www.malware-traffic-analysis.net Open in urlscan Pro
199.201.110.204 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://malware-traffic-analysis.net/2017/04/21/index2.html
Effective URL:
https://www.malware-traffic-analysis.net/2017/04/21/index2.html
Submission: On January 09 via api (January 9th 2021, 9:49:12 am UTC) from US

Summary HTTP 8 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 199.201.110.204, located in Phoenix, United States and belongs to SSASN2, US. The main domain is www.malware-traffic-analysis.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 10th 2020. Valid for: a year.

This is the only time www.malware-traffic-analysis.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 9	199.201.110.204 199.201.110.204		20454 (SSASN2) (SSASN2)
8	1

9 199.201.110.204 (Phoenix, United States) 1 redirects

ASN20454 (SSASN2, US)
PTR: nc-ph-1926-75.web-hosting.com

malware-traffic-analysis.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.malware-traffic-analysis.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	malware-traffic-analysis.net 1 redirects malware-traffic-analysis.net www.malware-traffic-analysis.net	1 MB
8	1

	Domain	Requested by
8	www.malware-traffic-analysis.net	www.malware-traffic-analysis.net
1	malware-traffic-analysis.net	1 redirects
8	2

This site contains links to these domains. Also see Links.

Domain
isc.sans.edu
www.bleepingcomputer.com
myonlinesecurity.co.uk
www.reverse.it

Subject Issuer	Validity	Valid
malware-traffic-analysis.net Sectigo RSA Domain Validation Secure Server CA	`2020-10-10` - `2021-11-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.malware-traffic-analysis.net/2017/04/21/index2.html
Frame ID: 60B307E2D5E7B436519D141F8B5ABC5A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://malware-traffic-analysis.net/2017/04/21/index2.html HTTP 301
https://www.malware-traffic-analysis.net/2017/04/21/index2.html Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

1387 kB
Transfer

1392 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://isc.sans.edu/forums/diary/Malspam+on+20170411+pushes+yet+another+ransomware+variant/22290/
Title: Malspam on 2017-04-11 pushes yet another ransomware variant

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/mole-ransomware-distributed-through-fake-online-word-docs/
Title: Mole Ransomware Distributed Through Fake online Word Docs

Search URL Search Domain Scan URL

URL: https://myonlinesecurity.co.uk/more-usps-delivery-messages-delivering-mole-ransomware/
Title: More USPS delivery messages delivering mole ransomware

Search URL Search Domain Scan URL

URL: https://myonlinesecurity.co.uk/changes-to-fake-usps-delivery-messages-delivering-malware/
Title: Changes to fake USPS delivery messages delivering malware

Search URL Search Domain Scan URL

URL: https://www.reverse.it/sample/20e6c812f7d8688c9ccb24cc4e9c0fa2b71f1770f38b5571a60043043d4b4ac5?environmentId=100
Title: https://www.reverse.it/sample/20e6c812f7d8688c9ccb24cc4e9c0fa2b71f1770f38b5571a60043043d4b4ac5?environmentId=100

Search URL Search Domain Scan URL

URL: https://www.reverse.it/sample/6ad0e26e0423838df19f00e178e47a1b65395b2b68055ecb07a99613208cc684?environmentId=100%3C
Title: https://www.reverse.it/sample/6ad0e26e0423838df19f00e178e47a1b65395b2b68055ecb07a99613208cc684?environmentId=100

