www.wicar.org Open in urlscan Pro
199.34.228.69  Public Scan

42 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://malware.wicar.org/ Page URL
2. https://www.wicar.org/test-malware.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ malware.wicar.org/	334 B 582 B	463ms 101ms	Document text/html	2607:ff18:80::615 GRIDFURY-AS
General Check archive.org Show headers Download Go to Full URL http://malware.wicar.org/ Protocol HTTP/1.1 Server 2607:ff18:80::615 , United States, ASN40630 (GRIDFURY-AS, US), Reverse DNS Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 242 Content-Type text/html; charset=UTF-8 Date Thu, 09 Nov 2023 14:12:36 GMT ETag "14e-570a1fa2dc79d" Keep-Alive timeout=5, max=100 Last-Modified Tue, 10 Jul 2018 09:44:32 GMT Server Apache Vary Accept-Encoding Via e7
GET H/1.1	200 OK	Primary Request test-malware.html Show response www.wicar.org/	37 KB 8 KB	689ms 210ms	Document text/html	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/test-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software Apache / Resource Hash 23cc90f7b79bebdf45569daa2b2ab837b0db330a56cce5bbbcca0d5d135deba3 Request headers Referer http://malware.wicar.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control private Connection Keep-Alive Content-Encoding gzip Content-Length 8108 Content-Type text/html; charset=UTF-8 Date Thu, 09 Nov 2023 14:12:37 GMT ETag W/"d14d2231ae44fe648aa3af6aed03ea2b-gzip" Keep-Alive timeout=10, max=72 Server Apache Vary X-W-SSL,Accept-Encoding,User-Agent X-Host grn152.sf2p.intern.weebly.net X-UA-Compatible IE=edge,chrome=1
GET H2	200	sites.css cdn2.editmysite.com/css/	206 KB 29 KB	59ms 25ms	Stylesheet text/css	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/css/sites.css?buildTime=1696105269 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 5b6bd64c8f7d37dd7bd34e3760cfffa93a982937376e2c02708f63c35c645a07 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 7, 1 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 164791 x-cache HIT, HIT x-host grn93.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 29663 x-served-by cache-sjc10067-SJC, cache-fra-eddf8230126-FRA last-modified Tue, 07 Nov 2023 15:19:26 GMT server nginx x-timer S1699539157.232592,VS0,VE7 etag W/"654a557e-337f6" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 21 Nov 2023 16:26:05 GMT
GET H2	200	fancybox.css cdn2.editmysite.com/css/old/	4 KB 2 KB	50ms 16ms	Stylesheet text/css	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/css/old/fancybox.css?1696105269 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 465, 1 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 795070 x-cache HIT, HIT x-host blu106.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 1218 x-served-by cache-sjc10069-SJC, cache-fra-eddf8230126-FRA last-modified Mon, 30 Oct 2023 20:17:02 GMT server nginx x-timer S1699539157.234175,VS0,VE1 etag "65400f3e-f47" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 14 Nov 2023 09:21:27 GMT
GET H/1.1	200 OK	main_style.css www.wicar.org/files/	13 KB 3 KB	166ms 160ms	Stylesheet text/css	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/files/main_style.css?1696165235 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software nginx / Resource Hash 51153664d232a1a9e17634e0cd3d3fad01e8be398ff9e931f1a2cba0090cae33 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/test-malware.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Date Thu, 09 Nov 2023 14:12:37 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Access-Control-Allow-Methods GET, POST, DELETE, OPTIONS Content-Type text/css Vary Accept-Encoding Access-Control-Allow-Origin * X-Host blu78.sf2p.intern.weebly.net Connection keep-alive Access-Control-Allow-Headers Origin, Authorization, Content-Type
GET H2	200	font.css cdn2.editmysite.com/fonts/Open_Sans/	3 KB 569 B	43ms 10ms	Stylesheet text/css	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f435c7332d3136b59a056b0c7e23926256b057ac7598568a8120f070c2ec30d4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 4, 914 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 101399 x-cache HIT, HIT x-host grn65.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 367 x-served-by cache-sjc10081-SJC, cache-fra-eddf8230126-FRA last-modified Tue, 07 Nov 2023 22:29:29 GMT server nginx x-timer S1699539157.234520,VS0,VE0 etag "654aba49-a2a" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 22 Nov 2023 10:02:38 GMT
GET H2	200	jquery-1.8.3.min.js Show response cdn2.editmysite.com/js/	91 KB 33 KB	28ms 9ms	Script application/javascript	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/jquery-1.8.3.min.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 3, 14493 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 745462 x-cache HIT, HIT x-host grn114.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33467 x-served-by cache-sjc10032-SJC, cache-fra-eddf8230126-FRA last-modified Tue, 31 Oct 2023 21:03:55 GMT server nginx x-timer S1699539157.234430,VS0,VE0 etag "65416bbb-16dc4" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 14 Nov 2023 23:08:15 GMT
