Domain > dfir.it

More information on this domain is in AlienVault OTX

Whois

Property	Value
Organization	Jakub Jozwiak
NameServer	lorna.ns.cloudflare.com
Created	2014-10-08 02:35:18
Changed	2015-03-18 23:57:21
Expires	2015-10-08 00:00:00
Registrar	OVH

DNS Resolutions

Date	IP Address
2015-06-22	104.28.2.15 (ClassC)
2015-07-26	104.28.3.15 (ClassC)
2019-12-11	104.24.127.196 (ClassC)
2019-12-11	104.24.126.196 (ClassC)
2023-08-05	188.114.96.2 (ClassC)
2024-09-14	104.21.72.14 (ClassC)
2024-12-02	172.67.173.189 (ClassC)
2025-02-09	104.21.112.1 (ClassC)
2025-05-13	104.21.48.1 (ClassC)
2025-05-17	104.21.64.1 (ClassC)
2025-06-16	104.21.96.1 (ClassC)
2025-07-05	104.21.80.1 (ClassC)
2025-07-25	104.21.16.1 (ClassC)
2025-08-12	104.21.32.1 (ClassC)

HTTP/1.1 200 OKDate: Sun, 13 Aug 2023 03:02:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveAccept-Ranges: bytesLast-Modified: Tue, 26 Feb 2019 20:40:04 GMTCF-Cache-Status

!DOCTYPE html>!--if IEMobile 7 >html classno-js iem7>!endif-->!--if lt IE 9>html classno-js lte-ie8>!endif-->!--if (gt IE 8)|(gt IEMobile 7)|!(IEMobile)|!(IE)>!-->html classno-js langen>!--!endif-->head>  meta charsetutf-8>  title>dfir it!/title>  meta nameauthor contentdfir.it!>    meta namedescription contentRecently I was playing with VirusTotal Intelligence and while testing some dynamic behavior queries I stumbled upon this strange PE binary (MD5: …>    !-- http://t.co/dKP3o1e -->  meta nameHandheldFriendly contentTrue>  meta nameMobileOptimized content320>  meta nameviewport contentwidthdevice-width, initial-scale1>    link relcanonical hrefhttps://dfir.it/>  link href/favicon.png relicon>  link href/stylesheets/screen.css mediascreen, projection relstylesheet typetext/css>  script src/javascripts/modernizr-2.0.js>/script>  script src/javascripts/ender.js>/script>  script src/javascripts/octopress.js typetext/javascript>/script>  link href/atom.xml relalternate titledfir it! typeapplication/atom+xml>  !--Fonts from Googles Web font directory at http://google.com/webfonts -->link href//fonts.googleapis.com/css?familyPT+Serif:regular,italic,bold,bolditalic relstylesheet typetext/css>link href//fonts.googleapis.com/css?familyPT+Sans:regular,italic,bold,bolditalic relstylesheet typetext/css>    script typetext/javascript>    var _gaq  _gaq || ;    _gaq.push(_setAccount, UA-64331040-1);    _gaq.push(_trackPageview);    (function() {      var ga  document.createElement(script); ga.type  text/javascript; ga.async  true;      ga.src  (https:  document.location.protocol ? https://ssl : http://www) + .google-analytics.com/ga.js;      var s  document.getElementsByTagName(script)0; s.parentNode.insertBefore(ga, s);    })();  /script>/head>body   >  header rolebanner>hgroup>  h1>a href/>dfir it!/a>/h1>      h2>responding to incidents with candied bacon/h2>  /hgroup>/header>  nav rolenavigation>ul classsubscription data-subscriptionrss>  li>a href/atom.xml relsubscribe-rss titlesubscribe via RSS>RSS/a>/li>  /ul>

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > dfir.it

Is this malicious?

Whois

DNS Resolutions

Port 443