FILEMembers
FILE

Same external host appears in two browser sandbox reports

Two reports for the same local HTML file record a lookup of www.webzdarma.cz and a connection to its resolved address. The recurrence makes the host a focused investigative lead, but the records do not show what initiated the contact or what, if anything, the host supplied.

Oct 29, 2026, 17:37 (UTC+9)Last seenOct 29, 2026Severity100ByCTX TeamActorSalty SpiderKuKuIOC34MITRE58RegionsBD

Two browser sandbox reports for the same local HTML file record a lookup of www.webzdarma.cz and a TCP connection to its resolved address, 185.64.219.22, on port 443. One report opened the file in Microsoft Edge; the other used Google Chrome. The repeated destination raises a concrete question: what role did that external host play when the local page was opened? The records reviewed by CTX Threat Intelligence establish a useful hostname-to-address connection in both environments.

Members only

Members-only article

This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.

Sign in to read
Source: CTX Threat Intelligence