GET H2	200	stl.js Show response cdn2.editmysite.com/js/lang/en/	178 KB 33 KB	30ms 12ms	Script application/javascript	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1696105269& Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 3b7805a3f0e4750ab90d4c40f0d1efdf11c5deb485ef9ed12b9c89b000f87f82 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 736, 1 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 174082 x-cache HIT, HIT x-host blu120.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33107 x-served-by cache-sjc10031-SJC, cache-fra-eddf8230126-FRA last-modified Mon, 06 Nov 2023 23:01:20 GMT server nginx x-timer S1699539157.234209,VS0,VE1 etag "65497040-2c90e" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 21 Nov 2023 13:51:14 GMT
GET H2	200	main.js Show response cdn2.editmysite.com/js/site/	466 KB 143 KB	36ms 18ms	Script application/javascript	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/site/main.js?buildTime=1696105269 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 593fec175b00a1f118f77bb8ed378e857e9f1225f0fc019fcea508b27da53cf0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 68, 1 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 180986 x-cache HIT, HIT x-host blu56.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 146401 x-served-by cache-sjc10039-SJC, cache-fra-eddf8230126-FRA last-modified Mon, 06 Nov 2023 23:02:13 GMT server nginx x-timer S1699539157.233872,VS0,VE2 etag "65497075-74804" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 21 Nov 2023 11:56:10 GMT
GET H2	200	main-customer-accounts-site.js Show response cdn2.editmysite.com/js/site/	522 KB 156 KB	40ms 23ms	Script application/javascript	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1696105269 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash dd8581d4db21d53a79ddeb0cea5289108dbdc0d214a6391a959d93a30e5d04b7 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 2, 1 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 968100 x-cache HIT, HIT x-host grn155.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 159146 x-served-by cache-sjc1000141-SJC, cache-fra-eddf8230126-FRA last-modified Fri, 27 Oct 2023 22:10:44 GMT server nginx x-timer S1699539157.234755,VS0,VE1 etag "653c3564-826d7" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Sun, 12 Nov 2023 09:17:37 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	185 KB 67 KB	116ms 33ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9ab4a773cf90e6746e182b38c866b3feecb174f16cc126ccc4b28da6ae0b309b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers date Thu, 09 Nov 2023 14:12:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 68577 x-xss-protection 0 last-modified Thu, 09 Nov 2023 12:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 09 Nov 2023 14:12:37 GMT
GET		buttons.js w.sharethis.com/button/	0 0
GET H/1.1	200 OK	bullet.png www.wicar.org/files/theme/	1 KB 2 KB	170ms 168ms	Image image/png	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.wicar.org/files/theme/bullet.png?1696165235 Requested by Host: www.wicar.org URL: https://www.wicar.org/files/main_style.css?1696165235 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software nginx / Resource Hash e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/files/main_style.css?1696165235 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers Date Thu, 09 Nov 2023 14:12:37 GMT X-Storage-Object e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0 Last-Modified Tue, 27 Oct 2020 15:57:36 GMT Server nginx x-amz-request-id tx0000000000000021e4ea8-006284e22e-b9fbc63-sfo1 ETag "ade925929d3c8bef998838a29bf90aae" Content-Type image/png; charset=binary x-rgw-object-type Normal X-Storage-Bucket ze459 X-Host blu78.sf2p.intern.weebly.net Connection keep-alive Accept-Ranges bytes Content-Length 1156
GET H3	200	regular.woff2 cdn2.editmysite.com/fonts/Open_Sans/	16 KB 17 KB	38ms 9ms	Font font/woff2	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/regular.woff2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Protocol H3 Security QUIC, , AES_256_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681 Request headers Referer https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Origin https://www.wicar.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 15, 843 date Thu, 09 Nov 2023 14:12:37 GMT via 1.1 varnish, 1.1 varnish age 820769 x-cache HIT, HIT x-host grn103.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 16740 x-served-by cache-sjc1000135-SJC, cache-fra-eddf8230047-FRA last-modified Mon, 30 Oct 2023 14:36:18 GMT server nginx x-timer S1699539157.482426,VS0,VE0 etag "653fbf62-4164" content-type font/woff2 access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 14 Nov 2023 02:13:08 GMT
GET H3	200	bold.woff2 cdn2.editmysite.com/fonts/Open_Sans/	16 KB 16 KB	40ms 11ms	Font font/woff2	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/bold.woff2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Protocol H3 Security QUIC, , AES_256_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72 Request headers Referer https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Origin https://www.wicar.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 11, 720 date Thu, 09 Nov 2023 14:12:37 GMT via 1.1 varnish, 1.1 varnish age 774879 x-cache HIT, HIT x-host blu26.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 16372 x-served-by cache-sjc10053-SJC, cache-fra-eddf8230047-FRA last-modified Mon, 30 Oct 2023 14:36:18 GMT server nginx x-timer S1699539157.482912,VS0,VE0 etag "653fbf62-3ff4" content-type font/woff2 access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 14 Nov 2023 14:57:58 GMT
