Recurring POST requests met redirects, including a domain-sale page
A Windows executable’s sandbox reports show repeated requests to the same web path on two hosts, while a local report records startup registry writes. The responses show that web services answered—including one that redirected to a domain-sale page—but do not establish command delivery or a successful control session.
A Windows executable’s sandbox record contains POST requests to /b3/order.php on two hosts. One returned redirects to the same path; the other directed the client to a domain-sale page. In the same Lastline report, AdobeAcrobat entries appeared under Windows startup registry keys. The combination raises a more useful question than whether the domains are suspicious: what did the executable try to establish locally, and what service actually answered its outbound requests?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read