URL: http://109.120.178.28/auth/login
Submission Tags: c2 malware meduza Search All
Submission: On September 20 via api from US — Scanned from FR

Summary

This website contacted 2 IPs in 1 countries across 0 domains to perform 9 HTTP transactions. The main IP is 109.120.178.28, located in Paris, France and belongs to AEZA-AS, GB. The main domain is 109.120.178.28.
This is the only time 109.120.178.28 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 109.120.178.28 210644 (AEZA-AS)
9 2
Apex Domain
Subdomains
Transfer
9 0
Domain Requested by
9 0

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://109.120.178.28/auth/login
Frame ID: 65382F7B701149647C35ADAB6C7B9060
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Meduza Stealer 2.9

Page URL History Show full URLs

  1. http://109.120.178.28/auth/login HTTP 307
    https://109.120.178.28/auth/login HTTP 307
    http://109.120.178.28/auth/login Page URL

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

3433 kB
Transfer

3434 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://109.120.178.28/auth/login HTTP 307
    https://109.120.178.28/auth/login HTTP 307
    http://109.120.178.28/auth/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
109.120.178.28/auth/
Redirect Chain
  • http://109.120.178.28/auth/login
  • https://109.120.178.28/auth/login
  • http://109.120.178.28/auth/login
519 B
824 B
Document
General
Full URL
http://109.120.178.28/auth/login
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
ab3a1c6373c4671214f3f2d196985a335fc745accbd13f4c40e9c5020c7c5516

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
public, max-age=43200
content-length
519
content-type
text/html; charset=utf-8
date
Fri, 20 Sep 2024 00:44:19 GMT
etag
"1721064124.5623908-519-2586778377"
expires
Fri, 20 Sep 2024 12:44:19 GMT
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11

Redirect headers

Location
http://109.120.178.28/auth/login
Non-Authoritative-Reason
HttpsUpgrades
index-R_HwHhKK.js
109.120.178.28/assets/
2 MB
2 MB
Script
General
Full URL
http://109.120.178.28/assets/index-R_HwHhKK.js
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/auth/login
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
5d4b1a8221b9c1a2c77ba6fbf02be4f21e3b42ddf7a4a76e3d4263f47e1c29b4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
http://109.120.178.28
Referer
http://109.120.178.28/auth/login

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5633905-2445565-1018044419"
expires
Fri, 20 Sep 2024 12:44:19 GMT
content-length
2445565
date
Fri, 20 Sep 2024 00:44:19 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
index-Gnhp7EuE.css
109.120.178.28/assets/
55 KB
55 KB
Stylesheet
General
Full URL
http://109.120.178.28/assets/index-Gnhp7EuE.css
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/auth/login
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
fd2dd8642bd058cc2c7c39f1b0faf0adec2e16ae734c8006dd49f6415769b4bb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
http://109.120.178.28
Referer
http://109.120.178.28/auth/login

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5623908-56129-1569857660"
expires
Fri, 20 Sep 2024 12:44:19 GMT
content-length
56129
date
Fri, 20 Sep 2024 00:44:19 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24599a8c6b67b31fcd42e5e68c7e158065aa192b6678c0881ac651e51c7385c6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/

Response headers

Content-Type
image/png
snake-lPgznXqp.png
109.120.178.28/assets/
114 KB
115 KB
Image
General
Full URL
http://109.120.178.28/assets/snake-lPgznXqp.png
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/assets/index-Gnhp7EuE.css
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
86a203c0bec9406ec46d264ecd99a2283c4ced726cccf548b64378784626f944

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/assets/index-Gnhp7EuE.css

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5493906-117220-1630871795"
expires
Fri, 20 Sep 2024 12:44:20 GMT
content-length
117220
date
Fri, 20 Sep 2024 00:44:20 GMT
content-type
image/png
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
Meduza-Xf1ectds.png
109.120.178.28/assets/
569 KB
570 KB
Image
General
Full URL
http://109.120.178.28/assets/Meduza-Xf1ectds.png
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/assets/index-Gnhp7EuE.css
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
ca6bbc108872be8f8954aa0aff4e488a62ddc97ac1675ca6ec2ef460f3a256de

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/assets/index-Gnhp7EuE.css

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5623908-582902-2122457349"
expires
Fri, 20 Sep 2024 12:44:20 GMT
content-length
582902
date
Fri, 20 Sep 2024 00:44:20 GMT
content-type
image/png
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
profile-bXjbzb05.png
109.120.178.28/assets/
18 KB
18 KB
Image
General
Full URL
http://109.120.178.28/assets/profile-bXjbzb05.png
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/assets/index-Gnhp7EuE.css
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
4ffe10c03698b7a8c507479d78e19578610b418c76367f44c19adcb7e204a573

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/assets/index-Gnhp7EuE.css

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5523908-18573-2739085653"
expires
Fri, 20 Sep 2024 12:44:20 GMT
content-length
18573
date
Fri, 20 Sep 2024 00:44:20 GMT
content-type
image/png
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
Comfortaa-VariableFont_wght-R_5AX4pn.ttf
109.120.178.28/assets/
198 KB
199 KB
Font
General
Full URL
http://109.120.178.28/assets/Comfortaa-VariableFont_wght-R_5AX4pn.ttf
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/assets/index-Gnhp7EuE.css
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
b9281be276c9f683947bb52f44f30d27dccc94e578ecec5e33c0883f01c57063

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
http://109.120.178.28
Referer
http://109.120.178.28/assets/index-Gnhp7EuE.css

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5523908-203040-2444372182"
expires
Fri, 20 Sep 2024 12:44:20 GMT
content-length
203040
date
Fri, 20 Sep 2024 00:44:20 GMT
content-type
application/octet-stream
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
truncated
/
427 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07edeed6ed7da0840259a022a18ec9acea9caba40b3bec343c00fec1e728f393

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/

Response headers

Content-Type
image/png
truncated
/
440 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7eba47f92ddc5d9a1ec95b1687f4e03e52dffab6666daa19c2633286450fc20

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/

Response headers

Content-Type
image/png
ds-greece-eWgboWnd.ttf
109.120.178.28/assets/
54 KB
55 KB
Font
General
Full URL
http://109.120.178.28/assets/ds-greece-eWgboWnd.ttf
Requested by
Host: 109.120.178.28
URL: http://109.120.178.28/assets/index-Gnhp7EuE.css
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
0695b533e71e5bfb83a90e99545c83c2019395dc21b22846a485b7ec878371bd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
http://109.120.178.28
Referer
http://109.120.178.28/assets/index-Gnhp7EuE.css

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5523908-55740-3831570994"
expires
Fri, 20 Sep 2024 12:44:20 GMT
content-length
55740
date
Fri, 20 Sep 2024 00:44:20 GMT
content-type
application/octet-stream
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11
logo-ovWOqCdT.svg
109.120.178.28/assets/
32 KB
33 KB
Other
General
Full URL
http://109.120.178.28/assets/logo-ovWOqCdT.svg
Protocol
HTTP/1.1
Server
109.120.178.28 Paris, France, ASN210644 (AEZA-AS, GB),
Reverse DNS
lumpy-jewel.aeza.network
Software
hypercorn-h11 /
Resource Hash
5c8b3ffa823046dcd23e2336195218e3ddf2823c1fe2252c4e5fa618413f5b84

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://109.120.178.28/auth/login

Response headers

cache-control
public, max-age=43200
etag
"1721064124.5523908-33277-1050091600"
expires
Fri, 20 Sep 2024 12:44:20 GMT
content-length
33277
date
Fri, 20 Sep 2024 00:44:20 GMT
content-type
image/svg+xml; charset=utf-8
last-modified
Mon, 15 Jul 2024 17:22:04 GMT
server
hypercorn-h11

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _global object| global function| Buffer object| libsodium

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: http://109.120.178.28/auth/login
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o