urlscan.io logo urlscan.io
SecurityTrails logo

46.30.41.6 Open in urlscan Pro
46.30.41.6  Public Scan

Go To Rescan Add Verdict Report
URL: http://46.30.41.6/anubis/login.php
Submission Tags: c2 malware anubis Search All
Submission: On September 13 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 2 domains to perform 5 HTTP transactions. The main IP is 46.30.41.6, located in Amsterdam, Netherlands and belongs to EUROBYTE Eurobyte LLC, RU. The main domain is 46.30.41.6.
This is the only time 46.30.41.6 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 46.30.41.6 210079 (EUROBYTE ...)
1 3 185.116.245.25 42263 (GERMANEDG...)
1 2 66.155.40.160 13768 (COGECO-PEER1)
5 3
Apex Domain
Subdomains		 Transfer
3 weloveiconfonts.com
weloveiconfonts.com — Cisco Umbrella Rank: 372542
32 KB
2 meyerweb.com
meyerweb.com — Cisco Umbrella Rank: 501214
957 B
5 2
Domain Requested by
3 weloveiconfonts.com 1 redirects 46.30.41.6
weloveiconfonts.com
2 meyerweb.com 1 redirects 46.30.41.6
5 2

This site contains no links.

Subject Issuer Validity Valid
weloveiconfonts.com
R3		 2022-07-28 -
2022-10-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://46.30.41.6/anubis/login.php
Frame ID: 569C4C9A328508A60D66E55B2621236A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

5
Requests

20 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

3
Countries

36 kB
Transfer

45 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://weloveiconfonts.com/api/?family=fontawesome HTTP 302
  • https://weloveiconfonts.com/api/?family=fontawesome
Request Chain 2
  • http://meyerweb.com/eric/tools/css/reset/reset.css HTTP 302
  • https://meyerweb.com/eric/tools/css/reset/reset.css

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
46.30.41.6/anubis/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://46.30.41.6/anubis/login.php
Protocol
HTTP/1.1
Server
46.30.41.6 Amsterdam, Netherlands, ASN210079 (EUROBYTE Eurobyte LLC, RU),
Reverse DNS
vm534415.eurodir.ru
Software
nginx/1.22.0 / PHP/5.6.40
Resource Hash
b9993f1f9fe4a56d7fa08df32c98f745323efa7b3b1724ef4289823d8bc8ad2c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 13 Sep 2022 02:05:57 GMT
Server
nginx/1.22.0
Transfer-Encoding
chunked
X-Powered-By
PHP/5.6.40
login.css
46.30.41.6/anubis/styles/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://46.30.41.6/anubis/styles/login.css
Requested by
Host: 46.30.41.6
URL: http://46.30.41.6/anubis/login.php
Protocol
HTTP/1.1
Server
46.30.41.6 Amsterdam, Netherlands, ASN210079 (EUROBYTE Eurobyte LLC, RU),
Reverse DNS
vm534415.eurodir.ru
Software
nginx/1.22.0 /
Resource Hash
6a8433d53b84ade495e2f8de0ce9c75b4172c2495bdd767110e033bb2d40d5b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://46.30.41.6/anubis/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 02:05:58 GMT
Last-Modified
Mon, 28 Aug 2017 19:21:38 GMT
Server
nginx/1.22.0
ETag
"59a46d42-a20"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2592
/
weloveiconfonts.com/api/
Redirect Chain
  • http://weloveiconfonts.com/api/?family=fontawesome
  • https://weloveiconfonts.com/api/?family=fontawesome
12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://weloveiconfonts.com/api/?family=fontawesome
Requested by
Host: 46.30.41.6
URL: http://46.30.41.6/anubis/styles/login.css
Protocol
H2
Server
185.116.245.25 , Germany, ASN42263 (GERMANEDGECLOUD, DE),
Reverse DNS
Software
/ PHP/7.2.18
Resource Hash
218bbefc083add1bdbb990a49978d75a564e07b562605f9fed281fe56ddc650e
Security Headers
Name Value
Content-Security-Policy script-src: https://themes.googleusercontent.com
Strict-Transport-Security max-age=15768000
X-Content-Type-Options : nosniff
X-Frame-Options : DENY
X-Xss-Protection : 1;mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://46.30.41.6/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 02:04:44 GMT
content-encoding
gzip
x-content-type-options
: nosniff
age
73
x-powered-by
PHP/7.2.18
x-cache
HIT
grace
none
vary
Accept-Encoding
content-length
2171
x-xss-protection
: 1;mode=block
referrer-policy
no-referrer-when-downgrade
x-frame-options
: DENY
strict-transport-security
max-age=15768000
content-type
text/css;charset=UTF-8
access-control-allow-origin
*
content-security-policy
script-src: https://themes.googleusercontent.com
accept-ranges
bytes

Redirect headers

Location
https://weloveiconfonts.com/api/?family=fontawesome
Cache-Control
no-cache
Content-length
0
reset.css
meyerweb.com/eric/tools/css/reset/
Redirect Chain
  • http://meyerweb.com/eric/tools/css/reset/reset.css
  • https://meyerweb.com/eric/tools/css/reset/reset.css
1 KB
697 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://meyerweb.com/eric/tools/css/reset/reset.css
Requested by
Host: 46.30.41.6
URL: http://46.30.41.6/anubis/styles/login.css
Protocol
H2
Server
66.155.40.160 Los Angeles, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
meyerweb.com
Software
Apache /
Resource Hash
ed555a279183c054222c873e78d92c40b512498e49359b6abfda36048f141988

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://46.30.41.6/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 02:05:58 GMT
content-encoding
br
last-modified
Wed, 26 Jan 2011 17:44:26 GMT
server
Apache
etag
"63fc1626-444-49ac36256d280-br"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=604800, public, must-revalidate
accept-ranges
bytes
content-length
526

Redirect headers

Location
https://meyerweb.com/eric/tools/css/reset/reset.css
Date
Tue, 13 Sep 2022 02:05:57 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=2, max=100
Content-Length
235
Content-Type
text/html; charset=iso-8859-1
fontawesome-webfont.woff
weloveiconfonts.com/api/fonts/fontawesome/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://weloveiconfonts.com/api/fonts/fontawesome/fontawesome-webfont.woff
Requested by
Host: weloveiconfonts.com
URL: https://weloveiconfonts.com/api/?family=fontawesome
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.116.245.25 , Germany, ASN42263 (GERMANEDGECLOUD, DE),
Reverse DNS
Software
/
Resource Hash
a6fb906942932de53852ee244ee3fec27bca0bf63a96421672aa4784851b8d4b
Security Headers
Name Value
Content-Security-Policy script-src: https://themes.googleusercontent.com
Strict-Transport-Security max-age=15768000
X-Content-Type-Options : nosniff
X-Frame-Options : DENY
X-Xss-Protection : 1;mode=block

Request headers

Referer
https://weloveiconfonts.com/api/?family=fontawesome
Origin
http://46.30.41.6
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 02:04:26 GMT
x-content-type-options
: nosniff
age
92
grace
none
x-cache
HIT
content-length
29380
x-xss-protection
: 1;mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 18 May 2019 12:35:06 GMT
x-frame-options
: DENY
etag
"5cdffbfa-72c4"
strict-transport-security
max-age=15768000
content-type
font/woff
access-control-allow-origin
*
content-security-policy
script-src: https://themes.googleusercontent.com
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

0 Cookies