45.131.64.67
45.131.64.67 Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

Submitted URL:
http://45.131.64.67/vst/test.php
Effective URL:
https://45.131.64.67/vst/test.php
Submission Tags: c2 malware kamasers Search All
Submission: On October 19 via api (October 19th 2025, 1:41:30 pm UTC) from US — Scanned from US

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 0 domains to perform 3 HTTP transactions. The main IP is 45.131.64.67, located in Germany and belongs to FlorianKolb Florian Kolb, DE. The main domain is 45.131.64.67.
TLS certificate: Issued by localhost on November 10th 2009. Valid for: 10yr.

This is the only time 45.131.64.67 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
3	45.131.64.67 45.131.64.67		58087 (FlorianKo...) (FlorianKolb Florian Kolb)
3	1

3 45.131.64.67 (Germany)

ASN58087 (FlorianKolb Florian Kolb, DE)
PTR: 67.64.131.45.in-addr.arpa

45.131.64.67	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
3	0

	Domain	Requested by
3	0

This site contains no links.

Subject Issuer	Validity	Valid
localhost localhost	`2009-11-10` - `2019-11-08`	10yr	crt.sh

This page contains 1 frames:

Primary Page: https://45.131.64.67/vst/test.php
Frame ID: B79A4C7B30625D4D8D9D0105DF9862F1
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

zeta Login

Page URL History Show full URLs

http://45.131.64.67/vst/test.php HTTP 307
https://45.131.64.67/vst/test.php Page URL

Detected technologies

PHP (Programming languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

1
IPs

1
Countries

39 kB
Transfer

38 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://45.131.64.67/vst/test.php HTTP 307
https://45.131.64.67/vst/test.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request test.php Show response 45.131.64.67/vst/ Redirect Chain http://45.131.64.67/vst/test.php https://45.131.64.67/vst/test.php	638 B 1 KB	881ms 420ms	Document text/html	45.131.64.67 FlorianKolb Flori...
General Check archive.org Download Go to Full URL https://45.131.64.67/vst/test.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.131.64.67 , Germany, ASN58087 (FlorianKolb Florian Kolb, DE), Reverse DNS 67.64.131.45.in-addr.arpa Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / PHP/8.0.30 Resource Hash `8be6ad65bd433e8af6f273592b82440174ea4dee25cba4303619f891d5a64436` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 638 Content-Type text/html; charset=UTF-8 Date Sun, 19 Oct 2025 13:41:31 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 X-Powered-By PHP/8.0.30 Redirect headers Location https://45.131.64.67/vst/test.php Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	panel_styles.css 45.131.64.67/vst/	7 KB 7 KB	231ms 231ms	Stylesheet text/css	45.131.64.67 FlorianKolb Flori...
General Check archive.org Download Go to Full URL https://45.131.64.67/vst/panel_styles.css Requested by Host: 45.131.64.67 URL: https://45.131.64.67/vst/test.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.131.64.67 , Germany, ASN58087 (FlorianKolb Florian Kolb, DE), Reverse DNS 67.64.131.45.in-addr.arpa Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash `e52cbc59e964af47610bce5990cc18f280b0964811a01725a7adbed3afa7fbc3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://45.131.64.67/vst/test.php Response headers ETag "1aff-63cd72ba9e637" Connection Keep-Alive Accept-Ranges bytes Content-Length 6911 Keep-Alive timeout=5, max=99 Date Sun, 19 Oct 2025 13:41:31 GMT Last-Modified Thu, 21 Aug 2025 02:51:48 GMT Content-Type text/css Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
GET H/1.1	200 OK	favicon.ico 45.131.64.67/	30 KB 30 KB	241ms 240ms	Other image/x-icon	45.131.64.67 FlorianKolb Flori...
General Check archive.org Download Go to Full URL https://45.131.64.67/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 45.131.64.67 , Germany, ASN58087 (FlorianKolb Florian Kolb, DE), Reverse DNS 67.64.131.45.in-addr.arpa Software Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 / Resource Hash `1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://45.131.64.67/vst/test.php Response headers ETag "78ae-51affc7a4c400" Connection Keep-Alive Accept-Ranges bytes Content-Length 30894 Keep-Alive timeout=5, max=98 Date Sun, 19 Oct 2025 13:41:31 GMT Last-Modified Thu, 16 Jul 2015 15:32:32 GMT Content-Type image/x-icon Server Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

Verdicts & Comments Add Verdict or Comment

0 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			45.131.64.67/	1969-12-31 23:59:59	Name: PHPSESSID Value: ehc6818j8asooj1vluusm67a7r

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://45.131.64.67/vst/test.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

45.131.64.67
1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9
8be6ad65bd433e8af6f273592b82440174ea4dee25cba4303619f891d5a64436
e52cbc59e964af47610bce5990cc18f280b0964811a01725a7adbed3afa7fbc3

45.131.64.67 45.131.64.67 Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective URL Pivot

Effective IP

Summary

urlscan.io Verdict: No classification

Domain & IP information

IP Lookup

ASN Lookup

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

1 IPs

1 Countries

39 kBTransfer

38 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Window variables

1 Cookies

1 Console Messages

Indicators

45.131.64.67
45.131.64.67 Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

3
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

1
IPs

1
Countries

39 kB
Transfer

38 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions