www.wicar.org Open in urlscan Pro
199.34.228.69  Public Scan

42 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://malware.wicar.org/ Page URL
2. https://www.wicar.org/test-malware.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response malware.wicar.org/	334 B 582 B	1516ms 251ms	Document text/html	2607:ff18:80::615 GRIDFURY-AS
General Check archive.org Show headers Download Go to Full URL http://malware.wicar.org/ Protocol HTTP/1.1 Server 2607:ff18:80::615 , United States, ASN40630 (GRIDFURY-AS, US), Reverse DNS Software Apache / Resource Hash 2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 242 Content-Type text/html; charset=UTF-8 Date Thu, 13 Jul 2023 10:34:17 GMT ETag "14e-570a1fa2dc79d" Keep-Alive timeout=5, max=100 Last-Modified Tue, 10 Jul 2018 09:44:32 GMT Server Apache Vary Accept-Encoding Via e3
GET H/1.1	200 OK	Primary Request test-malware.html Show response www.wicar.org/	37 KB 8 KB	2373ms 212ms	Document text/html	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/test-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software Apache / Resource Hash abc33d7b162bed08fe55b0fd472a5147dc2a43d378c6489b2811e8a93ddb8670 Request headers Referer http://malware.wicar.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers Cache-Control private Connection Keep-Alive Content-Encoding gzip Content-Length 8127 Content-Type text/html; charset=UTF-8 Date Thu, 13 Jul 2023 10:34:19 GMT ETag W/"e647a2d987e4137f7535cf4a38443b8a-gzip" Keep-Alive timeout=10, max=68 Server Apache Vary X-W-SSL,Accept-Encoding,User-Agent X-Host blu39.sf2p.intern.weebly.net X-UA-Compatible IE=edge,chrome=1
GET H2	200	sites.css cdn2.editmysite.com/css/	206 KB 29 KB	801ms 262ms	Stylesheet text/css	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/css/sites.css?buildTime=1689085041 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5b6bd64c8f7d37dd7bd34e3760cfffa93a982937376e2c02708f63c35c645a07 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 52, 43 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 158973 x-cache HIT, HIT x-host blu135.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 29663 x-served-by cache-sjc10061-SJC, cache-bom4720-BOM last-modified Tue, 11 Jul 2023 13:46:58 GMT server nginx x-timer S1689244460.231795,VS0,VE0 etag W/"64ad5d52-337f6" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Jul 2023 14:24:46 GMT
GET H2	200	fancybox.css cdn2.editmysite.com/css/old/	4 KB 1 KB	845ms 306ms	Stylesheet text/css	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/css/old/fancybox.css?1234 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 18, 4115 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 780996 x-cache HIT, HIT x-host blu126.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 1218 x-served-by cache-sjc10077-SJC, cache-bom4720-BOM last-modified Fri, 30 Jun 2023 18:39:35 GMT server nginx x-timer S1689244460.232205,VS0,VE0 etag "649f2167-f47" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 18 Jul 2023 09:37:43 GMT
GET H/1.1	200 OK	main_style.css www.wicar.org/files/	13 KB 3 KB	183ms 182ms	Stylesheet text/css	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/files/main_style.css?1680750716 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software nginx / Resource Hash 8e73a9976890dc39b814f08a593d19fea29eafde8bd6518bef62cf08402a879a Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/test-malware.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Thu, 13 Jul 2023 10:34:19 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Access-Control-Allow-Methods GET, POST, DELETE, OPTIONS Content-Type text/css Vary Accept-Encoding Access-Control-Allow-Origin * X-Host blu158.sf2p.intern.weebly.net Connection keep-alive Access-Control-Allow-Headers Origin, Authorization, Content-Type
GET H2	200	font.css cdn2.editmysite.com/fonts/Open_Sans/	3 KB 557 B	843ms 305ms	Stylesheet text/css	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f435c7332d3136b59a056b0c7e23926256b057ac7598568a8120f070c2ec30d4 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 10, 8414 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 693102 x-cache HIT, HIT x-host grn120.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 367 x-served-by cache-sjc10081-SJC, cache-bom4720-BOM last-modified Fri, 30 Jun 2023 04:47:31 GMT server nginx x-timer S1689244460.232227,VS0,VE0 etag "649e5e63-a2a" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 19 Jul 2023 10:02:37 GMT
GET H2	200	jquery-1.8.3.min.js Show response cdn2.editmysite.com/js/	91 KB 33 KB	905ms 367ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/jquery-1.8.3.min.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 95, 3723 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 127565 x-cache HIT, HIT x-host blu87.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33467 x-served-by cache-sjc10032-SJC, cache-bom4720-BOM last-modified Tue, 11 Jul 2023 21:08:46 GMT server nginx x-timer S1689244460.232834,VS0,VE0 etag "64adc4de-16dc4" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Jul 2023 23:08:14 GMT
GET H2	200	stl.js Show response cdn2.editmysite.com/js/lang/en/	178 KB 32 KB	904ms 367ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1234& Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9f17849278ea3971ca67fe008881f2e042351b3b0f279c38efde4f4b02ab8f75 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 31, 1377 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 250262 x-cache HIT, HIT x-host blu75.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33051 x-served-by cache-sjc10047-SJC, cache-bom4720-BOM last-modified Fri, 07 Jul 2023 00:18:12 GMT server nginx x-timer S1689244460.232836,VS0,VE0 etag "64a759c4-2c7eb" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Mon, 24 Jul 2023 13:03:18 GMT
