IOC Report
https://epayln.site.tb-hosting.com/

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 50
ASCII text, with very long lines (39369)
downloaded
Chrome Cache Entry: 51
ASCII text
downloaded
Chrome Cache Entry: 52
C++ source, ASCII text, with very long lines (2154)
downloaded
Chrome Cache Entry: 53
C++ source, ASCII text, with very long lines (2154)
dropped
Chrome Cache Entry: 54
Unicode text, UTF-8 text, with very long lines (65335)
downloaded
Chrome Cache Entry: 55
ASCII text, with very long lines (39369)
dropped
Chrome Cache Entry: 56
TrueType Font data, digitally signed, 15 tables, 1st "DSIG", 13 names, Microsoft, language 0x409, Copyright 2014-2017 Indian Type Foundry (info@indiantypefoundry.com)PoppinsRegular3.010;ITFO;Pop
downloaded
Chrome Cache Entry: 57
Algol 68 source, Unicode text, UTF-8 text, with very long lines (53585)
dropped
Chrome Cache Entry: 58
Algol 68 source, Unicode text, UTF-8 text, with very long lines (53585)
downloaded
Chrome Cache Entry: 59
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 60
SVG Scalable Vector Graphics image
downloaded
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1700,i,12017164564101457797,5329295057376494313,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://epayln.site.tb-hosting.com/"

URLs

Name
IP
Malicious
https://epayln.site.tb-hosting.com/
malicious
https://epayln.site.tb-hosting.com/livewire/livewire.js?id=90730a3b0e7144480175
213.158.94.185
 malicious
https://epayln.site.tb-hosting.com/favicon.ico
213.158.94.185
 malicious
https://epayln.site.tb-hosting.com/statics/css/style.css
213.158.94.185
 malicious
https://epayln.site.tb-hosting.com/
malicious
https://epayln.site.tb-hosting.com/statics/pictures/identity-main.svg
213.158.94.185
 malicious
https://epayln.site.tb-hosting.com/statics/fonts/poppins.regular.ttf
213.158.94.185
 malicious
http://stackoverflow.com/a/22075070
unknown
https://stackoverflow.com/questions/2901102/how-to-print-a-number-with-commas-as-thousands-separator
unknown
https://github.com/microsoft/TypeScript/issues/50754
unknown
https://github.com/microsoft/TypeScript/issues/6223
unknown
https://unpkg.com/imask@7.6.1
104.17.248.203
https://unpkg.com/imask@7.6.1/dist/imask.js
104.17.248.203
https://github.com/twbs/bootstrap/blob/main/LICENSE)
unknown
https://unpkg.com/imask
104.17.248.203
https://github.com/jonschlinkert/get-value
unknown
https://github.com/uNmAnNeR/imaskjs/issues/134
unknown
https://indiantypefoundry.comThis
unknown
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
unknown
https://getbootstrap.com/)
unknown
https://github.com/epoberezkin/fast-deep-equal
unknown
https://github.com/jonschlinkert/isobject
unknown
There are 11 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.210.172
www.google.com
216.58.206.36
epayln.site.tb-hosting.com
213.158.94.185
unpkg.com
104.17.248.203
fp2e7a.wpc.phicdn.net
192.229.221.95
cdn.jsdelivr.net
unknown

IPs

IP
Domain
Country
Malicious
104.17.246.203
unknown
United States
104.17.248.203
unpkg.com
United States
192.168.2.6
unknown
unknown
216.58.206.36
www.google.com
United States
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
213.158.94.185
epayln.site.tb-hosting.com
Italy

DOM / HTML

URL
Malicious
https://epayln.site.tb-hosting.com/