Windows Analysis Report
https://mmetimasklgiin.godaddysites.com/

Overview

General Information

Sample URL:	https://mmetimasklgiin.godaddysites.com/
Analysis ID:	1521938
Tags:	openphish
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Detected non-DNS traffic on DNS port

HTML title does not match URL

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

HTML title does not match URL

Source: https://mmetimasklgiin.godaddysites.com/

HTTP Parser: Title: MetMask Login | Login | Signup does not match URL

Source: https://mmetimasklgiin.godaddysites.com/

HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49811 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49842 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 1.1.1.1:53

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49811 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://mmetimasklgiin.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mmetimasklgiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://mmetimasklgiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy-policy HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /listen HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /bookings HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /tour HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://mmetimasklgiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /tour HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://mmetimasklgiin.godaddysites.com/sw.jsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=3&C_TOUCH=2024-09-29T04:08:47.122ZIf-None-Match: 9032bbca535b2dc1976849adbceb9e94

Source: chromecache_166.2.dr

String found in binary or memory: Core.utils.deferBootstrap({elId:'bs-2',componentName:'@widget/LAYOUT/bs-VideoComponent-Component',props:JSON.parse("{\"data-ux\":\"Video\",\"data-aid\":\"VIDEO_IFRAME_RENDERED\",\"url\":\"//youtube.com/embed/6eXyTL8-2_A?rel=0&showinfo=0\",\"rawUrl\":\"https://www.youtube.com/watch?v=6eXyTL8-2_A\",\"embedVideoStyles\":{\"overflow\":\"hidden\",\"maxHeight\":\"620px\"},\"widgetId\":\"c64815ed-f76e-40cc-b346-e5d6f1654acc\",\"section\":\"default\",\"category\":\"accent\",\"locale\":\"en-US\",\"env\":\"production\",\"renderMode\":\"PUBLISH\"}"),context:JSON.parse("{\"order\":1,\"widgetId\":\"c64815ed-f76e-40cc-b346-e5d6f1654acc\",\"widgetType\":\"VIDEO\",\"widgetPreset\":\"video2\",\"group\":\"Section\",\"groupType\":\"Default\",\"section\":\"default\",\"category\":\"accent\",\"fontSize\":\"medium\",\"fontFamily\":\"alternate\",\"websiteThemeOverrides\":{},\"widgetThemeOverrides\":{}}"),contextKey:'context-bs-1',radpack:"@widget/LAYOUT/bs-VideoComponent-Component"},false); equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mmetimasklgiin.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundLink: <//img1.wsimg.com/ceph-p3-01/website-builder-data-prod/static/widgets/UX.4.28.12.js>; rel=preload; as=script; crossorigin,<https://img1.wsimg.com/gfonts/s/archivoblack/v21/HTxqL289NzCGg4MzN6KJ7eW6CYyF_g.woff2>; rel=preload; as=font; crossorigin,<https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrOF6kg.woff2>; rel=preload; as=font; crossorigin,<https://fonts.googleapis.com>; rel=preconnect; crossorigin,<https://fonts.gstatic.com>; rel=preconnect; crossorigin,<https://img1.wsimg.com>; rel=preconnect; crossorigin,<https://isteam.wsimg.com>; rel=preconnect; crossoriginCache-Control: max-age=30Content-Security-Policy: frame-ancestors 'self' godaddy.com *.godaddy.comContent-Type: text/html;charset=utf-8Vary: Accept-EncodingServer: DPS/2.0.0+sha-227ca78X-Version: 227ca78X-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Sun, 29 Sep 2024 04:08:42 GMTConnection: closeTransfer-Encoding: chunked

