dde52d95c2e32e14950a1ed6
b8d9c24ce83e80a52bb18503a63b51e350847c930e06ef3191ece377d1196c60

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /LookOut/pages/logon.css?v=eea7ca282d HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: text/css
Content-Encoding: deflate
Content-Length: 1734
Last-Modified: Tue, 15 Apr 2025 06:16:16 GMT

89.39.224.73/favicon.ico?v=eea7ca282dc

89.39.224.73

200 OK

15 kB

URL GET
89.39.224.73/favicon.ico?v=eea7ca282dc
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
15 kB (15084 bytes)
Hash
f0382e05b7b71f7bb89e96253b673307
15759f5ff7bf5ad686ede036a7debdcd5b2a899b
d1d266ec10954e1d842c4ca061514102ad8b02591990c5d59934ea53db446d56

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico?v=eea7ca282dc HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: image/x-icon
Content-Length: 15084
Last-Modified: Tue, 15 Apr 2025 06:16:02 GMT

89.39.224.73/

89.39.224.73

302 Moved Temporarily

0 B

URL User Request GET
89.39.224.73/
IP
89.39.224.73:80
ASN
#31638 Lepida S.c.p.A.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:05 GMT
Content-Type: text/html
Location: https://89.39.224.73/
Content-Length: 0
Connection: close

89.39.224.73/

0.0.0.0

0 B

URL User Request GET
89.39.224.73/
IP
0.0.0.0:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

89.39.224.73/All/JavaScript/jquery-latest.js?v=eea7ca282d

89.39.224.73

200 OK

100 kB

URL GET
89.39.224.73/All/JavaScript/jquery-latest.js?v=eea7ca282d
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
JavaScript source, ASCII text, with very long lines (665), with CRLF line terminators
Size
100 kB (100097 bytes)
Hash
94dad50978324bf7b082d015d230f001
0483c53dd16dc89befdc97540935253daa4e9473
44df5acf102f26a92e19880629b71526fb648cf1e684176622c964a4c0dd8f4b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /All/JavaScript/jquery-latest.js?v=eea7ca282d HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: application/javascript
Content-Encoding: deflate
Content-Length: 41596
Last-Modified: Tue, 15 Apr 2025 06:16:04 GMT

89.39.224.73/All/Images/Banner.png

89.39.224.73

200 OK

93 kB

URL GET
89.39.224.73/All/Images/Banner.png
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
PNG image data, 429 x 88, 8-bit/color RGBA, non-interlaced
Size
93 kB (92986 bytes)
Hash
6242dc7975e11b45d00cbb32ce5b88c0
b23abd6872bc45e55e195ba56d97f53c6c046731
516320102fbde9aa77c77e9e34ab4b9b80dde0f66ed1adf1210bdde359f74d36

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /All/Images/Banner.png HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: image/png
Content-Length: 92986
Last-Modified: Tue, 15 Apr 2025 06:16:02 GMT

89.39.224.73/LookOut/globals.min.js?v=eea7ca282d

89.39.224.73

200 OK

28 kB

URL GET
89.39.224.73/LookOut/globals.min.js?v=eea7ca282d
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
JavaScript source, ASCII text, with very long lines (792)
Size
28 kB (28362 bytes)
Hash
63049731dcb679331f6b6d712aff6603
01069d8a69790cee3d1437ebc559fb971051f33b
8e51f121bf9e8e264b03459b9cb04e4fe31560a074839f903d3f8fcafb16d8bc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /LookOut/globals.min.js?v=eea7ca282d HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: application/javascript
Content-Encoding: deflate
Content-Length: 10756
Last-Modified: Tue, 15 Apr 2025 06:16:16 GMT

89.39.224.73/All/JavaScript/punycode.min.js?v=eea7ca282d

89.39.224.73

200 OK

4.0 kB

URL GET
89.39.224.73/All/JavaScript/punycode.min.js?v=eea7ca282d
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
JavaScript source, ASCII text, with very long lines (534)
Size
4.0 kB (4044 bytes)
Hash
8543713adf041ea49b77a8d05204e90c
9d489fd239c41128b8b0be3d5c2311ea75900788
0e6b3c6f0b0f7ccc16f094778b189d0be9c58eda9af603820537933a767e4ae9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /All/JavaScript/punycode.min.js?v=eea7ca282d HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: application/javascript
Content-Encoding: deflate
Content-Length: 1942
Last-Modified: Tue, 15 Apr 2025 06:16:04 GMT

89.39.224.73/LookOut/JavaScript/logon.js?v=eea7ca282d

89.39.224.73

200 OK

8.9 kB

URL GET
89.39.224.73/LookOut/JavaScript/logon.js?v=eea7ca282d
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
JavaScript source, ASCII text, with CRLF line terminators
Size
8.9 kB (8931 bytes)
Hash
c82fb9cce95161d51e075c978d23a3dc
ebcf657d7eed143e75951291855c3fa6680d2003
c2393ae1cf1c2d49d95e23b2dcc3ef0255a61aab2941790f1b1985814f7d30d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /LookOut/JavaScript/logon.js?v=eea7ca282d HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Server: WDaemon/4.0
Date: Fri, 25 Apr 2025 02:15:07 GMT
Content-Type: application/javascript
Content-Encoding: deflate
Content-Length: 2923
Last-Modified: Tue, 15 Apr 2025 06:16:16 GMT

89.39.224.73/WorldClient.dll?&TRANSLATION=1&THEME=LookOut&RETURNJAVASCRIPT=1&Lang=en

89.39.224.73

200 OK

784 B

URL GET
89.39.224.73/WorldClient.dll?&TRANSLATION=1&THEME=LookOut&RETURNJAVASCRIPT=1&Lang=en
IP
89.39.224.73:443
ASN
#31638 Lepida S.c.p.A.

Requested by
https://89.39.224.73/
Certificate
IssuerLet's Encrypt
Subjectmail.metatasse.it
Fingerprint48:8D:97:9A:25:FA:6C:CB:7B:D3:43:9A:81:C6:39:B6:CD:69:B3:BE
ValidityTue, 25 Feb 2025 22:03:03 GMT - Mon, 26 May 2025 22:03:02 GMT

File type
JSON text data
Size
784 B (784 bytes)
Hash
08ff641706437cbe742fa5d4c8ef5f7d
fa6d45dbe2177d3ec7002221d30e8182d59fec77
9d4651677830e17aff83c2902e5d48cebd8d3da10e0f546ba1d0fca6750f2a8b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /WorldClient.dll?&TRANSLATION=1&THEME=LookOut&RETURNJAVASCRIPT=1&Lang=en HTTP/1.1
Host: 89.39.224.73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://89.39.224.73/
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data:;frame-ancestors 'self'
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=2592000
X-Frame-Options: sameorigin
X-XSS-Protection: 1
Content-Type: text/html; charset=utf-8
Last-Modified: Fri, 25 Apr 2025 02:15:08 GMT
Expires: 0
Pragma: no-cache
Cache-Control: no-store
Content-Encoding: deflate
Connection: close

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type