malware-traffic-analysis.net Open in urlscan Pro
166.78.135.34 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://malware-traffic-analysis.net/2018/05/29/index.html
Submission: On October 23 via api (October 23rd 2019, 7:47:04 pm UTC) from US

Summary HTTP 8 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 166.78.135.34, located in San Antonio, United States and belongs to RMH-14 - Rackspace Hosting, US. The main domain is malware-traffic-analysis.net.

This is the only time malware-traffic-analysis.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
8	166.78.135.34 166.78.135.34		33070 (RMH-14) (RMH-14 - Rackspace Hosting)
8	1

8 166.78.135.34 (San Antonio, United States)

ASN33070 (RMH-14 - Rackspace Hosting, US)
PTR: www.malware-traffic-analysis.net

malware-traffic-analysis.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	malware-traffic-analysis.net malware-traffic-analysis.net	1 MB
8	1

	Domain	Requested by
8	malware-traffic-analysis.net	malware-traffic-analysis.net
8	1

This site contains links to these domains. Also see Links.

Domain
www.virustotal.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://malware-traffic-analysis.net/2018/05/29/index.html
Frame ID: 18832B05307D91869B8DE14F8EA63EFE
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1513 kB
Transfer

1511 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.virustotal.com/#/file/7521284ee6f9b45f5efe44cf7c449a3ed6fc86d71018fc071cd5c93f98bbafb8/detection
Title: 7521284ee6f9b45f5efe44cf7c449a3ed6fc86d71018fc071cd5c93f98bbafb8

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/cca8206696979428e9f4fec0153e2623a95a7ff206f6c68ce262a1dc59d0579c/detection
Title: cca8206696979428e9f4fec0153e2623a95a7ff206f6c68ce262a1dc59d0579c

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/a8d9739b395df4ceaf14bb51c962368008bd24d00cf98456fdbcd7f58e959a5e/detection
Title: a8d9739b395df4ceaf14bb51c962368008bd24d00cf98456fdbcd7f58e959a5e

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response malware-traffic-analysis.net/2018/05/29/	11 KB 11 KB	431ms 115ms	Document text/html	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Full URL http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `9df142935ae08b1dd31a41127967ccd0ea9afa7e82fd9e9e30a543c1bc54b460` Request headers Host malware-traffic-analysis.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:46 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips Last-Modified Tue, 29 May 2018 10:51:03 GMT ETag "2bbf-56d5602b96c66" Accept-Ranges bytes Content-Length 11199 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style.css malware-traffic-analysis.net/	2 KB 2 KB	115ms 115ms	Stylesheet text/css	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Full URL http://malware-traffic-analysis.net/style.css Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:46 GMT Last-Modified Sun, 31 Dec 2017 02:01:06 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "7d9-561993d17c116" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2009
GET H/1.1	200 OK	site-logo-01.gif malware-traffic-analysis.net/	13 KB 14 KB	115ms 115ms	Image image/gif	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Show image Full URL http://malware-traffic-analysis.net/site-logo-01.gif Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:46 GMT Last-Modified Mon, 08 Aug 2016 00:35:11 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "359b-5398496c9700a" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 13723
GET H/1.1	200 OK	2018-05-29-DHL-themed-malspam-image-01.jpg malware-traffic-analysis.net/2018/05/29/	322 KB 322 KB	267ms 152ms	Image image/jpeg	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Show image Full URL http://malware-traffic-analysis.net/2018/05/29/2018-05-29-DHL-themed-malspam-image-01.jpg Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `1a32a4faa6025b7a919039826fe269c7cc22eacf8eb0b4d17f9a72bf97050ce4` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:47 GMT Last-Modified Tue, 29 May 2018 10:50:47 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "5069a-56d5601ba969d" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 329370
GET H/1.1	200 OK	2018-05-29-DHL-themed-malspam-image-02.jpg malware-traffic-analysis.net/2018/05/29/	353 KB 353 KB	267ms 151ms	Image image/jpeg	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Show image Full URL http://malware-traffic-analysis.net/2018/05/29/2018-05-29-DHL-themed-malspam-image-02.jpg Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `7468b6897961ec882bbf12de775d0da6d885f31925e14044fb01156e8588bab8` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:47 GMT Last-Modified Tue, 29 May 2018 10:50:48 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "5821a-56d5601ca03ce" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 360986
GET H/1.1	200 OK	2018-05-29-DHL-themed-malspam-image-03.jpg malware-traffic-analysis.net/2018/05/29/	126 KB 126 KB	243ms 128ms	Image image/jpeg	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Show image Full URL http://malware-traffic-analysis.net/2018/05/29/2018-05-29-DHL-themed-malspam-image-03.jpg Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `a276df6066591ba26cacc5bc05f1003aa6631a34ca6c85da48f09f425752bda6` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:47 GMT Last-Modified Tue, 29 May 2018 10:50:49 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "1f634-56d5601e1e122" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 128564
GET H/1.1	200 OK	2018-05-29-DHL-themed-malspam-image-04.jpg malware-traffic-analysis.net/2018/05/29/	298 KB 298 KB	567ms 451ms	Image image/jpeg	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Show image Full URL http://malware-traffic-analysis.net/2018/05/29/2018-05-29-DHL-themed-malspam-image-04.jpg Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `d2c88ef8dbc8aadde74fb6a5a3f6e3852e2f41c09e92e8cf228a49baca79936a` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:47 GMT Last-Modified Tue, 29 May 2018 10:50:51 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "4a606-56d5601fa666d" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 304646
GET H/1.1	200 OK	2018-05-29-DHL-themed-malspam-image-05.jpg malware-traffic-analysis.net/2018/05/29/	387 KB 387 KB	151ms 151ms	Image image/jpeg	166.78.135.34 Rackspace Hosting
General Check archive.org Show headers Download Go to Show image Full URL http://malware-traffic-analysis.net/2018/05/29/2018-05-29-DHL-themed-malspam-image-05.jpg Requested by Host: malware-traffic-analysis.net URL: http://malware-traffic-analysis.net/2018/05/29/index.html Protocol HTTP/1.1 Server 166.78.135.34 San Antonio, United States, ASN33070 (RMH-14 - Rackspace Hosting, US), Reverse DNS www.malware-traffic-analysis.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips / Resource Hash `ebbdb54734d20901e28ae2ee6e89f9038587efb87022d1effb3676cc76d9ae0a` Request headers Referer http://malware-traffic-analysis.net/2018/05/29/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 23 Oct 2019 19:46:47 GMT Last-Modified Tue, 29 May 2018 10:50:53 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips ETag "60c08-56d5602173947" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 396296

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

malware-traffic-analysis.net
166.78.135.34
1a32a4faa6025b7a919039826fe269c7cc22eacf8eb0b4d17f9a72bf97050ce4
2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade
45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2
7468b6897961ec882bbf12de775d0da6d885f31925e14044fb01156e8588bab8
9df142935ae08b1dd31a41127967ccd0ea9afa7e82fd9e9e30a543c1bc54b460
a276df6066591ba26cacc5bc05f1003aa6631a34ca6c85da48f09f425752bda6
d2c88ef8dbc8aadde74fb6a5a3f6e3852e2f41c09e92e8cf228a49baca79936a
ebbdb54734d20901e28ae2ee6e89f9038587efb87022d1effb3676cc76d9ae0a

malware-traffic-analysis.net Open in urlscan Pro 166.78.135.34 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

1513 kBTransfer

1511 kBSize

0 Cookies

3 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

0 Cookies

Indicators

malware-traffic-analysis.net Open in urlscan Pro
166.78.135.34 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1513 kB
Transfer

1511 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions