www.ransomware.live Open in urlscan Pro
149.202.86.189 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Submission: On May 21 via api (May 21st 2025, 8:08:05 am UTC) from GB — Scanned from FR

Summary HTTP 18 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 18 HTTP transactions. The main IP is 149.202.86.189, located in France and belongs to OVH OVH SAS, FR. The main domain is www.ransomware.live.
TLS certificate: Issued by E5 on May 7th 2025. Valid for: 3 months.

This is the only time www.ransomware.live was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	149.202.86.189 149.202.86.189	16276 (OVH OVH SAS) (OVH OVH SAS)
2	104.18.39.141 104.18.39.141	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.16.175.226 104.16.175.226	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.46.99 18.245.46.99	16509 (AMAZON-02) (AMAZON-02)
2	51.178.87.219 51.178.87.219	16276 (OVH OVH SAS) (OVH OVH SAS)
18	6

6 149.202.86.189 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns3018561.ip-149-202-86.eu

www.ransomware.live	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
images.ransomware.live	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 104.18.39.141 (None, )

ASN13335 (CLOUDFLARENET, US)

analytics.ahrefs.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 104.16.175.226 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 18.245.46.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-99.fra56.r.cloudfront.net

img.logo.dev	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 51.178.87.219 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: 219.ip-51-178-87.eu

stats.mousqueton.io	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
6	ransomware.live www.ransomware.live images.ransomware.live	1 MB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 271	315 KB
3	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 334	120 KB
2	mousqueton.io stats.mousqueton.io	67 KB
2	ahrefs.com analytics.ahrefs.com — Cisco Umbrella Rank: 10174	2 KB
1	logo.dev img.logo.dev — Cisco Umbrella Rank: 211793	54 KB
18	6

	Domain	Requested by
4	cdnjs.cloudflare.com	www.ransomware.live cdnjs.cloudflare.com
3	images.ransomware.live	www.ransomware.live
3	cdn.jsdelivr.net	www.ransomware.live
3	www.ransomware.live	www.ransomware.live
2	stats.mousqueton.io	www.ransomware.live stats.mousqueton.io
2	analytics.ahrefs.com	www.ransomware.live analytics.ahrefs.com
1	img.logo.dev	www.ransomware.live
18	7

This site contains links to these domains. Also see Links.

Domain
buymeacoffee.com
hudsonrock.com
demeesternv.be
ransomwarelive.freshdesk.com
bsky.app
github.com
www.linkedin.com
logo.dev

Subject Issuer	Validity	Valid
ransomware.live E5	`2025-05-07` - `2025-08-05`	3 months	crt.sh
ahrefs.com WE1	`2025-04-05` - `2025-07-04`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2025-04-25` - `2026-05-04`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2025-03-24` - `2025-06-22`	3 months	crt.sh
img.logo.dev Amazon RSA 2048 M02	`2024-12-27` - `2026-01-25`	a year	crt.sh
stats.mousqueton.io E6	`2025-03-23` - `2025-06-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Frame ID: 4A3CC172F68DCA1C49502D3D683E5FEE
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ransomware.live Victim: Horecamaterialen De Meester NV

Detected technologies

Chart.js (JavaScript graphics) Expand

Overall confidence: 75%
Detected patterns

/Chart(?:\.bundle)?(?:\.min)?\.js

Bootstrap (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

2054 kB
Transfer

2526 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://buymeacoffee.com/ransomwarelive
Title: ☕️ Buy me a coffee

Search URL Search Domain Scan URL

URL: https://hudsonrock.com/free-tools/?=ransomwarelive
Title: Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Search URL Search Domain Scan URL

URL: https://demeesternv.be/

Search URL Search Domain Scan URL

URL: https://ransomwarelive.freshdesk.com/support/tickets/new
Title: Contact us

Search URL Search Domain Scan URL

URL: https://bsky.app/profile/ransomware.live
Title: BlueSky

Search URL Search Domain Scan URL

URL: https://github.com/jmousqueton/ransomware.live
Title: GitHub

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ransomwarelive
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://logo.dev/
Title: Logo.dev

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M=' Show response
www.ransomware.live/id/ 19 KB
6 KB 135ms
56ms Document
text/html 149.202.86.189
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 149.202.86.189 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3018561.ip-149-202-86.eu
Software: nginx /
Resource Hash: 4bc715159bceeffee60e65d8383517962de8222e1073bb6340f7e831933058ea

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 21 May 2025 08:08:05 GMT
server: nginx

GET
H3 200 analytics.js Show response
analytics.ahrefs.com/ 3 KB
2 KB 53ms
31ms Script
text/javascript 104.18.39.141
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://analytics.ahrefs.com/analytics.js
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.39.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0328cebc626c62ac3d4466f5152bcd976c76500ddd3a68ef71220a96836c0b71

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

x-request-id: d3fa3857-9293-4242-9460-1785b9eae06c
content-encoding: gzip
cf-cache-status: HIT
age: 213
traceparent: 00--e7607ac541f74904-03
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 21 May 2025 08:08:05 GMT
content-type: text/javascript
last-modified: Wed, 21 May 2025 08:04:32 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cdn-cache-control: max-age=18000
cf-ray: 9432957b18bc00b5-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1430
server: cloudflare

GET
H2 200 style.css
www.ransomware.live/static/ 2 KB
2 KB 110ms
106ms Stylesheet
text/css 149.202.86.189
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://www.ransomware.live/static/style.css
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 149.202.86.189 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3018561.ip-149-202-86.eu
Software: nginx /
Resource Hash: 183bc98ee7e03771ea7504b636d71037dfbd1bea74666b45c3d2a12984490b50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='

Response headers

cache-control: no-cache
etag: "1746734233.5561593-1691-1109331907"
content-length: 1691
date: Wed, 21 May 2025 08:08:05 GMT
content-type: text/css; charset=utf-8
content-disposition: inline; filename=style.css
server: nginx
last-modified: Thu, 08 May 2025 19:57:13 GMT

GET
H2 200 chart.js Show response
cdn.jsdelivr.net/npm/ 202 KB
70 KB 98ms
47ms Script
application/javascript 104.16.175.226
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/chart.js

Requested by

Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.175.226 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bce154080959c574be0bb6b1a924ff32f08ebc6ff460c159171f51c53802c844

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"32860-yn7HE6wYxO0DSriSgklawkhwxtY"
age: 19694
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mevfBHtE7F7FR9EMRtCk8YNGNV5%2F7R6ImBc8gAkTnn%2FJdC9P4%2BSRkRiO6Y46PG3pxL6u8CEBKhV1629swvQ%2B925L75WAtDclm7se0HBDj7mu%2BJYe8iEeLJUEkpxp%2BWrZaiE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21985-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957b4b94216f-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 71292
server: cloudflare
x-jsd-version: 4.4.9

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/ 227 KB
28 KB 75ms
24ms Stylesheet
text/css 104.16.175.226
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css

Requested by

Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.175.226 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"38d63-xawd7pYctZoEUlbsID9p4xeHL3w"
age: 536873
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OcuxQGq%2FJHNT23JkR8ngXhaKYas%2Bcz%2BE%2B8pkJNny4pCiFTOB4w7Aa8xsZquIhABVgjyFYuxsfXM%2FLWaaC3Z9YBSJXrUNkwOgl3i8m6dkoF6nyOfWd3CT8hmVDfk9%2ByO%2BcTY%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Wed, 21 May 2025 08:08:05 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230118-FRA, cache-lga21925-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957b4b8f216f-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27432
server: cloudflare
x-jsd-version: 5.3.3

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/ 79 KB
23 KB 90ms
40ms Script
application/javascript 104.16.175.226
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js

Requested by

Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.175.226 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"13b51-3cbp6tbRaukjc5nOQejBYgzFnDY"
age: 535865
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WNRfhSX5eecVgi9dPxN2tMeRGX9K4DaH%2FVbjVVmPf9y81oeSgY5gMjP%2BEHqo%2B5b%2Fc3b2KmppZVEY355Ak9afnebf8KzsiBSsXfIeIznKUTEwU7o4oYtf75b2JDN0F5o55lM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443"; ma=86400
x-cache: HIT, HIT
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230062-FRA, cache-lga21924-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957b4b90216f-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22790
server: cloudflare
x-jsd-version: 5.3.3

GET
H3 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/ 94 KB
19 KB 58ms
37ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Requested by

Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5e202e3c899507992952533f57b634722b69b34241d271963559d31aa33ef81

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "6696a8d8-491a"
age: 405882
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v4FagKMsR79KgsmSj4WcLvg8AdMGzK%2FvkunY33kR4bT0wpNRIB9CjVD4mqrR7fIaYqOdDQIZY6dzzcc0ZcZlpcPSiOIML8yJ09u%2BJONDW5USWw7%2Fvp3xremLlx5KVknQgu7i8KIa"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 11 May 2026 08:08:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 21 May 2025 08:08:05 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 16 Jul 2024 17:07:36 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957b18150288-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18714
server: cloudflare

GET
H2 200 logo.png
images.ransomware.live/ 1 MB
1 MB 71ms
64ms Image
image/png 149.202.86.189
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://images.ransomware.live/logo.png
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 149.202.86.189 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3018561.ip-149-202-86.eu
Software: nginx /
Resource Hash: 79270e29ab9b68f57b36dbc57b901390f79d320984a196cf97fd89426bd615ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

accept-ranges: bytes
content-length: 1405130
date: Wed, 21 May 2025 08:08:05 GMT
etag: "6820f15d-1570ca"
content-type: image/png
last-modified: Sun, 11 May 2025 18:50:05 GMT
server: nginx

GET
H2 200 demeesternv.be
img.logo.dev/ 54 KB
54 KB 150ms
37ms Image
image/png 18.245.46.99
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://img.logo.dev/demeesternv.be?token=pk_Txj9HAt5QTuMD0SLJCKIrQ&format=png&retina=true&fallback=404
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-99.fra56.r.cloudfront.net
Software: /
Resource Hash: 3433683760f258a9e481a5752d97df0c4691fc8b4541c88804f94499b701fbe0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

cache-control: max-age=86400, stale-while-revalidate=600
age: 54828
via: 1.1 6b15a9d1514a5645abfd43cbf330ce48.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: QF8VpBnlDVpJa5-vpL64ZZxFHXPJwxAFR0kdGuokgNPLXKe-BMDyKw==
date: Tue, 20 May 2025 16:54:17 GMT
content-type: image/png
x-amz-cf-pop: FRA56-P9
vary: Origin

GET
H2 200 BE.svg
images.ransomware.live/flags/ 426 B
550 B 204ms
204ms Image
image/svg+xml 149.202.86.189
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://images.ransomware.live/flags/BE.svg
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 149.202.86.189 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3018561.ip-149-202-86.eu
Software: nginx /
Resource Hash: 4972fe46aaf27da346b24610c8506897163040b85e1ece7d7913e3794b4f8208

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

accept-ranges: bytes
content-length: 426
date: Wed, 21 May 2025 08:08:05 GMT
etag: "678e30ee-1aa"
content-type: image/svg+xml
last-modified: Mon, 20 Jan 2025 11:18:06 GMT
server: nginx

GET
H2 200 c37c5eefd74965fe9f6c557690a186bb.png
images.ransomware.live/victims/ 103 KB
103 KB 205ms
204ms Image
image/png 149.202.86.189
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://images.ransomware.live/victims/c37c5eefd74965fe9f6c557690a186bb.png
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 149.202.86.189 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3018561.ip-149-202-86.eu
Software: nginx /
Resource Hash: c0630af419cb51f22dad016fa1f5864aa711243d9625cb1a87e0ec1b4f2106ff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

accept-ranges: bytes
content-length: 105292
date: Wed, 21 May 2025 08:08:05 GMT
etag: "682a0f38-19b4c"
content-type: image/png
last-modified: Sun, 18 May 2025 16:47:52 GMT
server: nginx

POST
H3 200 event Show response
analytics.ahrefs.com/api/ 11 B
284 B 134ms
116ms XHR
application/json 104.18.39.141
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://analytics.ahrefs.com/api/event
Requested by: Host: analytics.ahrefs.com
URL: https://analytics.ahrefs.com/analytics.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.39.141 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d42d95676a5fb59c33cf368c1c8fc71930805c1f4111bb007f02ca6bc05ed42a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.ransomware.live/

Response headers

x-request-id: 2305064d-e88a-479c-8b63-5985ed0930a4
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 9432957b6ca13a77-CDG
traceparent: 00--2abc3cc75ff348aa-03
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H3 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/webfonts/ 154 KB
154 KB 54ms
53ms Font
application/octet-stream 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f0189e087fcefbf654fad74a3a06668b782c01353a61d5c0b7f0bf23e33c020

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.ransomware.live
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Response headers

cf-cdnjs-via: cfworker/kv
cf-cache-status: HIT
etag: "6696a8d8-26608"
age: 407187
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XsnqK3NcWWTHXd0k9cSToKSwrY%2BFvaE35QcHsVU4d%2FyS9aIo2sbkbuqdQBQIH136X%2FFc9ZSk0p3lnF4PkEaVFwTZXDcdECXVIrEU7VOTlTY8ubuOi5MqMsojPkeYfedKZ%2Bio2nY0"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 11 May 2026 08:08:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/octet-stream; charset=utf-8
last-modified: Tue, 16 Jul 2024 17:07:36 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957bfa4722b1-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 157192
server: cloudflare

GET
H2 200 matomo.js Show response
stats.mousqueton.io/ 66 KB
67 KB 131ms
47ms Script
application/javascript 51.178.87.219
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://stats.mousqueton.io/matomo.js
Requested by: Host: www.ransomware.live
URL: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 51.178.87.219 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: 219.ip-51-178-87.eu
Software: nginx /
Resource Hash: a3b5d74233c65818946c2ae1e6fab1bdc04b8e051bdec7523ba4483c8058eda0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/

Response headers

cache-control: max-age=3600, public
etag: "6817155f-10988"
pragma: public
expires: Wed, 21 May 2025 09:08:05 GMT
accept-ranges: bytes
content-length: 67976
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/javascript
last-modified: Sun, 04 May 2025 07:21:03 GMT
server: nginx

GET
H3 200 fa-regular-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/webfonts/ 25 KB
26 KB 31ms
31ms Font
application/octet-stream 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/webfonts/fa-regular-400.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c732f106e91bc618767fbac8e2c7b27e5c736d477b2bb4fb83f597a43198c33c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.ransomware.live
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Response headers

cf-cdnjs-via: cfworker/kv
cf-cache-status: HIT
etag: "6696a8d8-6378"
age: 542632
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BIzr%2Bvo5EffjX5n6Rl6wgtAlw8GIPg13uQ6XzgW7jsaXU70lDjuN1XchD%2FG%2BGc%2BF1HIyWCBI5IjQhgZFcbFHdsjjAS%2FdweLkJqUFT5yS9fyOYfWcc8bf6KJp3P%2Bd8DppaOVyT%2BDF"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 11 May 2026 08:08:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/octet-stream; charset=utf-8
last-modified: Tue, 16 Jul 2024 17:07:36 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957bfa4822b1-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25464
server: cloudflare

GET
H3 200 fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/webfonts/ 115 KB
116 KB 31ms
30ms Font
application/octet-stream 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/webfonts/fa-brands-400.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c411f11975d26eb04cd2aa3c071181d4b18e489f1fb97060d4176a3531dfb36e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://www.ransomware.live
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.6.0/css/all.min.css

Response headers

cf-cdnjs-via: cfworker/kv
cf-cache-status: HIT
etag: "6696a8d8-1cd38"
age: 153501
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D0MUFlziHyCZJ7oSqivX5kO0B%2FeqR3yS13yXVuwEx7tt6FQIxpUroQ9t8xofEvJKEGfoPHW09LEG2DHlyuAgDd0%2BMVrFokWfvFp50qkbOQutHOrIm3f8U7qJDzcIrnSfCdu2RUnP"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 11 May 2026 08:08:05 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 21 May 2025 08:08:05 GMT
content-type: application/octet-stream; charset=utf-8
last-modified: Tue, 16 Jul 2024 17:07:36 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 9432957bfa4922b1-CDG
accept-ranges: bytes
access-control-allow-origin: *
content-length: 118072
server: cloudflare

