Snell13 analysis layers
entity

https://mailling.dossiecolefranc.com/

urlsandbox · completed · 5240 msjson

Malveillant

malicious

https://mailling.dossiecolefranc.com/ est classé MALVEILLANT avec une confiance de 95 %. Éléments déterminants : déjà signalé par 1 source; domaine enregistré il y a 14 jours; code exécuté après déchiffrement. À décharge : nom de forme ordinaire. 5 technique(s) ATT&CK identifiée(s). Action recommandée : blocage et diffusion des indicateurs.

Risk score

100/ 100

above danger threshold

Confidence

95%

concurring sources

Coverage

100%

sources actually queried

Indicators

15

extracted from the render

ATT&CK techniques

5

across 3 tactics

  1. Ouverture de la page

    +0 msNavigation

    https://mailling.dossiecolefranc.com/

  2. Résolution DNS : mailling.dossiecolefranc.com

    +426 msDNS

    185.53.179.136

  3. HTTPS → mailling.dossiecolefranc.com

    +426 msConnection

    185.53.179.136:443 · 36.0 Ko · 4814 ms

  4. Résolution DNS : euob.northwavepoint.com

    +1474 msDNS

    18.165.122.104, 18.165.122.50, 18.165.122.29, 18.165.122.39

  5. HTTPS → euob.northwavepoint.com

    +1474 msConnection

    18.165.122.104:443 · 57.8 Ko · 3766 ms

  6. Résolution DNS : yfdnzf.com

    +1706 msDNS

    208.91.196.46

  7. HTTPS → yfdnzf.com

    +1707 msConnection

    208.91.196.46:443 · 10.3 Ko · 3533 ms

  8. Résolution DNS : yr2.i.lencr.org

    +2007 msDNS

    2.21.240.63, 23.3.90.40, 2a02:26f0:41::215:f03f, 2a02:26f0:41::1703:5a28

  9. HTTP → yr2.i.lencr.org

    +2007 msConnection

    2.21.240.63:80 · 1.6 Ko · 73 ms

  10. Résolution DNS : yr.i.lencr.org

    +2125 msDNS

    2.21.240.63, 23.3.90.40, 2a02:26f0:41::215:f03f, 2a02:26f0:41::1703:5a28

  11. HTTP → yr.i.lencr.org

    +2125 msConnection

    2.21.240.63:80 · 1.9 Ko · 63 ms

  12. Résolution DNS : obseu.northwavepoint.com

    +2175 msDNS

    54.75.69.192, 34.251.101.162, 3.248.162.96, 2a05:d018:56f:b804:6115:ed34:65c7:21ff

  13. HTTPS → obseu.northwavepoint.com

    +2175 msConnection

    54.75.69.192:443 · 7.4 Ko · 3065 ms

  14. Résolution DNS : l.cdn-fileserver.com

    +2868 msDNS

    172.67.181.210, 104.21.31.250, 2606:4700:3033::ac43:b5d2, 2606:4700:3035::6815:1ffa

  15. HTTPS → l.cdn-fileserver.com

    +2869 msConnection

    172.67.181.210:443 · 4.8 Ko · 2371 ms

  16. Résolution DNS : d.delivery.consentmanager.net

    +2882 msDNS

    94.237.80.97, 94.237.85.247, 94.237.98.241, 94.237.89.114

  17. HTTPS → d.delivery.consentmanager.net

    +2882 msConnection

    94.237.80.97:443 · 8.2 Ko · 2358 ms

  18. Résolution DNS : cdn.consentmanager.net

    +2929 msDNS

    185.76.9.27, 185.76.9.11, 2a02:6ea0:c500::5, 2a02:6ea0:c500::6

  19. HTTPS → cdn.consentmanager.net

    +2929 msConnection

    185.76.9.27:443 · 167.7 Ko · 2311 ms

  20. Résolution DNS : searchexpertfind.com

    +3086 msDNS

    172.67.192.42, 104.21.73.210, 2606:4700:3037::6815:49d2, 2606:4700:3034::ac43:c02a

  21. HTTPS → searchexpertfind.com

    +3086 msConnection

    172.67.192.42:443 · 31.5 Ko · 2154 ms

  22. Résolution DNS : c.delivery.consentmanager.net

    +3316 msDNS

    5.22.215.48, 85.9.201.81, 94.237.101.74, 212.147.230.166

  23. HTTPS → c.delivery.consentmanager.net

    +3316 msConnection

    5.22.215.48:443 · 11.6 Ko · 1924 ms

  24. HTTPS → mailling.dossiecolefranc.com

    +3424 msConnection

    185.53.179.136:443 · 4.2 Ko · 609 ms

  25. Résolution DNS : scripts.clarity.ms

    +4629 msDNS

    150.171.109.196, 2603:1061:14:c3::1

  26. HTTPS → scripts.clarity.ms

    +4630 msConnection

    150.171.109.196:443 · 31.3 Ko · 610 ms

  27. Résolution DNS : msadsscale.microsoft.com

    +4639 msDNS

    150.171.109.197, 2603:1061:14:c5::1

  28. HTTPS → msadsscale.microsoft.com

    +4639 msConnection

    150.171.109.197:443 · 29.1 Ko · 601 ms

  29. Résolution DNS : s.cdn-fileserver.com

    +4643 msDNS

    172.67.181.210, 104.21.31.250, 2606:4700:3035::6815:1ffa, 2606:4700:3033::ac43:b5d2

  30. HTTPS → s.cdn-fileserver.com

    +4643 msConnection

    172.67.181.210:443 · 22.8 Ko · 597 ms

  31. Résolution DNS : s.yimg.com

    +4722 msDNS

    188.125.94.206, 188.125.94.204, 2a00:1288:f032:1fa::4000, 2a00:1288:f032:1fa::2000

  32. HTTPS → s.yimg.com

    +4722 msConnection

    188.125.94.206:443 · 15.0 Ko · 518 ms

  33. HTTPS → s.cdn-fileserver.com

    +4819 msConnection

    172.67.181.210:443 · 28.9 Ko · 421 ms

  34. HTTPS → s.cdn-fileserver.com

    +4821 msConnection

    172.67.181.210:443 · 0.0 Ko · 89 ms

  35. Fin de l'analyse

    +5240 msNavigation

    5240 ms

  36. Code déchiffré puis exécuté

    undatedScript

    Motif eval/Function nourri par atob/unescape — signature de kit

  37. 1 worker(s) démarré(s)

    undatedBehaviour

The page, as seen from the sandbox

Screenshot of the analysed page, taken in an isolated environment

inert image · hover to reveal