URL: http://185.161.248.199/auth/login
Submission Tags: c2 malware meduza Search All
Submission: On March 20 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 0 domains to perform 8 HTTP transactions. The main IP is 185.161.248.199, located in Russian Federation and belongs to KISARA-AS, RU. The main domain is 185.161.248.199.
This is the only time 185.161.248.199 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 185.161.248.199 49202 (KISARA-AS)
8 2
Apex Domain
Subdomains
Transfer
8 0
Domain Requested by
8 0

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://185.161.248.199/auth/login
Frame ID: 4B1348703A14E5C8D467905ED3E90820
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Meduza Stealer

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

3381 kB
Transfer

3381 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
185.161.248.199/auth/
553 B
858 B
Document
General
Full URL
http://185.161.248.199/auth/login
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
eb7361197541120d5986efda91c67373e54f9b51d50445a88c21b06d00b34f19

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=43200
content-length
553
content-type
text/html; charset=utf-8
date
Wed, 20 Mar 2024 01:51:09 GMT
etag
"1708733785.4983406-553-2801341008"
expires
Wed, 20 Mar 2024 13:51:09 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
index-zA6Sahgt.js
185.161.248.199/assets/
2 MB
2 MB
Script
General
Full URL
http://185.161.248.199/assets/index-zA6Sahgt.js
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/auth/login
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
adf836c487abf9befc132d9fc34bb4baedeb2a0cf00ba6a7ffe89e8c834591d6

Request headers

Referer
http://185.161.248.199/auth/login
Origin
http://185.161.248.199
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:09 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.5003407-2430377-3488880508"
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=43200
content-length
2430377
expires
Wed, 20 Mar 2024 13:51:09 GMT
index-meiT9fTn.css
185.161.248.199/assets/
50 KB
50 KB
Stylesheet
General
Full URL
http://185.161.248.199/assets/index-meiT9fTn.css
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/auth/login
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
3f33ce786607e0d5b5e1cff42c9947d8a094971b42842dc9cae2daf2750ee45e

Request headers

Referer
http://185.161.248.199/auth/login
Origin
http://185.161.248.199
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:09 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.4993403-50830-3907459056"
content-type
text/css; charset=utf-8
cache-control
public, max-age=43200
content-length
50830
expires
Wed, 20 Mar 2024 13:51:09 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24599a8c6b67b31fcd42e5e68c7e158065aa192b6678c0881ac651e51c7385c6

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://185.161.248.199/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/png
snake-lPgznXqp.png
185.161.248.199/assets/
114 KB
115 KB
Image
General
Full URL
http://185.161.248.199/assets/snake-lPgznXqp.png
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/assets/index-meiT9fTn.css
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
86a203c0bec9406ec46d264ecd99a2283c4ced726cccf548b64378784626f944

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://185.161.248.199/assets/index-meiT9fTn.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:10 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.4933393-117220-3944290362"
content-type
image/png
cache-control
public, max-age=43200
content-length
117220
expires
Wed, 20 Mar 2024 13:51:10 GMT
Meduza-Xf1ectds.png
185.161.248.199/assets/
569 KB
570 KB
Image
General
Full URL
http://185.161.248.199/assets/Meduza-Xf1ectds.png
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/assets/index-meiT9fTn.css
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
ca6bbc108872be8f8954aa0aff4e488a62ddc97ac1675ca6ec2ef460f3a256de

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://185.161.248.199/assets/index-meiT9fTn.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:10 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.4993403-582902-4289534028"
content-type
image/png
cache-control
public, max-age=43200
content-length
582902
expires
Wed, 20 Mar 2024 13:51:10 GMT
profile-bXjbzb05.png
185.161.248.199/assets/
18 KB
18 KB
Image
General
Full URL
http://185.161.248.199/assets/profile-bXjbzb05.png
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/assets/index-meiT9fTn.css
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
4ffe10c03698b7a8c507479d78e19578610b418c76367f44c19adcb7e204a573

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://185.161.248.199/assets/index-meiT9fTn.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:10 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.4933393-18573-465836188"
content-type
image/png
cache-control
public, max-age=43200
content-length
18573
expires
Wed, 20 Mar 2024 13:51:10 GMT
Comfortaa-VariableFont_wght-R_5AX4pn.ttf
185.161.248.199/assets/
198 KB
199 KB
Font
General
Full URL
http://185.161.248.199/assets/Comfortaa-VariableFont_wght-R_5AX4pn.ttf
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/assets/index-meiT9fTn.css
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
b9281be276c9f683947bb52f44f30d27dccc94e578ecec5e33c0883f01c57063

Request headers

Referer
http://185.161.248.199/assets/index-meiT9fTn.css
Origin
http://185.161.248.199
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:10 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.4933393-203040-1538269213"
content-type
application/octet-stream
cache-control
public, max-age=43200
content-length
203040
expires
Wed, 20 Mar 2024 13:51:10 GMT
truncated
/
427 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07edeed6ed7da0840259a022a18ec9acea9caba40b3bec343c00fec1e728f393

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://185.161.248.199/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
440 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7eba47f92ddc5d9a1ec95b1687f4e03e52dffab6666daa19c2633286450fc20

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://185.161.248.199/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/png
ds-greece-eWgboWnd.ttf
185.161.248.199/assets/
54 KB
55 KB
Font
General
Full URL
http://185.161.248.199/assets/ds-greece-eWgboWnd.ttf
Requested by
Host: 185.161.248.199
URL: http://185.161.248.199/assets/index-meiT9fTn.css
Protocol
HTTP/1.1
Server
185.161.248.199 , Russian Federation, ASN49202 (KISARA-AS, RU),
Reverse DNS
Software
hypercorn-h11 /
Resource Hash
0695b533e71e5bfb83a90e99545c83c2019395dc21b22846a485b7ec878371bd

Request headers

Referer
http://185.161.248.199/assets/index-meiT9fTn.css
Origin
http://185.161.248.199
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 20 Mar 2024 01:51:10 GMT
last-modified
Sat, 24 Feb 2024 00:16:25 GMT
server
hypercorn-h11
etag
"1708733785.4933393-55740-1265637753"
content-type
application/octet-stream
cache-control
public, max-age=43200
content-length
55740
expires
Wed, 20 Mar 2024 13:51:10 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _global object| global function| Buffer object| libsodium

0 Cookies