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	17ms 14ms	Script text/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 09 Nov 2023 13:19:58 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 3159 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17168 expires Thu, 09 Nov 2023 15:19:58 GMT
GET H2	200	snowday262.js Show response cdn2.editmysite.com/js/wsnbn/	73 KB 25 KB	12ms 11ms	Script application/javascript	2a04:4e42:400::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/wsnbn/snowday262.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers x-cache-hits 7, 733 date Thu, 09 Nov 2023 14:12:37 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 19383 x-cache HIT, HIT x-host grn97.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 25752 x-served-by cache-sjc10061-SJC, cache-fra-eddf8230126-FRA last-modified Wed, 08 Nov 2023 00:38:34 GMT server nginx x-timer S1699539157.497441,VS0,VE0 etag "654ad88a-124fe" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Thu, 23 Nov 2023 08:49:33 GMT
POST H/1.1	200 OK	/ Show response www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/	348 B 629 B	247ms 230ms	XHR application/json	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/js/jquery-1.8.3.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software Apache / Resource Hash adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.wicar.org/test-malware.html X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers Date Thu, 09 Nov 2023 14:12:37 GMT Server Apache Vary X-W-SSL,User-Agent Content-Type application/json X-Host grn117.sf2p.intern.weebly.net Connection Keep-Alive Keep-Alive timeout=10, max=74 Content-Length 348 X-UA-Compatible IE=edge,chrome=1
GET H2	200	js Show response www.googletagmanager.com/gtag/	221 KB 79 KB	36ms 35ms	Script application/javascript	2a00:1450:4001:80e::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-FZX7V2575Y&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash df6d5553cd09e21a71908997e5057c22ff08cb5e0088b8eff198e1624f84cd3d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers date Thu, 09 Nov 2023 14:12:37 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 80558 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 09 Nov 2023 14:12:37 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	58ms 18ms	Script text/javascript	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 09 Nov 2023 13:51:32 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 1265 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Thu, 09 Nov 2023 15:51:32 GMT
POST H2	200	tp2 Show response ec.editmysite.com/com.snowplowanalytics.snowplow/	2 B 319 B	530ms 177ms	XHR text/plain	52.37.65.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/js/wsnbn/snowday262.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.37.65.77 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-37-65-77.us-west-2.compute.amazonaws.com Software nginx / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://www.wicar.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers access-control-allow-origin https://www.wicar.org date Thu, 09 Nov 2023 14:12:38 GMT access-control-allow-credentials true content-type text/plain; charset=UTF-8 server nginx content-length 2 p3p policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
OPTIONS H2	200	tp2 ec.editmysite.com/com.snowplowanalytics.snowplow/	0 0	604ms 192ms	Preflight	52.37.65.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.37.65.77 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-37-65-77.us-west-2.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.wicar.org Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type, SP-Anonymous access-control-allow-origin https://www.wicar.org access-control-max-age 600 content-length 0 date Thu, 09 Nov 2023 14:12:38 GMT server nginx
POST H2	204	collect region1.google-analytics.com/g/	0 244 B	63ms 17ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-FZX7V2575Y&gtm=45je3b60v9117534308&_p=1699539157491&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=869123390.1699539158&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1699539157&sct=1&seg=0&dl=https%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&dr=http%3A%2F%2Fmalware.wicar.org%2F&dt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1170 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-FZX7V2575Y&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Response headers pragma no-cache date Thu, 09 Nov 2023 14:12:37 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.wicar.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 205 B	29ms 29ms	XHR text/plain	2a00:1450:4001:82f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1534535492&t=pageview&_s=1&dl=https%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&dr=http%3A%2F%2Fmalware.wicar.org%2F&ul=en-us&de=UTF-8&dt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=708500855&gjid=295801538&cid=869123390.1699539158&tid=UA-5568574-11&_gid=1184233075.1699539158&_r=1&gtm=457e3b60&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=193738301 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.wicar.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 09 Nov 2023 14:12:37 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.wicar.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