POST
H2 204 matomo.php
stats.mousqueton.io/ 0
210 B 87ms
86ms Ping
text/plain 51.178.87.219
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://stats.mousqueton.io/matomo.php?action_name=Ransomware.live%20Victim%3A%20Horecamaterialen%20De%20Meester%20NV&idsite=1&rec=1&r=152813&h=10&m=8&s=5&url=https%3A%2F%2Fwww.ransomware.live%2Fid%2FSG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M%3D%27&_id=&_idn=1&send_image=0&_refts=0&pv_id=5QH7Nq&pf_net=79&pf_srv=56&pf_tfr=1&pf_dm1=163&uadata=%7B%22formFactors%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200

Requested by

Host: stats.mousqueton.io
URL: https://stats.mousqueton.io/matomo.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

51.178.87.219 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

219.ip-51-178-87.eu

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://www.ransomware.live/

Response headers

strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: origin
access-control-allow-origin: https://www.ransomware.live
date: Wed, 21 May 2025 08:08:05 GMT
x-xss-protection: 1; mode=block
server: nginx

GET
H2 200 favicon.ico
www.ransomware.live/static/ 10 KB
10 KB 32ms
31ms Other
image/vnd.microsoft.icon 149.202.86.189
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://www.ransomware.live/static/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 149.202.86.189 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3018561.ip-149-202-86.eu
Software: nginx /
Resource Hash: 8ad5f057cb392d42151f2ee0246eb5b769bc36b69f934eff78ea2fb8b0647b1c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://www.ransomware.live/id/SG9yZWNhbWF0ZXJpYWxlbiBEZSBNZWVzdGVyIE5WQHdvcmxkbGVha3M='

Response headers

cache-control: no-cache
etag: "1746693073.7107701-10462-1641484394"
content-length: 10462
date: Wed, 21 May 2025 08:08:05 GMT
content-type: image/vnd.microsoft.icon
content-disposition: inline; filename=favicon.ico
server: nginx
last-modified: Thu, 08 May 2025 08:31:13 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.ransomware.live/	1970-01-21 14:15:50	Name: theme Value: light

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.ahrefs.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
images.ransomware.live
img.logo.dev
stats.mousqueton.io
www.ransomware.live
104.16.175.226
104.17.25.14
104.18.39.141
149.202.86.189
18.245.46.99
51.178.87.219
0328cebc626c62ac3d4466f5152bcd976c76500ddd3a68ef71220a96836c0b71
0833b2e9c3a26c258476c46266e6877fc75218625162e0460be9a3a098a61c6c
183bc98ee7e03771ea7504b636d71037dfbd1bea74666b45c3d2a12984490b50
1f0189e087fcefbf654fad74a3a06668b782c01353a61d5c0b7f0bf23e33c020
3433683760f258a9e481a5752d97df0c4691fc8b4541c88804f94499b701fbe0
3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8
4972fe46aaf27da346b24610c8506897163040b85e1ece7d7913e3794b4f8208
4bc715159bceeffee60e65d8383517962de8222e1073bb6340f7e831933058ea
79270e29ab9b68f57b36dbc57b901390f79d320984a196cf97fd89426bd615ae
8ad5f057cb392d42151f2ee0246eb5b769bc36b69f934eff78ea2fb8b0647b1c
a3b5d74233c65818946c2ae1e6fab1bdc04b8e051bdec7523ba4483c8058eda0
bce154080959c574be0bb6b1a924ff32f08ebc6ff460c159171f51c53802c844
c0630af419cb51f22dad016fa1f5864aa711243d9625cb1a87e0ec1b4f2106ff
c411f11975d26eb04cd2aa3c071181d4b18e489f1fb97060d4176a3531dfb36e
c732f106e91bc618767fbac8e2c7b27e5c736d477b2bb4fb83f597a43198c33c
d42d95676a5fb59c33cf368c1c8fc71930805c1f4111bb007f02ca6bc05ed42a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e202e3c899507992952533f57b634722b69b34241d271963559d31aa33ef81

www.ransomware.live Open in urlscan Pro 149.202.86.189 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

2054 kBTransfer

2526 kBSize

1 Cookies

8 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Window variables

1 Cookies

Indicators

www.ransomware.live Open in urlscan Pro
149.202.86.189 Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

2054 kB
Transfer

2526 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions