URL: https://www.malware.us-cert.gov/
Submission: On October 26 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 2a02:26f0:6c00:28f::1955, located in Ascension Island and belongs to AKAMAI-ASN1, NL. The main domain is www.malware.us-cert.gov.
TLS certificate: Issued by GeoTrust RSA CA 2018 on August 25th 2021. Valid for: a year.
This is the only time www.malware.us-cert.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 1
Apex Domain
Subdomains
Transfer
3 us-cert.gov
www.malware.us-cert.gov
132 KB
3 1
Domain Requested by
3 www.malware.us-cert.gov www.malware.us-cert.gov
3 1

This site contains links to these domains. Also see Links.

Domain
www.dhs.gov
Subject Issuer Validity Valid
www.dhs.gov
GeoTrust RSA CA 2018
2021-08-25 -
2022-08-02
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.malware.us-cert.gov/
Frame ID: 8AA0D60162E5CD50F0E566C5A71B18E2
Requests: 3 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)

Page Statistics

3
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

132 kB
Transfer

136 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
www.malware.us-cert.gov/
6 KB
3 KB
Document
General
Full URL
https://www.malware.us-cert.gov/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28f::1955 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
f1dfc21335d726cfe1b0570d6f730b221d63197ad3faeb0936a11fab45efacf3
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' 'www.malware.us-cert.gov'; script-src 'self'; style-src 'self' 'www.malware.us-cert.gov'
X-Content-Type-Options nosniff nosniff
X-Frame-Options DENY

Request headers

Host
www.malware.us-cert.gov
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx/1.20.1
Content-Type
text/html; charset=utf-8
X-Frame-Options
DENY
Vary
Cookie Accept-Encoding
X-Content-Type-Options
nosniff nosniff
Referrer-Policy
same-origin
Content-Security-Policy
default-src 'self'; img-src 'self' 'www.malware.us-cert.gov'; script-src 'self'; style-src 'self' 'www.malware.us-cert.gov'
Content-Encoding
gzip
Date
Tue, 26 Oct 2021 20:53:23 GMT
Content-Length
2170
Connection
keep-alive
Set-Cookie
csrftoken=Azw5WQ8ycuCBbLmtZjFiJS1ZGnp8i0zK7wfivlJnCy4bIDBibpF2qa0R7JXPYzLE; expires=Tue, 25 Oct 2022 20:53:23 GMT; Max-Age=31449600; Path=/; SameSite=Lax
style.css
www.malware.us-cert.gov/static/amac/
1 KB
813 B
Stylesheet
General
Full URL
https://www.malware.us-cert.gov/static/amac/style.css
Requested by
Host: www.malware.us-cert.gov
URL: https://www.malware.us-cert.gov/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28f::1955 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
2078737e0037a5e7fcb186ce2caa20e0bab1b5dcc7c4abba65bad93905575f81
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
www.malware.us-cert.gov
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://www.malware.us-cert.gov/
Cookie
csrftoken=Azw5WQ8ycuCBbLmtZjFiJS1ZGnp8i0zK7wfivlJnCy4bIDBibpF2qa0R7JXPYzLE
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://www.malware.us-cert.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 20:53:24 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 25 Mar 2021 17:34:25 GMT
Server
nginx/1.20.1
ETag
"605cc9a1-484"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
496
us-cert-logo.png
www.malware.us-cert.gov/static/amac/
128 KB
129 KB
Image
General
Full URL
https://www.malware.us-cert.gov/static/amac/us-cert-logo.png
Requested by
Host: www.malware.us-cert.gov
URL: https://www.malware.us-cert.gov/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28f::1955 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
9023dab2708c4b879f4b922e340a6f66a42d6a874b746862ddda04f02c145745
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
www.malware.us-cert.gov
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://www.malware.us-cert.gov/
Cookie
csrftoken=Azw5WQ8ycuCBbLmtZjFiJS1ZGnp8i0zK7wfivlJnCy4bIDBibpF2qa0R7JXPYzLE
Connection
keep-alive
Accept-Language
de-DE,de;q=0.9
Referer
https://www.malware.us-cert.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 26 Oct 2021 20:53:24 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 25 Mar 2021 17:34:25 GMT
Server
nginx/1.20.1
ETag
"605cc9a1-201f9"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
131577

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster

1 Cookies

Domain/Path Name / Value
www.malware.us-cert.gov/ Name: csrftoken
Value: Azw5WQ8ycuCBbLmtZjFiJS1ZGnp8i0zK7wfivlJnCy4bIDBibpF2qa0R7JXPYzLE

2 Console Messages

Source Level URL
Text
security error URL: https://www.malware.us-cert.gov/
Message:
The source list for the Content Security Policy directive 'img-src' contains an invalid source: ''www.malware.us-cert.gov''. It will be ignored.
security error URL: https://www.malware.us-cert.gov/
Message:
The source list for the Content Security Policy directive 'style-src' contains an invalid source: ''www.malware.us-cert.gov''. It will be ignored.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; img-src 'self' 'www.malware.us-cert.gov'; script-src 'self'; style-src 'self' 'www.malware.us-cert.gov'
X-Content-Type-Options nosniff nosniff
X-Frame-Options DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.malware.us-cert.gov
2a02:26f0:6c00:28f::1955
2078737e0037a5e7fcb186ce2caa20e0bab1b5dcc7c4abba65bad93905575f81
9023dab2708c4b879f4b922e340a6f66a42d6a874b746862ddda04f02c145745
f1dfc21335d726cfe1b0570d6f730b221d63197ad3faeb0936a11fab45efacf3