GET H2	200	main.js Show response cdn2.editmysite.com/js/site/	466 KB 143 KB	904ms 367ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/site/main.js?buildTime=1689085041 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 593fec175b00a1f118f77bb8ed378e857e9f1225f0fc019fcea508b27da53cf0 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 65, 2 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 158973 x-cache HIT, HIT x-host grn82.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 146401 x-served-by cache-sjc10069-SJC, cache-bom4720-BOM last-modified Tue, 11 Jul 2023 13:47:22 GMT server nginx x-timer S1689244460.232908,VS0,VE0 etag "64ad5d6a-74804" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Jul 2023 14:24:46 GMT
GET H2	200	stl.js Show response cdn2.editmysite.com/js/lang/en/	178 KB 32 KB	904ms 367ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1689085041& Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9f17849278ea3971ca67fe008881f2e042351b3b0f279c38efde4f4b02ab8f75 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 38, 55 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 158974 x-cache HIT, HIT x-host grn149.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33051 x-served-by cache-sjc10032-SJC, cache-bom4720-BOM last-modified Tue, 11 Jul 2023 13:41:25 GMT server nginx x-timer S1689244460.232855,VS0,VE0 etag "64ad5c05-2c7eb" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Jul 2023 14:24:46 GMT
GET H2	200	main-customer-accounts-site.js Show response cdn2.editmysite.com/js/site/	522 KB 156 KB	1124ms 587ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1689085041 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 207ec261a8530654204ada78a03b0cc6c129c09bac87013c3a8bb3bedfe84be6 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 9, 1 date Thu, 13 Jul 2023 10:34:20 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 158973 x-cache HIT, HIT x-host blu92.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 159104 x-served-by cache-sjc10057-SJC, cache-bom4720-BOM last-modified Tue, 11 Jul 2023 13:47:22 GMT server nginx x-timer S1689244460.232916,VS0,VE1 etag "64ad5d6a-826d7" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Jul 2023 14:24:47 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	177 KB 65 KB	169ms 71ms	Script application/javascript	2404:6800:4017:802::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4017:802::2008 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e45bed1910a2cf7c7d6c63a4e53c837960daf562548ce15dd38414a69fb1b56c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 10:34:21 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65770 x-xss-protection 0 last-modified Thu, 13 Jul 2023 09:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 13 Jul 2023 10:34:21 GMT
GET		buttons.js w.sharethis.com/button/	0 0
GET H/1.1	200 OK	bullet.png www.wicar.org/files/theme/	1 KB 2 KB	179ms 179ms	Image image/png	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.wicar.org/files/theme/bullet.png?1680750716 Requested by Host: www.wicar.org URL: https://www.wicar.org/files/main_style.css?1680750716 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software nginx / Resource Hash e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/files/main_style.css?1680750716 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Thu, 13 Jul 2023 10:34:21 GMT X-Storage-Object e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0 Last-Modified Tue, 27 Oct 2020 15:57:36 GMT Server nginx x-amz-request-id tx0000000000000022b84b3-006284f071-b9fbc20-sfo1 ETag "ade925929d3c8bef998838a29bf90aae" Content-Type image/png; charset=binary x-rgw-object-type Normal X-Storage-Bucket ze459 X-Host blu148.sf2p.intern.weebly.net Connection keep-alive Accept-Ranges bytes Content-Length 1156
GET H3	200	bold.woff2 cdn2.editmysite.com/fonts/Open_Sans/	16 KB 16 KB	552ms 275ms	Font font/woff2	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/bold.woff2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72 Request headers Referer https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Origin https://www.wicar.org accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 40, 556 date Thu, 13 Jul 2023 10:34:21 GMT via 1.1 varnish, 1.1 varnish age 781397 x-cache HIT, HIT x-host grn62.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 16372 x-served-by cache-sjc10053-SJC, cache-bom4728-BOM last-modified Fri, 30 Jun 2023 04:47:31 GMT server nginx x-timer S1689244462.790554,VS0,VE0 etag "649e5e63-3ff4" content-type font/woff2 access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 18 Jul 2023 09:31:04 GMT
GET H3	200	regular.woff2 cdn2.editmysite.com/fonts/Open_Sans/	16 KB 17 KB	549ms 273ms	Font font/woff2	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/regular.woff2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681 Request headers Referer https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Origin https://www.wicar.org accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 28, 1001 date Thu, 13 Jul 2023 10:34:21 GMT via 1.1 varnish, 1.1 varnish age 202874 x-cache HIT, HIT x-host blu41.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 16740 x-served-by cache-sjc10052-SJC, cache-bom4728-BOM last-modified Mon, 10 Jul 2023 18:26:54 GMT server nginx x-timer S1689244462.790561,VS0,VE0 etag "64ac4d6e-4164" content-type font/woff2 access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Jul 2023 02:13:07 GMT
