Domain > mail.rotaforte.com

Welcome! Right click nodes and scroll the mouse to navigate the graph.

More information on this domain is in AlienVault OTX

Files that talk to mail.rotaforte.com

MD5	A/V
61b408e2de1c4996c3708f1f46913d60	[HW32.CDB.C1b5] [Trojan.Kryptik!QyFpAm9uzfY] [Kryptik.CCFN] [Backdoor.Win32.Hlux.djft] [Trojan.Win32.S.PSW-Tepfer.835600.AI] [UnclassifiedMalware] [BackDoor.Slym.14044] [Mal/Kelihos-A] [Trojan[Backdoor]/Win32.Hlux] [Trojan/Win32.Tepfer] [W32/Trojan.AJYO-7526] [Backdoor.Hlux] [Trojan.Crypt_s] [W32/Kryptik.BWUN!tr] [Crypt3.HUF] [Trojan.Win32.Kryptik.BZIX]

Whois

Property	Value
NameServer	NS2.BNET.NET.TR
Created	1999-09-22 00:00:00
Changed	2013-07-06 00:00:00
Expires	2018-09-22 00:00:00
Registrar	TUCOWS DOMAINS INC.

DNS Resolutions

Date	IP Address
2014-04-25	88.249.228.129 (ClassC)
2015-06-02	-
2025-01-23	199.59.243.228 (ClassC)

HTTP/1.1 200 OKDate: Thu, 23 Jan 2025 12:58:26 GMTContent-Type: text/html; charsetutf-8Content-Length: 1054X-Request-Id: af00887d-d4d3-4d7b-b74e-ea8bd751066cCache-Control: no-store, max-age0Accept-Ch: sec-ch-prefers-color-schemeCritical-Ch: sec-ch-prefers-color-schemeVary: sec-ch-prefers-color-schemeX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ_UIi927uwmTtti0DdPiCsfRCoRWN4mtm7l4/aI7wZXf/t7DSquOX1Gx1gYUK3EnJK9mcY93xOY0r7mNDp888z7ASet-Cookie: parking_sessionaf00887d-d4d3-4d7b-b74e-ea8bd751066c; expiresThu, 23 Jan 2025 13:13:26 GMT; path/Connection: close

!doctype html>html data-adblockkeyMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ_UIi927uwmTtti0DdPiCsfRCoRWN4mtm7l4/aI7wZXf/t7DSquOX1Gx1gYUK3EnJK9mcY93xOY0r7mNDp888z7A langen stylebackground: #2B2B2B;>head>    meta charsetutf-8>    meta nameviewport contentwidthdevice-width, initial-scale1>    link relicon hrefdata:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC>    link relpreconnect hrefhttps://www.google.com crossorigin>/head>body>div idtarget styleopacity: 0>/div>script>window.park  eyJ1dWlkIjoiYWYwMDg4N2QtZDRkMy00ZDdiLWI3NGUtZWE4YmQ3NTEwNjZjIiwicGFnZV90aW1lIjoxNzM3NjM3MTA2LCJwYWdlX3VybCI6Imh0dHA6Ly9tYWlsLnJvdGFmb3J0ZS5jb20vIiwicGFnZV9tZXRob2QiOiJHRVQiLCJwYWdlX3JlcXVlc3QiOnt9LCJwYWdlX2hlYWRlcnMiOnt9LCJob3N0IjoibWFpbC5yb3RhZm9ydGUuY29tIiwiaXAiOiI1Mi40MC4yMzQuMTA1In0K;/script>script src/bCUUgAeiG.js>/script>/body>/html>

Port 443

HTTP/1.1 200 OKDate: Thu, 23 Jan 2025 12:58:26 GMTContent-Type: text/html; charsetutf-8Content-Length: 1058X-Request-Id: 93d64f38-a290-4068-b8b1-0fa6afa4737eCache-Control: no-store, max-age0Accept-Ch: sec-ch-prefers-color-schemeCritical-Ch: sec-ch-prefers-color-schemeVary: sec-ch-prefers-color-schemeX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ_UIi927uwmTtti0DdPiCsfRCoRWN4mtm7l4/aI7wZXf/t7DSquOX1Gx1gYUK3EnJK9mcY93xOY0r7mNDp888z7ASet-Cookie: parking_session93d64f38-a290-4068-b8b1-0fa6afa4737e; expiresThu, 23 Jan 2025 13:13:26 GMT; path/Connection: close

!doctype html>html data-adblockkeyMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ_UIi927uwmTtti0DdPiCsfRCoRWN4mtm7l4/aI7wZXf/t7DSquOX1Gx1gYUK3EnJK9mcY93xOY0r7mNDp888z7A langen stylebackground: #2B2B2B;>head>    meta charsetutf-8>    meta nameviewport contentwidthdevice-width, initial-scale1>    link relicon hrefdata:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC>    link relpreconnect hrefhttps://www.google.com crossorigin>/head>body>div idtarget styleopacity: 0>/div>script>window.park  eyJ1dWlkIjoiOTNkNjRmMzgtYTI5MC00MDY4LWI4YjEtMGZhNmFmYTQ3MzdlIiwicGFnZV90aW1lIjoxNzM3NjM3MTA2LCJwYWdlX3VybCI6Imh0dHBzOi8vbWFpbC5yb3RhZm9ydGUuY29tLyIsInBhZ2VfbWV0aG9kIjoiR0VUIiwicGFnZV9yZXF1ZXN0Ijp7fSwicGFnZV9oZWFkZXJzIjp7fSwiaG9zdCI6Im1haWwucm90YWZvcnRlLmNvbSIsImlwIjoiNTIuNDAuMjM0LjEwNSJ9Cg;/script>script src/bLRVwZpkJ.js>/script>/body>/html>

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > mail.rotaforte.com

Is this malicious?

Files that talk to mail.rotaforte.com

Whois

DNS Resolutions

Port 80

Port 443