Report - pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net

Report Overview

Visited public
2025-05-17 17:04:44
Tags
suspicious
URL
pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Finishing URL
pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
IP / ASN
162.159.140.237
#13335 CLOUDFLARENET
Title
Slurpmail Login
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
via.placeholder.com	26595	2002-05-05	2017-06-01	2025-05-17	459 B	0 B	0.0.0.0
image.thum.io	282725	2016-02-04	2017-02-03	2025-05-11	496 B	23 kB	35.153.41.85
www.google.com	7	1997-09-15	2015-05-10	2025-05-14	490 B	4.5 kB	142.250.178.100
t3.gstatic.com	unknown	2008-02-11	2013-05-06	2025-05-15	549 B	4.9 kB	142.250.178.36
pub-fd4c9bc378934d0492431b67307f6da3.r2.dev	unknown	2022-08-23	2025-05-16	2025-05-16	1.1 kB	38 kB	162.159.140.237
cdnjs.cloudflare.com	235	2009-02-17	2012-05-23	2025-05-14	1.1 kB	261 kB	104.17.24.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-17 17:04:12	low	Client IP	35.153.41.85	ET INFO Observed Commonly Actor Abused Domain (image .thum .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-05-17	medium	pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net	Detects file containing Telegram Bot API

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net	ScriptElement	5.0 kB	2025-05-16	2025-05-20
Pretty URL pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net IP 162.159.140.237 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-16 10:02 Last Seen2025-05-20 11:41 Times Seen50 Hash 6208a495fcfbdc5819ab5d1aceda313f a7b34faa29b5e90c747a3388b29be318c2cd6779 a0398fc7400d0ad25039379bd1d87f7ce44b4e73bc7742f090b1e7f9acf5e776 Loading...

HTTP Transactions (8)

URL IP Response Size

pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net

162.159.140.237

200 OK

11 kB

URL User Request GET
pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
IP
162.159.140.237:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5
ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (4967), with CRLF line terminators
Size
11 kB (10872 bytes)
Hash
1837e661a8506b089f2c3d306063cb5f
441978a020df44953e95d66b7301856e7d7e3a0f
e1a551134f2962b5ced765ecdbd85f2c61cfc6c934fc688c79bba53e2feda549

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
YARAhub by abuse.ch	malware	Detects file containing Telegram Bot API

HTTP Headers

GET /index.html?email=infopemilu.lhkpn@slurpmail.net HTTP/1.1
Host: pub-fd4c9bc378934d0492431b67307f6da3.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 17 May 2025 17:04:12 GMT
Content-Type: text/html
Content-Length: 10872
Connection: keep-alive
Accept-Ranges: bytes
ETag: "1837e661a8506b089f2c3d306063cb5f"
Last-Modified: Thu, 15 May 2025 15:48:22 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 9414b14aaffc7131-OSL

cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css

104.17.24.14

200 OK

102 kB

URL GET
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC
ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT

File type
ASCII text, with very long lines (52276)
Size
102 kB (102526 bytes)
Hash
c43cd173eeeba2f72aa6b431d06b8c07
427a692f7f39eabb3d5b8510aee2743025daf813
c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a

HTTP Headers

GET /ajax/libs/font-awesome/6.5.0/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 17 May 2025 17:04:12 GMT
content-type: text/css; charset=utf-8
content-length: 18859
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 9414b14cfe3b56c0-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "656632a7-49ab"
last-modified: Tue, 28 Nov 2023 18:34:15 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 170511
expires: Thu, 07 May 2026 17:04:12 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lAlBgXd8t0jxtwkvO13nXBlAJ0uCK2dzwRoUMOWIH%2F3SEpjhWV6CCA2fhVGzpRzZMCD%2BlNc9LhYBxoMV0Muy1odYXQzsoz0h%2FdC%2BKbuYkwvwVQezsVHOLMQmje2ltOnXxO3kDtt2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

via.placeholder.com/40

0.0.0.0

0 B

URL GET
via.placeholder.com/40
IP
0.0.0.0:0
ASN
#0

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /40 HTTP/1.1
Host: via.placeholder.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2

104.17.24.14

200 OK

156 kB

URL GET
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC
ValidityMon, 24 Mar 2025 12:00:12 GMT - Sun, 22 Jun 2025 13:00:01 GMT

File type
Web Open Font Format (Version 2), TrueType, length 156532, version 773.256
Size
156 kB (156532 bytes)
Hash
d465bccb9edf0873f021f66d4b09d89c
214f3c71de28c682602aecd39e9ad2bba15f1b0c
f4c5a5b297e623bc159679563a4d1eb16e409ca3b57698fbc00fd2c907dadae0

