urlscan.io logo urlscan.io
SecurityTrails logo

www.wicar.org Open in urlscan Pro
199.34.228.69  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://malware.wicar.org/
Effective URL: https://www.wicar.org/test-malware.html
Submission: On November 18 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 17 HTTP transactions. The main IP is 199.34.228.69, located in San Francisco, United States and belongs to WEEBLY, US. The main domain is www.wicar.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 9th 2020. Valid for: 3 months.
This is the only time www.wicar.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2607:ff18:80:... 40630 (GRIDFURY-AS)
3 199.34.228.69 27647 (WEEBLY)
2 2a04:4e42:1b:... 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
17 5
Domain Requested by
3 www.wicar.org www.wicar.org
2 ssl.google-analytics.com www.wicar.org
2 cdn2.editmysite.com www.wicar.org
1 malware.wicar.org
0 w.sharethis.com Failed www.wicar.org
0 ajax.googleapis.com Failed www.wicar.org
0 fonts.googleapis.com Failed www.wicar.org
17 7
Subject Issuer Validity Valid
www.wicar.org
Let's Encrypt Authority X3		 2020-10-09 -
2021-01-07		 3 months crt.sh
editmysite.com
GlobalSign CloudSSL CA - SHA256 - G3		 2020-04-21 -
2021-04-22		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-10-28 -
2021-01-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.wicar.org/test-malware.html
Frame ID: 381946D700C66B9CE806E739FE5D2118
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://malware.wicar.org/ Page URL
  2. https://www.wicar.org/test-malware.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /cdn\d+\.editmysite\.com/i
Overall confidence: 100%
Detected patterns
  • script /cdn\d+\.editmysite\.com/i
Overall confidence: 100%
Detected patterns
  • script /cdn\d+\.editmysite\.com/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

17
Requests

41 %
HTTPS

75 %
IPv6

5
Domains

7
Subdomains

5
IPs

3
Countries

86 kB
Transfer

332 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://malware.wicar.org/ Page URL
  2. https://www.wicar.org/test-malware.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
malware.wicar.org/ 		334 B
582 B 		Document
General
Check archive.org
Download Go to
Full URL
http://malware.wicar.org/
Protocol
HTTP/1.1
Server
2607:ff18:80::615 , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be

Request headers

Host
malware.wicar.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 18 Nov 2020 20:00:03 GMT
Server
Apache
Last-Modified
Tue, 10 Jul 2018 09:44:32 GMT
ETag
"14e-570a1fa2dc79d"
Accept-Ranges
bytes
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Via
e1
Content-Length
242
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Primary Request Cookie set test-malware.html
www.wicar.org/ 		36 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY, US),
Reverse DNS
pages-custom-21.weebly.com
Software
Apache /
Resource Hash
068217e28ebc6b917fd72b01d89df947345f85da557a6ef7b25c92075337a7f6

Request headers

Host
www.wicar.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
http://malware.wicar.org/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://malware.wicar.org/

Response headers

Date
Wed, 18 Nov 2020 20:00:04 GMT
Server
Apache
Set-Cookie
is_mobile=0; path=/; domain=www.wicar.org language=en; expires=Wed, 02-Dec-2020 20:00:04 GMT; Max-Age=1209600; path=/
Vary
X-W-SSL,Accept-Encoding,User-Agent
Cache-Control
private
ETag
W/"ba51602ec1af5d59c25548a734e22522-gzip"
Content-Encoding
gzip
X-Host
pages29.sf2p.intern.weebly.net
X-UA-Compatible
IE=edge,chrome=1
Content-Length
7971
Keep-Alive
timeout=10, max=66
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
gdprscript.js
www.wicar.org/gdpr/ 		0
0
sites.css
cdn2.editmysite.com/css/ 		0
0
fancybox.css
cdn2.editmysite.com/css/old/ 		0
0
main_style.css
www.wicar.org/files/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wicar.org/files/main_style.css?1584929572
Requested by
Host: www.wicar.org
URL: https://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY, US),
Reverse DNS
pages-custom-21.weebly.com
Software
nginx /
Resource Hash
4aaaface0c146790078c5db47539b972dee77a821556bdc031b248ca34cfd2a7

Request headers

Referer
https://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 18 Nov 2020 20:00:04 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
X-Host
grn25.sf2p.intern.weebly.net
Connection
keep-alive
Access-Control-Allow-Headers
Origin, Authorization, Content-Type
css
fonts.googleapis.com/ 		0
0
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 		0
0
stl.js
cdn2.editmysite.com/js/lang/en/ 		0
0
main.js
cdn2.editmysite.com/js/site/ 		0
0
main-customer-accounts-site.js
cdn2.editmysite.com/js/site/ 		0
0
stl.js
cdn2.editmysite.com/js/lang/en/ 		163 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1584819363&
Requested by
Host: www.wicar.org
URL: https://www.wicar.org/test-malware.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::302 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
be0cbac9aa6019fcb587157f324152ee21d966a7523a90ce4315bed07e8bcb63

Request headers

Referer
https://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 20:00:04 GMT
content-encoding
gzip
age
27691
x-cache
MISS, HIT
status
200
x-cache-hits
0, 1
content-length
29598
via
1.1 varnish, 1.1 varnish
x-served-by
cache-sjc10031-SJC, cache-hhn4074-HHN
last-modified
Tue, 17 Nov 2020 23:29:12 GMT
server
nginx
x-timer
S1605729604.299571,VS0,VE1
etag
W/"5fb45cc8-28c2d"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=1209600
accept-ranges
bytes
expires
Wed, 02 Dec 2020 12:18:33 GMT
bullet.png
www.wicar.org/files/theme/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wicar.org/files/theme/bullet.png?1584929572
Requested by
Host: www.wicar.org
URL: https://www.wicar.org/files/main_style.css?1584929572
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY, US),
Reverse DNS
pages-custom-21.weebly.com
Software
nginx /
Resource Hash
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0

Request headers

Referer
https://www.wicar.org/files/main_style.css?1584929572
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 18 Nov 2020 20:00:04 GMT
X-Storage-Object
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0
Last-Modified
Tue, 14 Apr 2020 22:05:12 GMT
Server
nginx
x-amz-request-id
tx00000000000000001255b-005ea35a5a-10e20e2-las
ETag
"ade925929d3c8bef998838a29bf90aae"
Content-Type
image/png; charset=binary
Connection
keep-alive
X-Host
blu27.sf2p.intern.weebly.net
X-Storage-Bucket
ze459
Accept-Ranges
bytes
Content-Length
1156
buttons.js
w.sharethis.com/button/ 		0
0
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: www.wicar.org
URL: https://www.wicar.org/test-malware.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
5432
date
Wed, 18 Nov 2020 18:29:32 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Wed, 18 Nov 2020 20:29:32 GMT
snowday262.js
cdn2.editmysite.com/js/wsnbn/ 		73 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn2.editmysite.com/js/wsnbn/snowday262.js
Requested by
Host: www.wicar.org
URL: https://www.wicar.org/test-malware.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::302 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3

Request headers

Referer
https://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 18 Nov 2020 20:00:04 GMT
content-encoding
gzip
age
636138
x-cache
HIT, HIT
status
200
x-cache-hits
1, 49093
content-length
25723
via
1.1 varnish, 1.1 varnish
x-served-by
cache-sjc10024-SJC, cache-hhn4074-HHN
last-modified
Wed, 11 Nov 2020 00:51:03 GMT
server
nginx
x-timer
S1605729604.387066,VS0,VE0
etag
W/"5fab3577-124fe"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=1209600
accept-ranges
bytes
expires
Wed, 25 Nov 2020 11:17:46 GMT
__utm.gif
ssl.google-analytics.com/r/ 		35 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=457749113&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&utmhid=2130944883&utmr=http%3A%2F%2Fmalware.wicar.org%2F&utmp=%2Ftest-malware.html&utmht=1605729604425&utmac=UA-5568574-11&utmcc=__utma%3D236560519.1055294146.1605729604.1605729604.1605729604.1%3B%2B__utmz%3D236560519.1605729604.1.1.utmcsr%3Dmalware.wicar.org%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=1486750248&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: www.wicar.org
URL: https://www.wicar.org/test-malware.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 Nov 2020 20:00:04 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.wicar.org
URL
https://www.wicar.org/gdpr/gdprscript.js?buildTime=1605653113&hasRemindMe=true&stealth=false
Domain
cdn2.editmysite.com
URL
https://cdn2.editmysite.com/css/sites.css?buildTime=1584819363
Domain
cdn2.editmysite.com
URL
https://cdn2.editmysite.com/css/old/fancybox.css?1584819363
Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,700,400italic,700italic&subset=latin,latin-ext
Domain
ajax.googleapis.com
URL
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Domain
cdn2.editmysite.com
URL
https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1584819363&
Domain
cdn2.editmysite.com
URL
https://cdn2.editmysite.com/js/site/main.js?buildTime=1584819363
Domain
cdn2.editmysite.com
URL
https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1584819363
Domain
w.sharethis.com
URL
http://w.sharethis.com/button/buttons.js

Verdicts & Comments Add Verdict or Comment

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes string| STATIC_BASE string| ASSETS_BASE string| STYLE_PREFIX function| initCustomerAccountsModels object| initEvt object| Weebly object| _W function| initFlyouts boolean| switchTo5x undefined| windowHref object| _gaq object| r function| snPlObR string| s object| regEx object| drSegmentsTag undefined| segmentData object| GlobalSnowplowNamespace function| snowday string| doNotTrack object| Snowplow object| _gat object| gaGlobal

7 Cookies

Domain/Path Name / Value
.wicar.org/ Name: __utmb
Value: 236560519.1.10.1605729604
.wicar.org/ Name: __utmt
Value: 1
.wicar.org/ Name: __utmc
Value: 236560519
.wicar.org/ Name: __utma
Value: 236560519.1055294146.1605729604.1605729604.1605729604.1
.www.wicar.org/ Name: is_mobile
Value: 0
www.wicar.org/ Name: language
Value: en
.wicar.org/ Name: __utmz
Value: 236560519.1605729604.1.1.utmcsr=malware.wicar.org|utmccn=(referral)|utmcmd=referral|utmcct=/