malware.news
Open in
urlscan Pro
2606:4700:20::681a:769
Public Scan
Submission: On November 22 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 15th 2021. Valid for: a year.
This is the only time malware.news was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
31 | 2606:4700:20:... 2606:4700:20::681a:769 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:831::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:721 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
35 | 4 |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
31 |
malware.news
malware.news |
1 MB |
2 |
google-analytics.com
www.google-analytics.com |
20 KB |
1 |
therecord.media
therecord.media |
126 KB |
0 |
recfut.com
Failed
www-therecord.recfut.com Failed |
|
35 | 4 |
Domain | Requested by | |
---|---|---|
31 | malware.news |
malware.news
|
2 | www.google-analytics.com |
malware.news
www.google-analytics.com |
1 | therecord.media |
malware.news
|
0 | www-therecord.recfut.com Failed |
malware.news
|
35 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
therecord.media |
apt.thaicert.or.th |
about.fb.com |
labs.k7computing.com |
en.wikipedia.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-06-15 - 2022-06-14 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-11-01 - 2022-01-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://malware.news/t/pakistani-hackers-operated-a-fake-app-store-to-target-former-afghan-officials/54650
Frame ID: 4A0B9C446843B4A6A75B5E6A900A90CE
Requests: 35 HTTP requests in this frame
10 Outgoing links
These are links going to different origins than the main page.
Title: 2
Search URL Search Domain Scan URL
Title: SideCopy
Search URL Search Domain Scan URL
Title: report
Search URL Search Domain Scan URL
Title: PJobRAT
Search URL Search Domain Scan URL
Title: Syria’s Air Force Intelligence Directorate
Search URL Search Domain Scan URL
Title: linked APT32
Search URL Search Domain Scan URL
Title: Iran
Search URL Search Domain Scan URL
Title: Palestine
Search URL Search Domain Scan URL
Title: China
Search URL Search Domain Scan URL
Title: The Record by Recorded Future
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
54650
malware.news/t/pakistani-hackers-operated-a-fake-app-store-to-target-former-afghan-officials/ |
79 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
color_definitions_base__2_ee47618baa1a0d84886f5d286192578d57a79a0d.css
malware.news/stylesheets/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
desktop_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
386 KB 70 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-details_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-local-dates_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-narrative-bot_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
153 B 681 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-presence_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lazy-yt_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poll_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poll_desktop_93a22f091c54232af298b50b16688ef99917bf57.css
malware.news/stylesheets/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
desktop_theme_2_95a8c44f0fc41047a948b433f2b72d51f04aef24.css
malware.news/stylesheets/ |
90 B 614 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
browser-detect-16ca87077aead9f656700e192992122d3a7eee8c1bb76da992127945464d4777.js
malware.news/assets/ |
279 B 578 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en-31abd0bd8622f3c49b2d78be9363daabc08d8d4e603a3174b85151da89811edc.js
malware.news/assets/locales/ |
270 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-1dab55cf5c2526ab8aee3b22b94132592f09b9633bd10e602dc4fc192e0e5c4b.js
malware.news/assets/ |
990 KB 292 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-5df712baae928b5a8697488527bd66f574c89604de830c13bcc2a65d568b4733.js
malware.news/assets/ |
3 MB 547 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-details-a5c71c75398c735e851440262e3c9ba43f9d8a2a7d81d8ecec16c8b2dbf452c3.js
malware.news/assets/plugins/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-local-dates-61bf2f885c99638a6e57fcd84bc259a8ef1ad94969374470e5b4934a4fc787b1.js
malware.news/assets/plugins/ |
37 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-narrative-bot-30875b55b6ce1fa11b9bd05515c0c931e4636c32f7ec29078c789af26f3fdcd6.js
malware.news/assets/plugins/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-presence-6314fe364c17d5968f47d8a05009ad6b350330aa4169db38adb2a139b1bad6f9.js
malware.news/assets/plugins/ |
13 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
docker_manager-4ced9f9c7bda9ba563c04006dbb93828d43f2c7d5b533065717c5a63da77d5fc.js
malware.news/assets/plugins/ |
2 KB 1002 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lazy-yt-4e94ac3522a311236b5b7b0cf0ad4f98ee8632f45a4c686ac5b6676fcabe6f78.js
malware.news/assets/plugins/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poll-011e19cce3453f7556e17cf5b8c3ffad20fb7d4d66651af275a348ae4ab1003b.js
malware.news/assets/plugins/ |
60 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js
malware.news/assets/ |
714 B 784 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
start-discourse-efa4e5abfbd1b50b5152ffbe64d5dcea9f7c33f766dcc6387e2711f0f2112148.js
malware.news/assets/ |