Source: chromecache_213.2.dr, chromecache_214.2.dr, chromecache_170.2.dr, chromecache_175.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://github.com/Omnibus-Type/ArchivoBlack)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/archivoblack/v21/HTxqL289NzCGg4MzN6KJ7eW6CYKF_i7y.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/archivoblack/v21/HTxqL289NzCGg4MzN6KJ7eW6CYyF_g.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrO56kigt.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrO96kigt.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrOF6kg.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrOx6kigt.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/isteam/ip/9945c369-0b60-4d11-8ca6-6df520624faa/new%20banner.png
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_185.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/
Source: chromecache_189.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/404
Source: chromecache_209.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/bookings
Source: chromecache_166.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/listen
Source: chromecache_167.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/privacy-policy
Source: chromecache_187.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/tour
Source: chromecache_166.2.dr	String found in binary or memory: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/610408578&color=%23ffa476&a
Source: chromecache_166.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=6eXyTL8-2_A

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49842 version: TLS 1.2

Source: classification engine

Classification label: sus21.win@17/127@16/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2192,i,554897299793871348,1010127844361621165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mmetimasklgiin.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2192,i,554897299793871348,1010127844361621165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://mmetimasklgiin.godaddysites.com/tour

LLM: Page contains button: 'ACCEPT' Source: '24.2.pages.csv'

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.121.64.201	isteam.wsimg.com	United States	16509	AMAZON-02US	false
13.248.243.5	mmetimasklgiin.godaddysites.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.6

Contacted Domains

Name	IP	Active
mmetimasklgiin.godaddysites.com	13.248.243.5	true
bg.microsoft.map.fastly.net	199.232.210.172	true
www.google.com	172.217.23.100	true
isteam.wsimg.com	3.121.64.201	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
img1.wsimg.com	unknown	unknown
csp.secureserver.net	unknown	unknown
events.api.secureserver.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://mmetimasklgiin.godaddysites.com/bookings	false	unknown
https://mmetimasklgiin.godaddysites.com/favicon.ico	false	unknown
https://mmetimasklgiin.godaddysites.com/listen	false	unknown
https://mmetimasklgiin.godaddysites.com/	false	unknown
https://mmetimasklgiin.godaddysites.com/manifest.webmanifest	false	unknown
https://mmetimasklgiin.godaddysites.com/privacy-policy	false	unknown
https://mmetimasklgiin.godaddysites.com/sw.js	false	unknown
https://mmetimasklgiin.godaddysites.com/tour	true	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 151	ASCII text, with very long lines (852)	1CCD3C1052745E96CE686CC6F6143F10	0B19BB42233073967E22FE75572E12908E70A8C9	F075FEFC90D97DA32D93AB7A2C9660A9D73B41A3B022497C8E6683CB6F98BF88
Chrome Cache Entry: 152	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 153	ASCII text, with very long lines (65536), with no line terminators	7E673F6ACFFA9336B09CFD35FA9CBD34	D2B4589DAA1F43F932ADD53ECB3D85DAB92AF8BA	CB6303B85AD1EE2C8C59C769BE4B3BA29910CDEEEE770D0AAE7940EBB68039F8
Chrome Cache Entry: 154	ASCII text, with very long lines (1352)	5CC6B93D41889C0A55C6C4FCD2D89713	51A59C1DAE337817C4EBAC39FBE61C232705A893	8671CFDFA128168DB2136D7C17F55BA98DDBA221CDD1ACBBE559D4969280FD51
Chrome Cache Entry: 155	JSON data	CBC90B8CF0EDD2DDAD93EC11E7252777	012FD9E3FD89C61029A3A88AF4017A26638B0F21	95D87ED99DAC298AFC492845343DD7206A83F68B78AF187A3A5711D887A66EF9
Chrome Cache Entry: 156	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 157	ASCII text, with very long lines (905)	62A914B2C847D4D02B76164D7A2A54C6	20D9F49A90A51FA6C8420640610DF77F7A96D919	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
Chrome Cache Entry: 158	Web Open Font Format (Version 2), TrueType, length 18604, version 1.0	4B6914A69E6A586FBE253F73D19D90B0	1F965709606B88830826C45EF0EBCFE3484AA674	25F33E61CF995ABD6BE62931CF03BF427286259177B43618CC410EE0157CFD30
Chrome Cache Entry: 159	Web Open Font Format (Version 2), TrueType, length 44584, version 1.0	E04669366CDA1ACA21161F9E22BAC3AE	157532EC5CDB07C395EB96AA6E9D0DE1EEB869A7	43A079FD739DFFA727DE659B5BBF44596031AA7542C8A8AFBC54A243AAB96B47
Chrome Cache Entry: 160	ASCII text, with very long lines (1352)	5CC6B93D41889C0A55C6C4FCD2D89713	51A59C1DAE337817C4EBAC39FBE61C232705A893	8671CFDFA128168DB2136D7C17F55BA98DDBA221CDD1ACBBE559D4969280FD51
Chrome Cache Entry: 161	ASCII text, with very long lines (51853)	FBAEC5820143E436CEE71FAFA566A252	F58849E2514FDC709884C7C99B7A3E2AF7014BE8	042C53149976B97F0428374593584CB38C57DEC634C7286C0AA0983C3AD3878A
Chrome Cache Entry: 162	ASCII text, with very long lines (33002), with no line terminators	9032BBCA535B2DC1976849ADBCEB9E94	DE027960EDD5D323D60E289490198E85D120B79E	7F6A74E6AE2647D15140800E2609AF88DD6419C3D668D40201B7667AC2C76625
Chrome Cache Entry: 163	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 164	ASCII text, with very long lines (23126)	3D092EF4ABA019B14F01C40747E40554	1C26145272FCF4CA91AF501288CCE84B1BFFD38B	B4C48B77BBE6BBACF7D16BDAA81F5509FB8EA0FBFDDFBF2D12307F7A88518846
Chrome Cache Entry: 165	ASCII text, with very long lines (21556)	1C56940A864F144FAE2EB40EE952CB94	EBFC754CE962A1F9025853F2995B3987F0383D87	3C37A4AA3CF6AAAE6921A4B750C0E4F81FD338D6878BE90B0FAF2F921039CB23
Chrome Cache Entry: 166	HTML document, Unicode text, UTF-8 text, with very long lines (9037)	AEE931F45925E0CDD5D4BBFE5B494292	029DCBE535E99561C8F3FEDA1142C65F9A2BA448	9110C07F411EDF7175828A559F060A52F7433E55D5391E861B26F1F411DF03A6
