
Same external host appears in two browser sandbox reports
Two reports for the same local HTML file record a lookup of www.webzdarma.cz and a connection to its resolved address. The recurrence makes the host a focused investigative lead, but the records do not show what initiated the contact or what, if anything, the host supplied.
Two browser sandbox reports for the same local HTML file record a lookup of www.webzdarma.cz and a TCP connection to its resolved address, 185.64.219.22, on port 443. One report opened the file in Microsoft Edge; the other used Google Chrome. The repeated destination raises a concrete question: what role did that external host play when the local page was opened? The records reviewed by CTX Threat Intelligence establish a useful hostname-to-address connection in both environments.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read