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://malware-traffic-analysis.net/2017/04/21/index2.html HTTP 301
https://www.malware-traffic-analysis.net/2017/04/21/index2.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index2.html Show response www.malware-traffic-analysis.net/2017/04/21/ Redirect Chain http://malware-traffic-analysis.net/2017/04/21/index2.html https://www.malware-traffic-analysis.net/2017/04/21/index2.html	9 KB 3 KB	504ms 168ms	Document text/html	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Full URL https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `0e0b0b46d86609917f81c0b4d39cab16bd01caa47ccced8b15f989632a6d01cf` Request headers Host www.malware-traffic-analysis.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:42 GMT Server Apache/2.4.41 (Ubuntu) Last-Modified Fri, 21 Apr 2017 22:38:44 GMT ETag "22d1-54db4eb7f6500-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 2946 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html Redirect headers Date Sat, 09 Jan 2021 09:48:42 GMT Server Apache/2.4.41 (Ubuntu) Location https://www.malware-traffic-analysis.net/2017/04/21/index2.html Content-Length 365 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	style.css www.malware-traffic-analysis.net/	2 KB 908 B	167ms 167ms	Stylesheet text/css	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Full URL https://www.malware-traffic-analysis.net/style.css Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Content-Encoding gzip Last-Modified Sun, 31 Dec 2017 02:01:06 GMT Server Apache/2.4.41 (Ubuntu) ETag "7d9-561993d117c80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 573
GET H/1.1	200 OK	site-logo-01.gif www.malware-traffic-analysis.net/	13 KB 14 KB	334ms 166ms	Image image/gif	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/site-logo-01.gif Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Last-Modified Mon, 08 Aug 2016 00:35:11 GMT Server Apache/2.4.41 (Ubuntu) ETag "359b-5398496bd2dc0" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 13723
GET H/1.1	200 OK	2017-04-21-parking-service-malspam-image-00.jpg www.malware-traffic-analysis.net/2017/04/21/	219 KB 220 KB	494ms 163ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-parking-service-malspam-image-00.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `30ab862271fcad942a3463be8f77048dd27103709e5b42fcdd6bfb8247d62391` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Last-Modified Fri, 21 Apr 2017 22:33:09 GMT Server Apache/2.4.41 (Ubuntu) ETag "36cdf-54db4d787b340" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 224479
GET H/1.1	200 OK	2017-04-21-parking-service-malspam-image-01.jpg www.malware-traffic-analysis.net/2017/04/21/	278 KB 279 KB	503ms 169ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-parking-service-malspam-image-01.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `09c67102758f06cce74d9fbff93a926c1745a5389c958b2136b41787bdd27f5f` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Last-Modified Fri, 21 Apr 2017 22:33:14 GMT Server Apache/2.4.41 (Ubuntu) ETag "45967-54db4d7d3fe80" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 285031
GET H/1.1	200 OK	2017-04-21-parking-service-malspam-image-02.jpg www.malware-traffic-analysis.net/2017/04/21/	283 KB 283 KB	507ms 168ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-parking-service-malspam-image-02.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `ad5b928e37a650fd49af9d7ae6b032d2414f90149b6bb6dbcbfe50ba6d737726` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Last-Modified Fri, 21 Apr 2017 22:33:18 GMT Server Apache/2.4.41 (Ubuntu) ETag "46b8f-54db4d8110780" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 289679
GET H/1.1	200 OK	2017-04-21-parking-service-malspam-image-03.jpg www.malware-traffic-analysis.net/2017/04/21/	77 KB 77 KB	505ms 166ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-parking-service-malspam-image-03.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `acf695de5b54586c9468b0264db0403a05b088d69d572a040754274542885596` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Last-Modified Fri, 21 Apr 2017 22:33:19 GMT Server Apache/2.4.41 (Ubuntu) ETag "134cd-54db4d82049c0" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 79053
GET H/1.1	200 OK	2017-04-21-parking-service-malspam-image-04.jpg www.malware-traffic-analysis.net/2017/04/21/	510 KB 511 KB	342ms 168ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-parking-service-malspam-image-04.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `b92ba47a92ab970e09e6ebb92adfb141b26e3f0d1e0d8db6dcd156169b2740a6` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:48:43 GMT Last-Modified Fri, 21 Apr 2017 22:33:23 GMT Server Apache/2.4.41 (Ubuntu) ETag "7f973-54db4d85d52c0" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 522611

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

malware-traffic-analysis.net
www.malware-traffic-analysis.net
199.201.110.204
09c67102758f06cce74d9fbff93a926c1745a5389c958b2136b41787bdd27f5f
0e0b0b46d86609917f81c0b4d39cab16bd01caa47ccced8b15f989632a6d01cf
2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade
30ab862271fcad942a3463be8f77048dd27103709e5b42fcdd6bfb8247d62391
45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2
acf695de5b54586c9468b0264db0403a05b088d69d572a040754274542885596
ad5b928e37a650fd49af9d7ae6b032d2414f90149b6bb6dbcbfe50ba6d737726
b92ba47a92ab970e09e6ebb92adfb141b26e3f0d1e0d8db6dcd156169b2740a6

www.malware-traffic-analysis.net Open in urlscan Pro 199.201.110.204 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

1 IPs

1 Countries

1387 kBTransfer

1392 kBSize

0 Cookies

6 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

0 Cookies

Indicators

www.malware-traffic-analysis.net Open in urlscan Pro
199.201.110.204 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

1387 kB
Transfer

1392 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions