alege.malware.ltd
Open in
urlscan Pro
2a06:98c1:3121::3
Public Scan
Submission Tags: c2 malware evisyn Search All
Submission: On September 05 via api from US — Scanned from NL
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 8th 2022. Valid for: a year.
This is the only time alege.malware.ltd was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3033::6815:3f36 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
malware.ltd
alege.malware.ltd |
26 KB |
2 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 897 |
48 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 691 |
35 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 212 |
27 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
4 | alege.malware.ltd |
alege.malware.ltd
|
2 | use.fontawesome.com |
alege.malware.ltd
use.fontawesome.com |
2 | maxcdn.bootstrapcdn.com |
alege.malware.ltd
|
1 | cdnjs.cloudflare.com |
alege.malware.ltd
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-08 - 2023-06-07 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://alege.malware.ltd/login.php
Frame ID: 83CD9E201E6D1448441E84FEBEBB887E
Requests: 6 HTTP requests in this frame
Frame:
https://alege.malware.ltd/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1662336000
Frame ID: 18CD91EBDEB26733A2DEED238B43B893
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Evisyn — LoginDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
alege.malware.ltd/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.0.8/css/ |
35 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
use.fontawesome.com/releases/v5.0.8/webfonts/ |
39 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
invisible.js
alege.malware.ltd/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 18CD |
35 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pica.js
alege.malware.ltd/cdn-cgi/challenge-platform/h/g/scripts/ Frame 18CD |
18 KB 8 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
745ab64aff939134
alege.malware.ltd/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 18CD |
2 B 684 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| bootstrap function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
alege.malware.ltd/ | Name: PHPSESSID Value: ejdammftc2ra3k4e2et22sb9hr |
|
.malware.ltd/ | Name: __cf_bm Value: P_o3KxFGuZrzZmsV0qfVgAxIewqHNj8XckDhoNbDVi4-1662336314-0-AYUkL7hMwpxK+U3eReee4L6Fkn2Zq+OPiJnk9JLAyYrYCjdIyCSStfSU455wx25gJR4j2q/4g52D2OP8TPdsTiBdYJXMOPCz1Htp6Nc3X9yPPp2f/ncj0svc4Ez/hV/f1Q== |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
alege.malware.ltd
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
use.fontawesome.com
2606:4700:3033::6815:3f36
2606:4700::6811:190e
2606:4700::6812:acf
2a06:98c1:3121::3
04608e5d48c008b657943bcfc649a56e883259802072c401d7fbe121d7e85105
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
4080b83d8afc4487b8229308be2f196372bd2123613b46388048f14159f07181
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3
5bccc18b1b93928eab96d314ac1a2eef71708f1dbf585244c292d1da3259619c
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
db62db1b27628a5fdbc492e96641f215bb44acf332ab104b72a7f1e0a3076e56
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b