Snell13 analysis layers
entity

https://meilor.ecoliearsenegrescs.com/

urlsandbox · completed · 5945 msjson

Malveillant

malicious

https://meilor.ecoliearsenegrescs.com/ est classé MALVEILLANT avec une confiance de 92 %. Éléments déterminants : déjà signalé par 1 source; code exécuté après déchiffrement. À décharge : nom de forme ordinaire. 5 technique(s) ATT&CK identifiée(s). Action recommandée : blocage et diffusion des indicateurs.

Risk score

100/ 100

above danger threshold

Confidence

92%

concurring sources

Coverage

100%

sources actually queried

Indicators

17

extracted from the render

ATT&CK techniques

5

across 3 tactics

  1. Ouverture de la page

    +0 msNavigation

    https://meilor.ecoliearsenegrescs.com/

  2. Résolution DNS : meilor.ecoliearsenegrescs.com

    +449 msDNS

    185.53.179.136

  3. HTTPS → meilor.ecoliearsenegrescs.com

    +449 msConnection

    185.53.179.136:443 · 36.0 Ko · 5495 ms

  4. Résolution DNS : euob.northwavepoint.com

    +1504 msDNS

    18.165.122.29, 18.165.122.39, 18.165.122.50, 18.165.122.104

  5. HTTPS → euob.northwavepoint.com

    +1504 msConnection

    18.165.122.29:443 · 57.7 Ko · 4440 ms

  6. Résolution DNS : yfdnza.com

    +2054 msDNS

    208.91.196.46

  7. HTTPS → yfdnza.com

    +2054 msConnection

    208.91.196.46:443 · 10.4 Ko · 3890 ms

  8. Résolution DNS : obseu.northwavepoint.com

    +2237 msDNS

    54.75.69.192, 3.248.162.96, 34.251.101.162, 2a05:d018:56f:b804:6115:ed34:65c7:21ff

  9. HTTPS → obseu.northwavepoint.com

    +2237 msConnection

    54.75.69.192:443 · 7.5 Ko · 3707 ms

  10. Résolution DNS : yr1.i.lencr.org

    +2338 msDNS

    2.21.240.16, 2.21.240.63, 2a02:26f0:41::215:f03f, 2a02:26f0:41::215:f010

  11. HTTP → yr1.i.lencr.org

    +2338 msConnection

    2.21.240.16:80 · 1.6 Ko · 70 ms

  12. Résolution DNS : yr.i.lencr.org

    +2434 msDNS

    2.21.240.63, 2.21.240.16, 2a02:26f0:41::215:f03f, 2a02:26f0:41::215:f010

  13. HTTP → yr.i.lencr.org

    +2434 msConnection

    2.21.240.63:80 · 1.9 Ko · 70 ms

  14. HTTPS → meilor.ecoliearsenegrescs.com

    +3086 msConnection

    185.53.179.136:443 · 4.2 Ko · 624 ms

  15. Résolution DNS : l.cdn-fileserver.com

    +3300 msDNS

    104.21.31.250, 172.67.181.210, 2606:4700:3033::ac43:b5d2, 2606:4700:3035::6815:1ffa

  16. HTTPS → l.cdn-fileserver.com

    +3300 msConnection

    104.21.31.250:443 · 5.5 Ko · 2644 ms

  17. Résolution DNS : d.delivery.consentmanager.net

    +3326 msDNS

    94.237.85.247, 85.9.205.255, 94.237.80.97, 94.237.98.241

  18. HTTPS → d.delivery.consentmanager.net

    +3326 msConnection

    94.237.85.247:443 · 8.2 Ko · 2618 ms

  19. Résolution DNS : cdn.consentmanager.net

    +3406 msDNS

    185.76.9.27, 185.76.9.11, 2a02:6ea0:c500::5, 2a02:6ea0:c500::6

  20. HTTPS → cdn.consentmanager.net

    +3406 msConnection

    185.76.9.27:443 · 167.7 Ko · 2538 ms

  21. Résolution DNS : searchexpertfind.com

    +3499 msDNS

    104.21.73.210, 172.67.192.42, 2606:4700:3037::6815:49d2, 2606:4700:3034::ac43:c02a

  22. HTTPS → searchexpertfind.com

    +3499 msConnection

    104.21.73.210:443 · 31.1 Ko · 2445 ms

  23. Résolution DNS : c.delivery.consentmanager.net

    +3675 msDNS

    212.147.230.166, 5.22.215.48, 85.9.201.81, 94.237.101.74

  24. HTTPS → c.delivery.consentmanager.net

    +3675 msConnection

    212.147.230.166:443 · 11.6 Ko · 2269 ms

  25. Résolution DNS : msadsscale.microsoft.com

    +4162 msDNS

    150.171.109.197, 2603:1061:14:c5::1

  26. HTTPS → msadsscale.microsoft.com

    +4162 msConnection

    150.171.109.197:443 · 29.6 Ko · 1782 ms

  27. Résolution DNS : scripts.clarity.ms

    +4173 msDNS

    150.171.109.198, 2603:1061:14:c4::1

  28. HTTPS → scripts.clarity.ms

    +4173 msConnection

    150.171.109.198:443 · 31.3 Ko · 1771 ms

  29. Résolution DNS : s.cdn-fileserver.com

    +4181 msDNS

    172.67.181.210, 104.21.31.250, 2606:4700:3035::6815:1ffa, 2606:4700:3033::ac43:b5d2

  30. HTTPS → s.cdn-fileserver.com

    +4181 msConnection

    172.67.181.210:443 · 22.8 Ko · 1763 ms

  31. Résolution DNS : s.yimg.com

    +4254 msDNS

    188.125.94.206, 188.125.94.204, 2a00:1288:f032:1fa::2000, 2a00:1288:f032:1fa::4000

  32. HTTPS → s.yimg.com

    +4254 msConnection

    188.125.94.206:443 · 15.0 Ko · 1690 ms

  33. HTTPS → s.cdn-fileserver.com

    +4275 msConnection

    172.67.181.210:443 · 0.0 Ko · 97 ms

  34. HTTPS → s.cdn-fileserver.com

    +4279 msConnection

    172.67.181.210:443 · 28.9 Ko · 1665 ms

  35. Fin de l'analyse

    +5945 msNavigation

    5945 ms

  36. Code déchiffré puis exécuté

    undatedScript

    Motif eval/Function nourri par atob/unescape — signature de kit

  37. 1 worker(s) démarré(s)

    undatedBehaviour

The page, as seen from the sandbox

Screenshot of the analysed page, taken in an isolated environment

inert image · hover to reveal