HTTP Headers

GET /ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 17 May 2025 17:04:12 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 156532
server: cloudflare
strict-transport-security: max-age=15780000
cf-ray: 9414b14de951b4f9-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "656632a7-26374"
last-modified: Tue, 28 Nov 2023 18:34:15 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 169598
expires: Thu, 07 May 2026 17:04:12 GMT
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mtxVzwxzWKLmaykLMkPXgzw6nDI0%2FJdA%2FcZ%2F2gwWbkoHG9CipnwiHiPUB8cNurLKha618NjLpMU19PZ2HcNSfnsOkjeent%2BLm4kIUZ4wdNVv6msCAj5eBbDnNGW6GmCkY%2B5N8pL0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

image.thum.io/get/width/1200/crop/800/https://slurpmail.net

35.153.41.85

200 OK

22 kB

URL GET
image.thum.io/get/width/1200/crop/800/https://slurpmail.net
IP
35.153.41.85:443
ASN
#14618 AMAZON-AES

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Certificate
IssuerAmazon
Subject*.thum.io
Fingerprint72:B5:BA:89:E3:7B:48:37:BA:98:5C:B4:4F:B9:C9:FD:5C:EE:DB:57
ValiditySat, 24 Aug 2024 00:00:00 GMT - Mon, 22 Sep 2025 23:59:59 GMT

File type
PNG image data, 1200 x 800, 8-bit/color RGBA, non-interlaced
Size
22 kB (22278 bytes)
Hash
49378a7d3b010138abdf70ff4dd432fb
505e21008dcd694b045c47a519feb3512d39cff2
2bbaf3a2b102195c17b62adb6254b23e50b110e464c9ec6d92a689c843447327

HTTP Headers

GET /get/width/1200/crop/800/https://slurpmail.net HTTP/1.1
Host: image.thum.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 17 May 2025 17:04:13 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=86400
expires: Sun, 18 May 2025 17:04:13 GMT
thum_status_code: 0
content-disposition: inline; filename= "slurpmail.net.png"
X-Firefox-Spdy: h2

www.google.com/s2/favicons?sz=64&domain=slurpmail.net

142.250.178.100

301 Moved Permanently

4.0 kB

URL GET
www.google.com/s2/favicons?sz=64&domain=slurpmail.net
IP
142.250.178.100:443
ASN
#15169 GOOGLE

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Certificate
IssuerGoogle Trust Services
Subjectwww.google.com
FingerprintC0:9B:21:A5:10:36:7E:DC:25:8D:0B:AB:4B:D9:D7:AD:92:06:96:49
ValidityMon, 21 Apr 2025 08:42:35 GMT - Mon, 14 Jul 2025 08:42:34 GMT

File type

Size
4.0 kB (4035 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /s2/favicons?sz=64&domain=slurpmail.net HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
location: https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://slurpmail.net&size=64
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 17 May 2025 17:04:12 GMT
expires: Sat, 17 May 2025 17:34:12 GMT
cache-control: public, max-age=1800
server: sffe
content-length: 333
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/favicon.ico

162.159.140.237

404 Not Found

27 kB

URL GET
pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/favicon.ico
IP
162.159.140.237:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Certificate
IssuerLet's Encrypt
Subject*.r2.dev
FingerprintB5:A8:AD:86:09:9A:90:92:96:24:0C:B5:31:B4:70:40:B0:04:5C:F5
ValidityTue, 25 Mar 2025 11:48:11 GMT - Mon, 23 Jun 2025 11:48:10 GMT

File type
HTML document, ASCII text, with very long lines (611)
Size
27 kB (27150 bytes)
Hash
46dd133ee00dc1bae5e4eeba7b88432f
8af86a4ac91ce48c062216fb94a6e1d57618a19b
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: pub-fd4c9bc378934d0492431b67307f6da3.r2.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Sat, 17 May 2025 17:04:12 GMT
Content-Type: text/html
Content-Length: 27150
Connection: keep-alive
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 9414b14ebdd27131-OSL

t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://slurpmail.net&size=64

142.250.178.36

200 OK

4.0 kB

URL GET
t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://slurpmail.net&size=64
IP
142.250.178.36:443
ASN
#15169 GOOGLE

Requested by
https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/index.html?email=infopemilu.lhkpn@slurpmail.net
Certificate
IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint15:8B:D4:EA:7E:CB:34:1B:6F:2E:20:9E:39:44:7A:D6:D7:30:26:AB
ValidityMon, 21 Apr 2025 08:41:49 GMT - Mon, 14 Jul 2025 08:41:48 GMT

File type
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Size
4.0 kB (4035 bytes)
Hash
dfb1aa23672e31bcedc794dd32f8334f
9ad39e9c3d8eda641de2351d8974ed7d758754de
ee1b521c1117187d365e85f322e1c76acc5c69d57d3dde63b0523debc45b0f17

HTTP Headers

GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://slurpmail.net&size=64 HTTP/1.1
Host: t3.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://pub-fd4c9bc378934d0492431b67307f6da3.r2.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
content-location: http://slurpmail.net/favicon.ico
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 4035
date: Sat, 17 May 2025 17:04:12 GMT
expires: Sat, 24 May 2025 17:04:12 GMT
cache-control: public, max-age=604800
last-modified: Wed, 29 Nov 2017 12:34:19 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (8)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size