www.malware-traffic-analysis.net Open in urlscan Pro
199.201.110.204 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.malware-traffic-analysis.net/2017/04/21/index3.html
Effective URL:
https://www.malware-traffic-analysis.net/2017/04/21/index3.html
Submission: On January 09 via api (January 9th 2021, 9:52:04 am UTC) from US

Summary HTTP 8 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 199.201.110.204, located in Phoenix, United States and belongs to SSASN2, US. The main domain is www.malware-traffic-analysis.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 10th 2020. Valid for: a year.

This is the only time www.malware-traffic-analysis.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 9	199.201.110.204 199.201.110.204		20454 (SSASN2) (SSASN2)
8	1

9 199.201.110.204 (Phoenix, United States) 1 redirects

ASN20454 (SSASN2, US)
PTR: nc-ph-1926-75.web-hosting.com

www.malware-traffic-analysis.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	malware-traffic-analysis.net 1 redirects www.malware-traffic-analysis.net	1 MB
8	1

	Domain	Requested by
9	www.malware-traffic-analysis.net	1 redirects www.malware-traffic-analysis.net
8	1

This site contains links to these domains. Also see Links.

Domain
myonlinesecurity.co.uk
www.bleepingcomputer.com

Subject Issuer	Validity	Valid
malware-traffic-analysis.net Sectigo RSA Domain Validation Secure Server CA	`2020-10-10` - `2021-11-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.malware-traffic-analysis.net/2017/04/21/index3.html
Frame ID: 0AF9AE20EC1ECE86F6EAA0327BF254AD
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.malware-traffic-analysis.net/2017/04/21/index3.html HTTP 301
https://www.malware-traffic-analysis.net/2017/04/21/index3.html Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1378 kB
Transfer

1380 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://myonlinesecurity.co.uk/the-return-of-locky-ransomware-with-fake-receipts-malspam/
Title: The return of Locky ransomware with fake receipts malspam

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/the-locky-ransomware-is-back-and-still-adding-osiris-to-encrypted-files/
Title: The Locky Ransomware is Back and Still Adding OSIRIS to Encrypted Files

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.malware-traffic-analysis.net/2017/04/21/index3.html HTTP 301
https://www.malware-traffic-analysis.net/2017/04/21/index3.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index3.html Show response www.malware-traffic-analysis.net/2017/04/21/ Redirect Chain http://www.malware-traffic-analysis.net/2017/04/21/index3.html https://www.malware-traffic-analysis.net/2017/04/21/index3.html	5 KB 2 KB	442ms 145ms	Document text/html	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Full URL https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `1dd37f0436881a81d5a1adb2ecdbeb854b7d510d4fcabfa4ffbd3cd2c7e1b7b4` Request headers Host www.malware-traffic-analysis.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Server Apache/2.4.41 (Ubuntu) Last-Modified Sat, 22 Apr 2017 20:48:41 GMT ETag "1504-54dc77fc4fc40-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 2155 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html Redirect headers Date Sat, 09 Jan 2021 09:51:44 GMT Server Apache/2.4.41 (Ubuntu) Location https://www.malware-traffic-analysis.net/2017/04/21/index3.html Content-Length 369 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	style.css www.malware-traffic-analysis.net/	2 KB 908 B	146ms 144ms	Stylesheet text/css	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Full URL https://www.malware-traffic-analysis.net/style.css Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Content-Encoding gzip Last-Modified Sun, 31 Dec 2017 02:01:06 GMT Server Apache/2.4.41 (Ubuntu) ETag "7d9-561993d117c80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 573
GET H/1.1	200 OK	site-logo-01.gif www.malware-traffic-analysis.net/	13 KB 14 KB	292ms 144ms	Image image/gif	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/site-logo-01.gif Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Last-Modified Mon, 08 Aug 2016 00:35:11 GMT Server Apache/2.4.41 (Ubuntu) ETag "359b-5398496bd2dc0" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 13723
GET H/1.1	200 OK	2017-04-21-locky-malspam-image-01.jpg www.malware-traffic-analysis.net/2017/04/21/	55 KB 55 KB	442ms 144ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-locky-malspam-image-01.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `341efbd1c8047b917eebc4452d626833dbbd8f765d1f123069f01ce7a9c262d6` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Last-Modified Sat, 22 Apr 2017 20:40:50 GMT Server Apache/2.4.41 (Ubuntu) ETag "dcb4-54dc763b21880" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 56500
GET H/1.1	200 OK	2017-04-21-locky-malspam-image-02.jpg www.malware-traffic-analysis.net/2017/04/21/	123 KB 123 KB	444ms 145ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-locky-malspam-image-02.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `3c19af4306d6086542b44f38e75bbc8e678385d07db8ba42d76779a6a9656532` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Last-Modified Sat, 22 Apr 2017 20:40:50 GMT Server Apache/2.4.41 (Ubuntu) ETag "1eb4c-54dc763b21880" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 125772
GET H/1.1	200 OK	2017-04-21-locky-malspam-image-03.jpg www.malware-traffic-analysis.net/2017/04/21/	357 KB 357 KB	445ms 147ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-locky-malspam-image-03.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `2c1cea1f9c582d31f09b2a082b34a40bb9bbf00fd92b3f0a8913324edcc5c781` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Last-Modified Sat, 22 Apr 2017 20:40:51 GMT Server Apache/2.4.41 (Ubuntu) ETag "592dc-54dc763c15ac0" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 365276
GET H/1.1	200 OK	2017-04-21-locky-malspam-image-04.jpg www.malware-traffic-analysis.net/2017/04/21/	484 KB 484 KB	445ms 146ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-locky-malspam-image-04.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `4e661c2057dbe9ab40e215ca18e178056e540c0b2c2316b183afe16041e2e16e` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Last-Modified Sat, 22 Apr 2017 20:40:52 GMT Server Apache/2.4.41 (Ubuntu) ETag "78f43-54dc763d09d00" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 495427
GET H/1.1	200 OK	2017-04-21-locky-malspam-image-05.jpg www.malware-traffic-analysis.net/2017/04/21/	341 KB 341 KB	314ms 152ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/21/2017-04-21-locky-malspam-image-05.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/21/index3.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `44827363d720d9047439976c167b58896f9b1a7f2beb984ebb9ce67c1271bf8c` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/21/index3.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 09:51:45 GMT Last-Modified Sat, 22 Apr 2017 20:40:52 GMT Server Apache/2.4.41 (Ubuntu) ETag "552d8-54dc763d09d00" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 348888

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.malware-traffic-analysis.net
199.201.110.204
1dd37f0436881a81d5a1adb2ecdbeb854b7d510d4fcabfa4ffbd3cd2c7e1b7b4
2c1cea1f9c582d31f09b2a082b34a40bb9bbf00fd92b3f0a8913324edcc5c781
2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade
341efbd1c8047b917eebc4452d626833dbbd8f765d1f123069f01ce7a9c262d6
3c19af4306d6086542b44f38e75bbc8e678385d07db8ba42d76779a6a9656532
44827363d720d9047439976c167b58896f9b1a7f2beb984ebb9ce67c1271bf8c
45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2
4e661c2057dbe9ab40e215ca18e178056e540c0b2c2316b183afe16041e2e16e

www.malware-traffic-analysis.net Open in urlscan Pro 199.201.110.204 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

1378 kBTransfer

1380 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

0 Cookies

Indicators

www.malware-traffic-analysis.net Open in urlscan Pro
199.201.110.204 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1378 kB
Transfer

1380 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions