sarumanuser.xyz
Open in
urlscan Pro
2a00:f940:2:2:1:1:0:74
Public Scan
URL:
http://sarumanuser.xyz/auth.php
Submission Tags: c2 malware anubis Search All
Submission: On August 01 via api from US
Submission Tags: c2 malware anubis Search All
Submission: On August 01 via api from US
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 8 HTTP transactions.
The main IP is 2a00:f940:2:2:1:1:0:74, located in
Russian Federation and
belongs to AS-REG, RU.
The main domain is sarumanuser.xyz.
This is the only time sarumanuser.xyz was scanned on urlscan.io!
This is the only time sarumanuser.xyz was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 2a00:f940:2:2... 2a00:f940:2:2:1:1:0:74 | 197695 (AS-REG) (AS-REG) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
| 8 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
sarumanuser.xyz
sarumanuser.xyz |
2 KB |
| 1 |
googleapis.com
ajax.googleapis.com |
34 KB |
| 0 |
anubiscode.fun
Failed
anubiscode.fun Failed |
|
| 8 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | sarumanuser.xyz |
sarumanuser.xyz
|
| 1 | ajax.googleapis.com |
sarumanuser.xyz
|
| 0 | anubiscode.fun Failed |
sarumanuser.xyz
|
| 8 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1O1 |
2021-06-28 - 2021-09-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://sarumanuser.xyz/auth.php
Frame ID: 1D73BE09B4F3BC3EC11706266701B8CF
Requests: 8 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery
(JavaScript libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
auth.php
sarumanuser.xyz/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
style.css
anubiscode.fun/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
funcs.js
anubiscode.fun/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
anubis.png
anubiscode.fun/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
anubis.png
anubiscode.fun/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2.mp4
sarumanuser.xyz/vids/ |
14 KB 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2.mp3
sarumanuser.xyz/vids/ |
11 KB 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- anubiscode.fun
- URL
- https://anubiscode.fun/css/style.css
- Domain
- anubiscode.fun
- URL
- https://anubiscode.fun/js/funcs.js
- Domain
- anubiscode.fun
- URL
- https://anubiscode.fun/anubis.png
- Domain
- anubiscode.fun
- URL
- https://anubiscode.fun/anubis.png
Verdicts & Comments Add Verdict or Comment
9 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
anubiscode.fun
sarumanuser.xyz
anubiscode.fun
2a00:1450:4001:830::200a
2a00:f940:2:2:1:1:0:74
5839d2707e9ba79a86f434715f0ebee90d072c674aa684d18706f9f59e888f19
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404