Report Overview
Visitedpublic
2025-10-06 00:25:37
Tags
Submit Tags
URL
loader.oxy.st/get/4bf09b510983ac4fc603b8d7cc4c1d60/
Finishing URL
about:privatebrowsing
IP / ASN
104.21.17.251
Title
about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
loader.oxy.st 2 alert(s) on this Host | unknown | 2019-11-03 | 2022-10-19 | 2025-10-03 | 519 B | 536 kB | 104.21.17.251 |   |
s1.oxy.st 3 alert(s) on this Host | unknown | 2019-11-03 | 2022-06-04 | 2025-10-01 | 734 B | 535 kB | 104.21.17.251 | |
Cloudflare (CDN)
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.PHP (Programming languages)
PHP is a general-purpose scripting language used for web development.Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
No alerts detected
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| YARAhub by abuse.ch | s1.oxy.st/get.php?cg=czozMjoiMjQ4NDVlZDAyOWNjZDNjNTg0YmU3YjA1Zjk4NTkxYjQiOw%2C%2C&n=czoxMDoibG9hZGVyLmV4ZSI7&c=czo2NDoiMjM5M2U1YTgyOGNkZGZmYjI1NjM1YTQ2MDY2NGI0Nzk1MmE5MTI2YTViYWQ4NzUxYWNhOGUxMmVlZmYwNWE2MiI7&t=1759710311 | malware | files - file ~tmp01925d3f.exe |
| DNS0 Zero | loader.oxy.st | malicious | Sinkholed |
| Hagezi Threat Feed | loader.oxy.st | malicious | Sinkholed |
| ClamAV | s1.oxy.st/get.php?cg=czozMjoiMjQ4NDVlZDAyOWNjZDNjNTg0YmU3YjA1Zjk4NTkxYjQiOw%2C%2C&n=czoxMDoibG9hZGVyLmV4ZSI7&c=czo2NDoiMjM5M2U1YTgyOGNkZGZmYjI1NjM1YTQ2MDY2NGI0Nzk1MmE5MTI2YTViYWQ4NzUxYWNhOGUxMmVlZmYwNWE2MiI7&t=1759710311 | malicious | Win.Keylogger.Lazy-10031941-0 |
File detected
URL
s1.oxy.st/get.php?cg=czozMjoiMjQ4NDVlZDAyOWNjZDNjNTg0YmU3YjA1Zjk4NTkxYjQiOw%2C%2C&n=czoxMDoibG9hZGVyLmV4ZSI7&c=czo2NDoiMjM5M2U1YTgyOGNkZGZmYjI1NjM1YTQ2MDY2NGI0Nzk1MmE5MTI2YTViYWQ4NzUxYWNhOGUxMmVlZmYwNWE2MiI7&t=1759710311
IP / ASN
104.21.17.251
File Overview
File TypePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size534 kB (534528 bytes)
MD529accad3efa7fac25dce07ff71cf1808
SHA157ffba43cc6f0d9e255002451234a9fb779c717c
Detections
| Analyzer | Verdict | Alert |
|---|---|---|
| YARAhub by abuse.ch | malware | files - file ~tmp01925d3f.exe |
| VirusTotal | malicious | |
| ClamAV | malicious | Win.Keylogger.Lazy-10031941-0 |
JavaScript (0)
No JavaScripts
HTTP Transactions (2)
| URL | IP | Response | Size |
|---|