tureetclient.blogdns.org

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 45.145.164.86, located in France and belongs to FEELB, FR. The main domain is tureetclient.blogdns.org.
TLS certificate: Issued by R10 on September 9th 2024. Valid for: 3 months.

This is the only time tureetclient.blogdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	45.145.164.86 45.145.164.86	207992 (FEELB) (FEELB)
1 2	2606:4700:303... 2606:4700:3038::6815:e9c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	3

1 45.145.164.86 (France)

ASN207992 (FEELB, FR)
PTR: hms20111.hostmyservers.me

tureetclient.blogdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3038::6815:e9c5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

zupimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zupimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	zupimages.net 1 redirects zupimages.net — Cisco Umbrella Rank: 140640 www.zupimages.net — Cisco Umbrella Rank: 171108	2 KB
1	blogdns.org tureetclient.blogdns.org	43 KB
2	2

	Domain	Requested by
1	www.zupimages.net
1	zupimages.net	1 redirects
1	tureetclient.blogdns.org
2	3

This site contains no links.

Subject Issuer	Validity	Valid
tureetclient.blogdns.org R10	`2024-09-09` - `2024-12-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tureetclient.blogdns.org/messagerie.php
Frame ID: 652DFDDA55426D8C7EEF3EA3BCCCCBFC
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Identifiez-vous

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

2
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

44 kB
Transfer

113 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://zupimages.net/up/19/24/jvb7.jpeg HTTP 301
https://www.zupimages.net/up/19/24/jvb7.jpeg

2 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request messagerie.php Show response
tureetclient.blogdns.org/ 65 KB
43 KB 188ms
89ms Document
text/html 45.145.164.86
FEELB

General

Check archive.org

Show headers Download Go to

Full URL: https://tureetclient.blogdns.org/messagerie.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.145.164.86 , France, ASN207992 (FEELB, FR),
Reverse DNS: hms20111.hostmyservers.me
Software: nginx / PHP/8.3.11 PleskLin
Resource Hash: 56bb9627c03aa1782005443fd2ad209443ef4d6e61cf394204b86fa62f09dc54

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 10 Sep 2024 14:06:49 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.3.11 PleskLin

GET
DATA 200
OK truncated
/ 47 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b3c0e47edeca6cdbbc4d72689dcf0fdf3952374a1846bea4769b7e4ed0fd804

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

jvb7.jpeg
www.zupimages.net/up/19/24/
Redirect Chain

https://zupimages.net/up/19/24/jvb7.jpeg
https://www.zupimages.net/up/19/24/jvb7.jpeg

832 B
1 KB

72ms
59ms

Other
image/jpeg

2606:4700:3038::6815:e9c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zupimages.net/up/19/24/jvb7.jpeg

Protocol

H2

Server

2606:4700:3038::6815:e9c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b5eb75c92568eb6b284a5eae87572600b703ec0672593d29fbe90b537e91041

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://tureetclient.blogdns.org/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 10 Sep 2024 14:06:50 GMT
strict-transport-security: max-age=15768000
cf-cache-status: EXPIRED
last-modified: Tue, 10 Sep 2024 14:06:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u9cahwAn9o5hAgyk2f65wYuX5bQ%2FCt7M9yViq3%2BoJ%2BowhIRbOgUMb8XzrF1R4OXECb8Pa4Qb1XlFiKTE8esFQaIovAap0cATEFYHP0UydHSdhCTdjKvJUEeBe6fi5CwBvlGF%2FNMzSiGlaPiSGeJ8SA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
content-disposition: filename="jvb7.jpeg"
cf-ray: 8c0ffb1beccb954d-LHR
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

Redirect headers

date: Tue, 10 Sep 2024 14:06:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W6R1cAeUgx1WM1QTivh%2Bo9aiZEQNSHdLyBFvaRjnwjCXXSd1Pw9K9e9ToSw7GxxIB%2FLuSmj7qix4JD4Bk5fug5fBF388NzCTLs03XEdylsr8H7%2FoeCWAzvqRdiqznNBRKf16MdAs%2B4tEzsUZ"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://www.zupimages.net/up/19/24/jvb7.jpeg
cache-control: max-age=3600
cf-ray: 8c0ffb1b1b66954d-LHR
alt-svc: h3=":443"; ma=86400
content-length: 167
expires: Tue, 10 Sep 2024 15:06:50 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| AvoidSpace

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			tureetclient.blogdns.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: prd198oichsjisvegbtrtnahvn

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://tureetclient.blogdns.org/messagerie.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

tureetclient.blogdns.org
www.zupimages.net
zupimages.net
2606:4700:3038::6815:e9c5
45.145.164.86
56bb9627c03aa1782005443fd2ad209443ef4d6e61cf394204b86fa62f09dc54
6b5eb75c92568eb6b284a5eae87572600b703ec0672593d29fbe90b537e91041
9b3c0e47edeca6cdbbc4d72689dcf0fdf3952374a1846bea4769b7e4ed0fd804

tureetclient.blogdns.org Open in urlscan Pro 45.145.164.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

2 Requests

50 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

44 kBTransfer

113 kBSize

1 Cookies

0 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

tureetclient.blogdns.org Open in urlscan Pro
45.145.164.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

44 kB
Transfer

113 kB
Size

1
Cookies

2 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!