w.sharethis.com

URL

http://w.sharethis.com/button/buttons.js

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture string| STATIC_BASE string| ASSETS_BASE string| STYLE_PREFIX function| $ function| jQuery object| Weebly object| _W function| publishedWBJP string| RECAPTCHA_PUBLIC_KEY string| INVISIBLE_RECAPTCHA_PUBLIC_KEY function| _ object| Mustache object| jQBrowser function| PlatformElement function| whenThemeCSSLoaded function| isThemeCSSLoaded function| blogCommentDisplayForm object| YTPlayer object| VimeoPlayer function| Sd function| Rd boolean| Cd function| videojs function| _V_ object| jsonrpc function| getCartCount function| getCartNavElement function| reportCartNavElement function| initPublishedFlyoutMenus boolean| flyoutMenusRefreshable function| initEditorFlyoutMenus function| refreshNavCondense boolean| disableFlyouts function| FlyoutMenu function| objectify object| mejs function| MediaElement function| MediaElementPlayer function| require function| platformElementRequire function| initCustomerAccountsModels object| initEvt string| com_currentSite string| com_userID function| initFlyouts boolean| switchTo5x undefined| windowHref object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| gtag object| dataLayer object| _gaq object| r function| snPlObR string| s object| regEx object| drSegmentsTag undefined| segmentData object| GlobalSnowplowNamespace function| snowday object| jQuery18305779221346572676 boolean| lightboxLoaded object| navFlyoutMenu function| refreshPublishedFlyoutMenus object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| _gat object| Snowplow object| gaGlobal object| gaplugins object| gaData

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.www.wicar.org/	1969-12-31 23:59:59	Name: is_mobile Value: 0
			www.wicar.org/	1970-01-20 16:25:48	Name: language Value: de_DE
			.wicar.org/	1970-01-20 16:05:40	Name: _snow_ses.ae07 Value: *
			.wicar.org/	1970-01-21 01:41:39	Name: _snow_id.ae07 Value: 630258f8-4d80-4ddc-a287-e0ced19692b9.1699539158.1.1699539158.1699539158.8b4d5316-e941-4c74-b48c-0e7866081ea9
			.wicar.org/	1970-01-21 01:41:39	Name: _ga_FZX7V2575Y Value: GS1.1.1699539157.1.0.1699539157.0.0.0
			.wicar.org/	1970-01-21 01:41:39	Name: _ga Value: GA1.2.869123390.1699539158
			.wicar.org/	1970-01-20 16:07:05	Name: _gid Value: GA1.2.1184233075.1699539158
			.wicar.org/	1970-01-20 16:05:39	Name: _gat_gtag_UA_5568574_11 Value: 1
			ec.editmysite.com/	1970-01-21 00:51:15	Name: sp Value: f81040eb-1d79-4ba4-aaab-87dc32ac6954

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.wicar.org/test-malware.html Message: Mixed Content: The page at 'https://www.wicar.org/test-malware.html' was loaded over HTTPS, but requested an insecure script 'http://w.sharethis.com/button/buttons.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn2.editmysite.com
ec.editmysite.com
malware.wicar.org
region1.google-analytics.com
ssl.google-analytics.com
w.sharethis.com
www.google-analytics.com
www.googletagmanager.com
www.wicar.org
w.sharethis.com
199.34.228.69
2001:4860:4802:32::36
2607:ff18:80::615
2a00:1450:4001:80e::2008
2a00:1450:4001:82f::200e
2a04:4e42:400::302
52.37.65.77
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
23cc90f7b79bebdf45569daa2b2ab837b0db330a56cce5bbbcca0d5d135deba3
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3b7805a3f0e4750ab90d4c40f0d1efdf11c5deb485ef9ed12b9c89b000f87f82
51153664d232a1a9e17634e0cd3d3fad01e8be398ff9e931f1a2cba0090cae33
593fec175b00a1f118f77bb8ed378e857e9f1225f0fc019fcea508b27da53cf0
5b6bd64c8f7d37dd7bd34e3760cfffa93a982937376e2c02708f63c35c645a07
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a
9ab4a773cf90e6746e182b38c866b3feecb174f16cc126ccc4b28da6ae0b309b
adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72
dd8581d4db21d53a79ddeb0cea5289108dbdc0d214a6391a959d93a30e5d04b7
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df6d5553cd09e21a71908997e5057c22ff08cb5e0088b8eff198e1624f84cd3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0
f435c7332d3136b59a056b0c7e23926256b057ac7598568a8120f070c2ec30d4