135 B 464 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
browser-update-eec13eb6f8386f18f10b5dd6ebb7a3598d28421bb796e539b91a7e4a4c5d4c08.js
malware.news/assets/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
svg-2-a63c82e1d7ca12b72b28a3395e96e4231ebe0584.js
malware.news/svg-sprite/malware.news/ |
114 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.magnific-popup.min.js
malware.news/javascripts/magnific-popup/1.1.0/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cdefff4af52a8d2d43094b5d57ebca1fc7613a63.js
malware.news/highlight-js/malware.news/ |
202 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24_2.png
malware.news/user_avatar/malware.news/malbot/45/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Kabul-Afghanistan-1024x566.jpg
therecord.media/wp-content/uploads/2021/11/ |
126 KB 126 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SideCopy-app-store.png
www-therecord.recfut.com/wp-content/uploads/2021/11/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 205 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
poll
malware.news/message-bus/443c7fa573424676911bf507b0df8116/ |
266 B 0 |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www-therecord.recfut.com
- URL
- https://www-therecord.recfut.com/wp-content/uploads/2021/11/SideCopy-app-store.png
Verdicts & Comments Add Verdict or Comment
47 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| I18n object| MessageFormat function| moment function| define function| requirejs object| Markdown object| bootbox object| clone object| ENV object| EmberENV function| $ function| jQuery object| mainContext object| Ember object| Em function| require function| requireModule object| Logster object| Handlebars object| MessageBus object| Popper function| _ function| ItsATrap object| RSVP object| Uppy function| BufferedProxy string| __INDIVIDUAL_ONE_VERSION_ev-store_ENFORCE_SINGLETON undefined| __INDIVIDUAL_ONE_VERSION_ev-store object| virtualDom function| filterCSS function| filterXSS function| __t object| __DISCOURSE_RAW_TEMPLATES object| Discourse object| __widget_helpers string| GoogleAnalyticsObject function| ga undefined| $bu object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| hljs3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.malware.news/ | Name: _ga Value: GA1.2.1599145617.1637600877 |
|
.malware.news/ | Name: _gid Value: GA1.2.137085683.1637600877 |
|
.malware.news/ | Name: _gat Value: 1 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://malware.news/logs/ https://malware.news/sidekiq/ https://malware.news/mini-profiler-resources/ https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/extra-locales/ https://malware.news/highlight-js/ https://malware.news/javascripts/ https://malware.news/plugins/ https://malware.news/theme-javascripts/ https://malware.news/svg-sprite/ https://www.google-analytics.com/analytics.js; worker-src 'self' https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/javascripts/ https://malware.news/plugins/; frame-ancestors 'self'; manifest-src 'self' |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
malware.news
therecord.media
www-therecord.recfut.com
www.google-analytics.com
www-therecord.recfut.com
2606:4700:20::681a:769
2606:4700::6812:721
2a00:1450:4001:831::200e
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
0fcffc7fb527327f6f200d30d6aea548b6b4123384dcca354ffe9d208fa076f4
100201b3008526362e99f5ad52e8c0a2a247b3c3f28d5c98747d1febe2eeeb1f
13cbd5ba2a63471fd2570088d4b3ca5761239b375385a957752dc0f397baa7ba
16c3a3e3f45b425c2ee002ecfe86f9a3e6e8268d6474a1adeeb13d32a9dd760a
178b4b9e60ffd21a2d8ff23f50ef58c6d80debd2b9afbf66501d60d63725b69d
1d4a605cb261ecd589679cc0cf166f73216953dbae4b98aa285f18c71c9ee639
20ec9f960e177cdd0ab1fbb1c3e2721a9ee1f2dccf21b0f242f15e92d3360d08
22d40468f4ecd2d00eb706c83aa51eb1b977f8b0abe1b4e903a2132b610ca5ae
285bc697b8e5897bf7133e9f6949167f99668e55eaefc6284e570f7d35b3a5ff
2a8e95e07d9dbcddac4082465f580c93b0b5b49316c40cdc6053f18431128d9a
32dd04a200b7d37f9c746a0dd75ae6c88da517348b69589b3f0c9ff10af9c1a4
34a57e9e634882adef3bd9ae1fcadab8d09b5dad07888b89d504e1708f7396a1
36e56ff433d1e7c0017688ed51d42dea37fc7a90431b54d4568df80746ed349b
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
424e47b514ed74e2b99a705328ea4df53514584207a8cc2b208dcbfa97feeb5d
439310fe70c9254ca886a5848ab84ece7a2d0b9f1d7eb654e35ee1af86b1d0d9
4587cbbeae3149a10e6f462994d43da9a3de45dc2547d68821c1c37a0eaccd3c
64002b3db3c6de2699314daf41c014c608c437500a076b0305f22abf2d41085c
659d3d9f20a0eb70f222e25c949dbeb05d94d9087a6332443b7bc78a9aab9fdb
73edfabfded13666c4a05cc461f0fc719721b799584445dc700c7d169504e25e
7e6dbcb4fa67139ef1bfb019ef153f21b130a1f68f7d5bbe3c15033c14342ff7
873fea534c95b50cb6a7e87c05d3239d44017be63de1a2243d8566fa1366f52e
8819a1e1d71488799884b1f3ee3794fefa09bb011f2752d71d4f652eabe49b74
89f0a6cadcfcb4800c243fd670276a9d1ea9dcb2a1f0d18e94ade14bff9c0648
8e4c97db884fbdc4e17c3dd31d3a5aebe3fef1fffe4d67882cc06979aa0b1146
97cab28ecff02fc636054e3e328d1107c6cc0dfc7ded53017511df4502f87e33
9ddbd7e428470009468a2b2dea162d6aa4f84f55bf13672fc5409cec9133e22d
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a933fa87d48ac7c2f381036d364fa92767c5dae738491b16aa668671abc23442
cbd1543f1a445bf11e223bc4ed18f99e97352f4351da641a86c7d9c9bcab268a
fdf3629738ae4371321ed16c31b588897be085c49f281572d8e69b30c57fb6c4