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	133ms 33ms	Script text/javascript	2404:6800:4017:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4017:800::2008 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 13 Jul 2023 10:04:36 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 1785 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17168 expires Thu, 13 Jul 2023 12:04:36 GMT
GET H2	200	snowday262.js Show response cdn2.editmysite.com/js/wsnbn/	73 KB 25 KB	263ms 262ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/wsnbn/snowday262.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-cache-hits 45, 18362 date Thu, 13 Jul 2023 10:34:21 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 611087 x-cache HIT, HIT x-host grn43.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 25752 x-served-by cache-sjc10061-SJC, cache-bom4720-BOM last-modified Wed, 05 Jul 2023 19:58:33 GMT server nginx x-timer S1689244462.536144,VS0,VE0 etag "64a5cb69-124fe" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Thu, 20 Jul 2023 08:49:33 GMT
POST H/1.1	200 OK	/ Show response www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/	348 B 629 B	459ms 306ms	XHR application/json	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/js/jquery-1.8.3.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software Apache / Resource Hash adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.wicar.org/test-malware.html X-Requested-With XMLHttpRequest accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers Date Thu, 13 Jul 2023 10:34:21 GMT Server Apache Vary X-W-SSL,User-Agent Content-Type application/json X-Host blu144.sf2p.intern.weebly.net Connection Keep-Alive Keep-Alive timeout=10, max=66 Content-Length 348 X-UA-Compatible IE=edge,chrome=1
GET H2	200	js Show response www.googletagmanager.com/gtag/	215 KB 76 KB	79ms 77ms	Script application/javascript	2404:6800:4017:802::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-FZX7V2575Y&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4017:802::2008 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 608ab463eabb9be50577a61e567dd2cb9084d2693bc435bb4877d856610c09d0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Thu, 13 Jul 2023 10:34:21 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 77802 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 13 Jul 2023 10:34:21 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	17ms 4ms	Script text/javascript	2404:6800:4003:c1a::65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4003:c1a::65 , Singapore, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 13 Jul 2023 08:37:54 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 6987 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Thu, 13 Jul 2023 10:37:54 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 205 B	5ms 5ms	XHR text/plain	2404:6800:4003:c1a::65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1835686024&t=pageview&_s=1&dl=https%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&dr=http%3A%2F%2Fmalware.wicar.org%2F&ul=en-us&de=UTF-8&dt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1511237498&gjid=237604211&cid=694154005.1689244462&tid=UA-5568574-11&_gid=5084718.1689244462&_r=1&gtm=457e37a0&jsscut=1&z=1284670689 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4003:c1a::65 , Singapore, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.wicar.org/ accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 13 Jul 2023 10:34:21 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.wicar.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	204	collect www.google-analytics.com/g/	0 17 B	11ms 11ms	Ping text/plain	2404:6800:4003:c1a::65 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-FZX7V2575Y&gtm=45je37a0&_p=1835686024&cid=694154005.1689244462&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1689244461&sct=1&seg=0&dl=https%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&dr=http%3A%2F%2Fmalware.wicar.org%2F&dt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&en=page_view&_fv=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-FZX7V2575Y&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 2404:6800:4003:c1a::65 , Singapore, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language zh-SG,zh;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers pragma no-cache date Thu, 13 Jul 2023 10:34:21 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.wicar.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H2	200	tp2 ec.editmysite.com/com.snowplowanalytics.snowplow/	0 0	549ms 179ms	Preflight	34.210.52.168
General Check archive.org Show headers Download Go to Full URL https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.210.52.168 -, , ASN (), Reverse DNS Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.wicar.org Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type, SP-Anonymous access-control-allow-origin https://www.wicar.org access-control-max-age 600 content-length 0 date Thu, 13 Jul 2023 10:34:22 GMT server nginx
POST H2	200	tp2 Show response ec.editmysite.com/com.snowplowanalytics.snowplow/	2 B 320 B	521ms 174ms	XHR text/plain	34.210.52.168
General Check archive.org Show headers Download Go to Full URL https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/js/wsnbn/snowday262.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.210.52.168 -, , ASN (), Reverse DNS Software nginx / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://www.wicar.org/ accept-language zh-SG,zh;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers access-control-allow-origin https://www.wicar.org date Thu, 13 Jul 2023 10:34:22 GMT access-control-allow-credentials true content-type text/plain; charset=UTF-8 server nginx content-length 2 p3p policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

w.sharethis.com

URL

http://w.sharethis.com/button/buttons.js

84 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend string| STATIC_BASE string| ASSETS_BASE string| STYLE_PREFIX function| $ function| jQuery object| Weebly object| _W function| publishedWBJP string| RECAPTCHA_PUBLIC_KEY string| INVISIBLE_RECAPTCHA_PUBLIC_KEY function| _ object| Mustache object| jQBrowser function| PlatformElement function| whenThemeCSSLoaded function| isThemeCSSLoaded function| blogCommentDisplayForm object| YTPlayer object| VimeoPlayer function| Sd function| Rd boolean| Cd function| videojs function| _V_ object| jsonrpc function| getCartCount function| getCartNavElement function| reportCartNavElement function| initPublishedFlyoutMenus boolean| flyoutMenusRefreshable function| initEditorFlyoutMenus function| refreshNavCondense boolean| disableFlyouts function| FlyoutMenu function| objectify object| mejs function| MediaElement function| MediaElementPlayer function| require function| platformElementRequire function| initCustomerAccountsModels object| initEvt string| com_currentSite string| com_userID function| initFlyouts boolean| switchTo5x undefined| windowHref object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| gtag object| dataLayer object| _gaq object| r function| snPlObR string| s object| regEx object| drSegmentsTag undefined| segmentData object| GlobalSnowplowNamespace function| snowday object| jQuery18302977056753902476 boolean| lightboxLoaded object| navFlyoutMenu function| refreshPublishedFlyoutMenus object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| _gat object| gaplugins object| gaGlobal object| gaData object| Snowplow

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.www.wicar.org/	1969-12-31 23:59:59	Name: is_mobile Value: 0
			www.wicar.org/	1970-01-20 13:34:14	Name: language Value: en
			.wicar.org/	1970-01-20 13:15:30	Name: _gid Value: GA1.2.5084718.1689244462
			.wicar.org/	1970-01-20 13:14:04	Name: _gat_gtag_UA_5568574_11 Value: 1
			.wicar.org/	1970-01-20 22:50:04	Name: _ga_FZX7V2575Y Value: GS1.1.1689244461.1.0.1689244461.0.0.0
			.wicar.org/	1970-01-20 22:50:04	Name: _ga Value: GA1.1.694154005.1689244462
			.wicar.org/	1970-01-20 13:14:06	Name: _snow_ses.ae07 Value: *
			.wicar.org/	1970-01-20 22:50:04	Name: _snow_id.ae07 Value: 25f7c264-b9e3-44a5-8bc9-21cf84505db9.1689244462.1.1689244462.1689244462.fbe1abb8-43da-448a-b115-d7685919f40e

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.wicar.org/test-malware.html Message: Mixed Content: The page at 'https://www.wicar.org/test-malware.html' was loaded over HTTPS, but requested an insecure script 'http://w.sharethis.com/button/buttons.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn2.editmysite.com
ec.editmysite.com
malware.wicar.org
ssl.google-analytics.com
w.sharethis.com
www.google-analytics.com
www.googletagmanager.com
www.wicar.org
w.sharethis.com
199.34.228.69
2404:6800:4003:c1a::65
2404:6800:4017:800::2008
2404:6800:4017:802::2008
2607:ff18:80::615
2a04:4e42::302
34.210.52.168
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
207ec261a8530654204ada78a03b0cc6c129c09bac87013c3a8bb3bedfe84be6
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be
593fec175b00a1f118f77bb8ed378e857e9f1225f0fc019fcea508b27da53cf0
5b6bd64c8f7d37dd7bd34e3760cfffa93a982937376e2c02708f63c35c645a07
608ab463eabb9be50577a61e567dd2cb9084d2693bc435bb4877d856610c09d0
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a
8e73a9976890dc39b814f08a593d19fea29eafde8bd6518bef62cf08402a879a
9f17849278ea3971ca67fe008881f2e042351b3b0f279c38efde4f4b02ab8f75
abc33d7b162bed08fe55b0fd472a5147dc2a43d378c6489b2811e8a93ddb8670
adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0
e45bed1910a2cf7c7d6c63a4e53c837960daf562548ce15dd38414a69fb1b56c
f435c7332d3136b59a056b0c7e23926256b057ac7598568a8120f070c2ec30d4