Chrome Cache Entry: 167	HTML document, Unicode text, UTF-8 text, with very long lines (5688)	83BA69B354924966A32D4E0918ACBAF3	04CC7A95DC7DDAD9506BDE0FF5FA7A0A45039EA5	135E26DB7A741C532DC9EDAC20D10CBF22A5AE74386D0EAD8465E90FAFDBE1A6
Chrome Cache Entry: 168	ASCII text, with very long lines (17294)	4F4EF394E123EE966048B4B338874363	7356078BEDA7AF37CD55B652F4204EE79D17126A	42943C92483158FAA544F2DC9D0F6CC7593B8EC3857C11ED88EB7C41786D6632
Chrome Cache Entry: 169	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 170	Unicode text, UTF-8 text, with very long lines (63425)	D8A1FE8B9FD01233B8A030EA79C21DF0	1B2B4474F72FCEE56977101E7C85A8201F730903	91DEC32BF6596B875CDEB8C7BFFC8B5029A870657D3D7C790E8939F17E24DC20
Chrome Cache Entry: 171	ASCII text, with very long lines (65536), with no line terminators	EE94D93E4A0EB3D2C41B8C7EE1BB25F6	3C52577F309D7C76DE7EA4E0A40CBB358886A1B4	22F0A029FD70E639CC74C49BE1071F7710AE42E70CA2AD71C08EB6075B53D4BC
Chrome Cache Entry: 172	ASCII text, with very long lines (1211)	CB9BFA0FBDD957FBE7F4841B70341DB2	9CAD12A3580D3E4D340CB867E88B687C75564C5A	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
Chrome Cache Entry: 173	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 174	ASCII text, with very long lines (969)	285CD15EEB19EE1C3A052EC4FFDECF19	1749DDAEA9437D59071621E38107A69182726D70	15855B0BBAE3BD2D348356F6645D57C1AF6C9296669310172B8680F20A23AE74
Chrome Cache Entry: 175	Unicode text, UTF-8 text, with very long lines (20947)	753CB19EE1A756E46FAA0F118B1B4E01	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
Chrome Cache Entry: 176	ASCII text	8F12765EB30FBDCFCDC116D13F7FC272	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
Chrome Cache Entry: 177	ASCII text, with very long lines (65536), with no line terminators	6A7950CC31489069917BF817B62B2BFE	44AAB6E9B8FDBAA23EA297CE69E26422277907C0	1B4DACB0DAFDA81D48EE0890EA113B3B8275BF2D16D5325F971F16EB75F7218A
Chrome Cache Entry: 178	ASCII text, with very long lines (905)	62A914B2C847D4D02B76164D7A2A54C6	20D9F49A90A51FA6C8420640610DF77F7A96D919	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
Chrome Cache Entry: 179	ASCII text, with very long lines (383)	21AD22788E6CAA18A4E9E57F7372B108	50EBDD2452193BEAB7D1899F788FBBF32D90DD55	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
Chrome Cache Entry: 180	ASCII text, with very long lines (13834)	C7B1DBB0EEF8600D5F57536998855E4D	03908243C34D5A373ACBA694EB16E30F088B4F7D	53DA7DD341F1EF0C484A7B56A17D86669287DA5D082AAA8A0AF04FD3816B6631
Chrome Cache Entry: 181	ASCII text	DAA79AD7558674F6A12D962ABF47F2F6	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
Chrome Cache Entry: 182	ASCII text, with very long lines (483)	AC687AF8368A5DBE36B23037664288BF	EE85DFDA561ABF19C8BD933BB435D57F0ECAC859	CC9D5DE843D91F43C1694F0589A7893A9BD4BA4C0421CEE75A18E8C8777EE21A
Chrome Cache Entry: 183	ASCII text	2C13A70C1579D857475DAA4B6F096132	AC038B89338A0F3F04E6E6F0E25533F14A774EFE	26067A40185B85E1C3A001EB984A86F68F2588D244A88449F4A8A254EA20D3C2
Chrome Cache Entry: 184	ASCII text, with very long lines (483)	AC687AF8368A5DBE36B23037664288BF	EE85DFDA561ABF19C8BD933BB435D57F0ECAC859	CC9D5DE843D91F43C1694F0589A7893A9BD4BA4C0421CEE75A18E8C8777EE21A
Chrome Cache Entry: 185	HTML document, Unicode text, UTF-8 text, with very long lines (7766)	FAFDF760807D8D57F02BF00DBD61ABAF	D15D6C840E09B12A8D82EE35E7F1536200DEB5A9	0F0694F079970E3C6B0D521F53788D3E72F5144D6A88E23BA1DE15A8704D3EEC
Chrome Cache Entry: 186	ASCII text, with very long lines (383)	21AD22788E6CAA18A4E9E57F7372B108	50EBDD2452193BEAB7D1899F788FBBF32D90DD55	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
