18.217.136.142 Open in urlscan Pro
18.217.136.142 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://18.217.136.142/PTG/index.php
Submission Tags: c2 malware lampion Search All
Submission: On January 11 via api (January 11th 2020, 5:01:11 pm UTC) from CA

Summary HTTP 5 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 5 HTTP transactions. The main IP is 18.217.136.142, located in Columbus, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is 18.217.136.142.

This is the only time 18.217.136.142 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
4	18.217.136.142 18.217.136.142		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:814::200a		15169 (GOOGLE) (GOOGLE - Google LLC)
5	2

4 18.217.136.142 (Columbus, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-217-136-142.us-east-2.compute.amazonaws.com

18.217.136.142	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	googleapis.com ajax.googleapis.com	29 KB
5	1

	Domain	Requested by
1	ajax.googleapis.com	18.217.136.142
5	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://18.217.136.142/PTG/index.php
Frame ID: 38346C811C907BDDC8EB5A067A356A64
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

5
Requests

0 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

47 kB
Transfer

181 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.php Show response
18.217.136.142/PTG/ 2 KB
1 KB 221ms
207ms Document
text/html 18.217.136.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://18.217.136.142/PTG/index.php
Protocol: HTTP/1.1
Server: 18.217.136.142 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-217-136-142.us-east-2.compute.amazonaws.com
Software: Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.29
Resource Hash: 1fd9b05a45477fa11d84d1c388955f6131c41af17c50da1155e20e3dd95aba6b

Request headers

Host: 18.217.136.142
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Sat, 11 Jan 2020 17:00:57 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.29
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 995
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK bootstrap.min.css
18.217.136.142/PTG/css/ 97 KB
17 KB 123ms
123ms Stylesheet
text/css 18.217.136.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://18.217.136.142/PTG/css/bootstrap.min.css
Requested by: Host: 18.217.136.142
URL: http://18.217.136.142/PTG/index.php
Protocol: HTTP/1.1
Server: 18.217.136.142 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-217-136-142.us-east-2.compute.amazonaws.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: 46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466

Request headers

Referer: http://18.217.136.142/PTG/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Sat, 11 Jan 2020 17:00:57 GMT
Content-Encoding: gzip
Last-Modified: Fri, 12 Oct 2018 10:14:12 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "184dc-57805594de500-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16659

GET
H/1.1 200
OK styles.css
18.217.136.142/PTG/css/ 36 B
317 B 245ms
228ms Stylesheet
text/css 18.217.136.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://18.217.136.142/PTG/css/styles.css
Requested by: Host: 18.217.136.142
URL: http://18.217.136.142/PTG/index.php
Protocol: HTTP/1.1
Server: 18.217.136.142 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-217-136-142.us-east-2.compute.amazonaws.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash: f3fbf9ff1568e7ff489c863a06226d6e94193b9ef9dbaae0204be6d3e5367225

Request headers

Referer: http://18.217.136.142/PTG/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Sat, 11 Jan 2020 17:00:57 GMT
Last-Modified: Fri, 12 Oct 2018 10:14:12 GMT
Server: Apache/2.4.7 (Ubuntu)
ETag: "24-57805594de500"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 36

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.0.2/ 82 KB
29 KB 15ms
8ms Script
text/javascript 2a00:1450:4001:814::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/2.0.2/jquery.min.js

Requested by

Host: 18.217.136.142
URL: http://18.217.136.142/PTG/index.php

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9d7d1c727e1cd32745764098a76e5d3d5fb7acd3b6527c5aacd85b7c6f8ce341

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://18.217.136.142/PTG/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Thu, 21 Nov 2019 23:18:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 20 Dec 2016 18:17:03 GMT
Server: sffe
Age: 4383747
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 29456
X-XSS-Protection: 0
Expires: Fri, 20 Nov 2020 23:18:29 GMT

GET
H/1.1 404
Not Found bootstrap.min.js
18.217.136.142/PTG/js/ 0
0 246ms
229ms Script
text/html 18.217.136.142
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://18.217.136.142/PTG/js/bootstrap.min.js
Requested by: Host: 18.217.136.142
URL: http://18.217.136.142/PTG/index.php
Protocol: HTTP/1.1
Server: 18.217.136.142 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-217-136-142.us-east-2.compute.amazonaws.com
Software: Apache/2.4.7 (Ubuntu) /
Resource Hash

Request headers

Referer: http://18.217.136.142/PTG/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Sat, 11 Jan 2020 17:00:57 GMT
Server: Apache/2.4.7 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 300
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
18.217.136.142
2a00:1450:4001:814::200a
1fd9b05a45477fa11d84d1c388955f6131c41af17c50da1155e20e3dd95aba6b
46a2de362f54e3c988cc8c9fbf68fe12018c8ae42fe11509a747f52f17834466
9d7d1c727e1cd32745764098a76e5d3d5fb7acd3b6527c5aacd85b7c6f8ce341
f3fbf9ff1568e7ff489c863a06226d6e94193b9ef9dbaae0204be6d3e5367225