Chrome Cache Entry: 187	HTML document, Unicode text, UTF-8 text, with very long lines (41834)	79A62C67E16C46749164178DD8279666	C6444CB8DD65D7FF1CB1C8A9C8CF7FEB700E7DEA	7AAEDBD9D9F6F1ED540C453503A9FBD3F87A3F962AFF7800245575AA297C3D78
Chrome Cache Entry: 188	ASCII text	DAA79AD7558674F6A12D962ABF47F2F6	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
Chrome Cache Entry: 189	HTML document, Unicode text, UTF-8 text, with very long lines (6450)	9291AF094B7BE0A74735933F3654B289	DC91A5E5A737CE331D5C0F498EAC8174AB964752	EAD4CAC1DE48C279B35D79E4FD5100747613024412DAF890DCD5B26BA04C46BE
Chrome Cache Entry: 190	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 191	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 192	ASCII text	8578A331AD09BB2EF6359FEC3916BEFC	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
Chrome Cache Entry: 193	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 194	ASCII text, with very long lines (17294)	4F4EF394E123EE966048B4B338874363	7356078BEDA7AF37CD55B652F4204EE79D17126A	42943C92483158FAA544F2DC9D0F6CC7593B8EC3857C11ED88EB7C41786D6632
Chrome Cache Entry: 195	ASCII text, with very long lines (51853)	E10663DCC69B8C526DFD11DE9246AA54	E5E67199FBFC24E6E5B915B2CA6604E37600C72A	17CBACA8305301A46CB2214D92E2D53FC15632D0E51976174067AFFF0C1AA968
Chrome Cache Entry: 196	ASCII text, with very long lines (330)	C86B7F8224FA45FB1682AC94D8F75AC6	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
Chrome Cache Entry: 197	ASCII text	8578A331AD09BB2EF6359FEC3916BEFC	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
Chrome Cache Entry: 198	RIFF (little-endian) data, Web/P image	F7C46C52F98007ACB1F3BACC511E5199	4E6786D7E34D4AC2A26926AF753A60E776F3CB12	1DFA1081896E487A6DB1E38D81CB63BFD199D15192A1AAECBFCA8E3E05E5777B
Chrome Cache Entry: 199	ASCII text, with very long lines (3043)	852CBC5322260E00B44F2C682F88B2C7	BCAF229E6134F43EB5F974C9891E4D16FAF1D344	BAE437DBEFE58377D88C9D579DB7C59F4202F3FBF88866D0005FB375BE6B2CD7
Chrome Cache Entry: 200	ASCII text, with very long lines (21556)	1C56940A864F144FAE2EB40EE952CB94	EBFC754CE962A1F9025853F2995B3987F0383D87	3C37A4AA3CF6AAAE6921A4B750C0E4F81FD338D6878BE90B0FAF2F921039CB23
Chrome Cache Entry: 201	ASCII text, with very long lines (51853)	FBAEC5820143E436CEE71FAFA566A252	F58849E2514FDC709884C7C99B7A3E2AF7014BE8	042C53149976B97F0428374593584CB38C57DEC634C7286C0AA0983C3AD3878A
Chrome Cache Entry: 202	ASCII text, with very long lines (5443)	C85506AC9E5BD3471E5AA04300C138A8	9B64C59CE408465F88EB911FBBE3D4C9A8BD1D4D	7CBC6E33E4795BB35DDB877126D916C8CFE85884EEB85536B092BF633363439C
Chrome Cache Entry: 203	ASCII text, with very long lines (330)	C86B7F8224FA45FB1682AC94D8F75AC6	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
Chrome Cache Entry: 204	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 205	ASCII text, with very long lines (3043)	852CBC5322260E00B44F2C682F88B2C7	BCAF229E6134F43EB5F974C9891E4D16FAF1D344	BAE437DBEFE58377D88C9D579DB7C59F4202F3FBF88866D0005FB375BE6B2CD7
Chrome Cache Entry: 206	ASCII text, with very long lines (65536), with no line terminators	EE94D93E4A0EB3D2C41B8C7EE1BB25F6	3C52577F309D7C76DE7EA4E0A40CBB358886A1B4	22F0A029FD70E639CC74C49BE1071F7710AE42E70CA2AD71C08EB6075B53D4BC
Chrome Cache Entry: 207	ASCII text	8F12765EB30FBDCFCDC116D13F7FC272	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
Chrome Cache Entry: 208	GIF image data, version 89a, 1 x 1	325472601571F31E1BF00674C368D335	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Chrome Cache Entry: 209	HTML document, Unicode text, UTF-8 text, with very long lines (12794)	02F15199703B68E6B11BF5A5A07E0561	B5F1534DE12C8CD4BAFB7FBF7A2125B4DD969B7C	19CB8D766B6ED36E0B6F5049D0F3DED0CA21045273E7C8428506E38F7E015E61
Chrome Cache Entry: 210	ASCII text, with very long lines (1211)	CB9BFA0FBDD957FBE7F4841B70341DB2	9CAD12A3580D3E4D340CB867E88B687C75564C5A	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
Chrome Cache Entry: 211	ASCII text, with very long lines (829)	9219CF782ED219BD3929A51E99503BC2	6AAC399854EC0405949566FAFDCA8C121F0CDA58	89388608D7BCECED5AD74231681FFCE822AD580ACB9FD7E492970176E3E38347
Chrome Cache Entry: 212	ASCII text, with very long lines (23126)	3D092EF4ABA019B14F01C40747E40554	1C26145272FCF4CA91AF501288CCE84B1BFFD38B	B4C48B77BBE6BBACF7D16BDAA81F5509FB8EA0FBFDDFBF2D12307F7A88518846
Chrome Cache Entry: 213	Unicode text, UTF-8 text, with very long lines (63425)	D8A1FE8B9FD01233B8A030EA79C21DF0	1B2B4474F72FCEE56977101E7C85A8201F730903	91DEC32BF6596B875CDEB8C7BFFC8B5029A870657D3D7C790E8939F17E24DC20
Chrome Cache Entry: 214	Unicode text, UTF-8 text, with very long lines (20947)	753CB19EE1A756E46FAA0F118B1B4E01	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
Chrome Cache Entry: 215	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1417x751, components 3	F317A1BB3A93C987872957958B80B65C	01E5C18A9F61E005438C6FAC2B4A387789982D18	2B2EB2D6B35AB8A37E5B51D24A34CB0CC2855CE8B29C66523E9BD86B169A4364
Chrome Cache Entry: 216	ASCII text, with very long lines (522)	FADB3719FFA2A9E96CDC64FFEA0220FA	B9B00833E59E99ECE036B518D8429AF5EFEC1163	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
Chrome Cache Entry: 217	ASCII text, with very long lines (13834)	C7B1DBB0EEF8600D5F57536998855E4D	03908243C34D5A373ACBA694EB16E30F088B4F7D	53DA7DD341F1EF0C484A7B56A17D86669287DA5D082AAA8A0AF04FD3816B6631
Chrome Cache Entry: 218	ASCII text, with very long lines (5443)	C85506AC9E5BD3471E5AA04300C138A8	9B64C59CE408465F88EB911FBBE3D4C9A8BD1D4D	7CBC6E33E4795BB35DDB877126D916C8CFE85884EEB85536B092BF633363439C
Chrome Cache Entry: 219	JPEG image data, baseline, precision 8, 192x192, components 3	2460F5DE9DE320900B6EDBEE239CD3A8	F385B3253B914E2044DCDC2384ACF8CC57B2259A	80FF763FE5B062BAFE61FF473D53E0610D68C8A977FA357D55DBE63C85552411
Chrome Cache Entry: 220	ASCII text, with very long lines (852)	1CCD3C1052745E96CE686CC6F6143F10	0B19BB42233073967E22FE75572E12908E70A8C9	F075FEFC90D97DA32D93AB7A2C9660A9D73B41A3B022497C8E6683CB6F98BF88
Chrome Cache Entry: 221	ASCII text, with very long lines (1824)	EDC15AD5DAAC3CFA744BFFDB1E0174BE	E314A5CA702D0E77B2C2C023ADDADE266EA223B2	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
Chrome Cache Entry: 222	ASCII text, with very long lines (829)	9219CF782ED219BD3929A51E99503BC2	6AAC399854EC0405949566FAFDCA8C121F0CDA58	89388608D7BCECED5AD74231681FFCE822AD580ACB9FD7E492970176E3E38347
Chrome Cache Entry: 223	ASCII text, with very long lines (28646)	FFC34FEF749814D0B4F37D375D2D8A58	88B21B7D073CBCDEA62AE3411BB86798F6C523AC	8F917171F60E0DE528FC1ADD1093F105141D8ECFE7AC5793C7826AC6489E2A37
Chrome Cache Entry: 224	ASCII text, with very long lines (65536), with no line terminators	6A7950CC31489069917BF817B62B2BFE	44AAB6E9B8FDBAA23EA297CE69E26422277907C0	1B4DACB0DAFDA81D48EE0890EA113B3B8275BF2D16D5325F971F16EB75F7218A
Chrome Cache Entry: 225	ASCII text, with very long lines (522)	FADB3719FFA2A9E96CDC64FFEA0220FA	B9B00833E59E99ECE036B518D8429AF5EFEC1163	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
Chrome Cache Entry: 226	ASCII text, with very long lines (1824)	EDC15AD5DAAC3CFA744BFFDB1E0174BE	E314A5CA702D0E77B2C2C023ADDADE266EA223B2	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
Chrome Cache Entry: 227	ASCII text, with very long lines (51853)	E10663DCC69B8C526DFD11DE9246AA54	E5E67199FBFC24E6E5B915B2CA6604E37600C72A	17CBACA8305301A46CB2214D92E2D53FC15632D0E51976174067AFFF0C1AA968
Chrome Cache Entry: 228	RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Scaling: [none]x[none], YUV color, decoders should clamp	138F196E984491E32DAC12235FE1831E	0B41EE506C82DD5F6795BFD7A2307926540BCB78	2DC50F75EAA74A4F9537B32D692CAF20293333C1D108B9CE8F1E42DA87AEB6B1

HTML title does not match URL

Source: https://mmetimasklgiin.godaddysites.com/

HTTP Parser: Title: MetMask Login | Login | Signup does not match URL

Source: https://mmetimasklgiin.godaddysites.com/

HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49811 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49842 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 1.1.1.1:53

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49811 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://mmetimasklgiin.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mmetimasklgiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://mmetimasklgiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy-policy HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /listen HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /bookings HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /tour HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://mmetimasklgiin.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /tour HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://mmetimasklgiin.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=1&C_TOUCH=2024-09-29T04:08:38.209Z
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: mmetimasklgiin.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://mmetimasklgiin.godaddysites.com/sw.jsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1; _tccl_visitor=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _tccl_visit=1c78f5f0-d84c-4bd0-a384-04c204a407f5; _scc_session=pc=3&C_TOUCH=2024-09-29T04:08:47.122ZIf-None-Match: 9032bbca535b2dc1976849adbceb9e94

Source: chromecache_166.2.dr

Source: global traffic	DNS traffic detected: DNS query: mmetimasklgiin.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: events.api.secureserver.net
Source: global traffic	DNS traffic detected: DNS query: csp.secureserver.net

Source: global traffic

Source: chromecache_213.2.dr, chromecache_214.2.dr, chromecache_170.2.dr, chromecache_175.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://github.com/Omnibus-Type/ArchivoBlack)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/archivoblack/v21/HTxqL289NzCGg4MzN6KJ7eW6CYKF_i7y.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/archivoblack/v21/HTxqL289NzCGg4MzN6KJ7eW6CYyF_g.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrO56kigt.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrO96kigt.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrOF6kg.woff2)
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/fjallaone/v15/Yq6R-LCAWCX3-6Ky7FAFrOx6kigt.woff2)
Source: chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/isteam/ip/9945c369-0b60-4d11-8ca6-6df520624faa/new%20banner.png
Source: chromecache_185.2.dr, chromecache_166.2.dr, chromecache_209.2.dr, chromecache_187.2.dr, chromecache_167.2.dr, chromecache_189.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_185.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/
Source: chromecache_189.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/404
Source: chromecache_209.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/bookings
Source: chromecache_166.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/listen
Source: chromecache_167.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/privacy-policy
Source: chromecache_187.2.dr	String found in binary or memory: https://mmetimasklgiin.godaddysites.com/tour
Source: chromecache_166.2.dr	String found in binary or memory: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/610408578&color=%23ffa476&a
Source: chromecache_166.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=6eXyTL8-2_A

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49842 version: TLS 1.2

Source: classification engine

Classification label: sus21.win@17/127@16/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2192,i,554897299793871348,1010127844361621165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mmetimasklgiin.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2192,i,554897299793871348,1010127844361621165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://mmetimasklgiin.godaddysites.com/tour

LLM: Page contains button: 'ACCEPT' Source: '24.2.pages.csv'

ID:	1521938
Product:	CloudBasic
Start time:	06:07:39
Start date:	29.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://mmetimasklgiin.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://mmetimasklgiin.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://mmetimasklgiin.godaddysites.com/