www.2-spyware.com Open in urlscan Pro
2606:4700:20::681a:542 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.2-spyware.com/remove-libexec-virus.html
Submission: On October 21 via manual (October 21st 2022, 3:42:57 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 2606:4700:20::681a:542, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.2-spyware.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 29th 2022. Valid for: a year.

This is the only time www.2-spyware.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:20:... 2606:4700:20::681a:542	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	109.235.67.100 109.235.67.100	62282 (RACKRAY U...) (RACKRAY UAB Rakrejus)
12	4

9 2606:4700:20::681a:542 (United States)

ASN13335 (CLOUDFLARENET, US)

www.2-spyware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.235.67.100 (Lithuania)

ASN62282 (RACKRAY UAB Rakrejus, LT)
PTR: server.hey.lt

www.hey.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	2-spyware.com www.2-spyware.com	138 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 32	20 KB
1	hey.lt www.hey.lt — Cisco Umbrella Rank: 467590	1 KB
12	3

	Domain	Requested by
9	www.2-spyware.com	www.2-spyware.com
2	www.google-analytics.com	www.2-spyware.com www.google-analytics.com
1	www.hey.lt
12	3

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.reimageplus.com
offer.intego.com
www.enigmasoftware.com
www.malwarebytes.com
www.combocleaner.com
www.cultofmac.com
usa.kaspersky.com
en.wikipedia.org
support.microsoft.com
virusactivity.com
www.hey.lt
feeds.feedburner.com
esolutions.lt

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-29` - `2023-05-29`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
hey.lt Sectigo RSA Domain Validation Secure Server CA	`2022-03-04` - `2023-04-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.2-spyware.com/remove-libexec-virus.html
Frame ID: A1B6CF37B867C68D468172321F1FB62E
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Remove Libexec virus (Virus Removal Guide) - Free InstructionsVirus Activity

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

159 kB
Transfer

432 kB
Size

3
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/LinasKiguolis

Search URL Search Domain Scan URL

URL: https://www.facebook.com/profile.php?id=100010654927153

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/terms-of-use/
Title: Reimаge EULA

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://offer.intego.com/MAC_5bjaoj9vy
Title: Intego

Search URL Search Domain Scan URL

URL: https://www.reimageplus.com/refund-policy/
Title: Refund Policy

Search URL Search Domain Scan URL

URL: https://www.enigmasoftware.com/enigmasoft-privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.enigmasoftware.com/spyhunter5-eula/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/privacy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/tos/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/eula/
Title: Product Refund Policy

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/privacy-policy/
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.combocleaner.com/refund-policy/
Title: Product Refund Policy

Search URL Search Domain Scan URL

URL: https://www.cultofmac.com/679857/trojan-using-fake-flash-updates-infects-1-in-10-macs/
Title: Trojan using fake Flash updates infects 1 in 10 Macs

Search URL Search Domain Scan URL

URL: https://usa.kaspersky.com/resource-center/threats/mac-vs-pc
Title: Mac vs. PC Computer Security

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Scareware
Title: Scareware

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/4520411/adobe-flash-end-of-support
Title: Adobe Flash end of support on December 31, 2020

Search URL Search Domain Scan URL

URL: https://virusactivity.com/
Title: Virus Activity

Search URL Search Domain Scan URL

URL: https://www.hey.lt/details.php?id=spyware

Search URL Search Domain Scan URL

URL: http://feeds.feedburner.com/2-spyware/XBaU
Title: Rss feed

Search URL Search Domain Scan URL

URL: https://www.facebook.com/2spyware
Title: Like us

Search URL Search Domain Scan URL

URL: http://esolutions.lt/
Title: esolutions.lt

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request remove-libexec-virus.html Show response
www.2-spyware.com/ 127 KB
30 KB 639ms
592ms Document
text/html 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1022620da2db546471ebebd0914aac55e6133099cd1be4aee62a29c14ef747b0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 27
cf-cache-status: DYNAMIC
cf-ray: 75db1afe5f769237-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 21 Oct 2022 15:42:51 GMT
link: <https://www.2-spyware.com/?p=71578>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=31BCf4yxgV%2B0V8FUNMHACHE%2Fx%2F7XfGFyTgloOvX1hzbdjK%2BiXZ%2FcE8Djpf6jVZ7v0kU6zsiWvqs25%2BDNl6S%2FnhUBTU%2BxSuli1PHLdjkKVNYkdURvkXTLrrg82tRgLAouGTQURDDXAdLYp4fJC%2FEj"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
via: 1.1 varnish
x-pingback: https://www.2-spyware.com/news/xmlrpc.php
x-varnish: 362597113 362597072

GET
H2 200 style_2s.min.css
www.2-spyware.com/news/wp-content/themes/AskIt/css/ 102 KB
26 KB 52ms
52ms Stylesheet
text/css 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/css/style_2s.min.css?ver=1654079379
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f108e1d5678eb11a3af690b9aca312a485fa5315292dafdfdc23968ab1cf433

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Jun 2022 10:29:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1348616
etag: W/"198b5-5e0605d0a6d80-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jzEs0pSiexP%2FXEkqD3vnELBMwM%2BUBrueY7u3s9tzs8WQ5HSEWsbbjMQuM9EsqNUbTsi4wJYHi93v24lvGte0iXe8pRksiyc3FwwfZefxp567hz%2FKMM9AXHA03%2FLR20pjrtjKKoSf7Nk3ys%2FbZIaZ"}],"group":"cf-nel","max_age":604800}
x-varnish: 359746013
content-type: text/css
cache-control: max-age=15854400, public
cf-ray: 75db1b031e709237-FRA

GET
H2 200 jquery-3.5.1.min.js Show response
www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/ 87 KB
32 KB 60ms
60ms Script
application/javascript 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/esolaskit/js/min/jquery-3.5.1.min.js
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 May 2020 23:02:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7398769
etag: W/"15d84-5a4da870aa1c0-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rRq5m1I39LEynPK2tJJTSB5JRolePf9gLKkseKTZKFVJ9pPgv8oGvLFbh7SFuBilUtjNdzplXzWOGxeIvlTW2wQViblKLTFBWdIblHwY8eDrQNeAtW2esajAlLAbiT3BXPDSzoLQvt16Ek9iGY8i"}],"group":"cf-nel","max_age":604800}
x-varnish: 313544609 313295003
content-type: application/javascript
cache-control: max-age=15854400, public
cf-ray: 75db1b031e729237-FRA

GET
H2 200 esol-email.js Show response
www.2-spyware.com/news/wp-content/plugins/esol-email/public/js/ 2 KB
1 KB 69ms
68ms Script
application/javascript 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/plugins/esol-email/public/js/esol-email.js?ver=1.0.1
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16c7f1315f4fe5316debec23145568a7841f2c52943f806985ee6a5cc9f20f9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7398769
cf-polished: origSize=3794
cf-bgj: minify
last-modified: Wed, 12 Feb 2020 09:59:55 GMT
server: cloudflare
etag: W/"ed2-59e5e08c81cc0-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MzVhI71wfgBWqTqhdD%2BjfS4kT6w%2BZwmBm%2BtqG6KwzcmMtkls7%2BxmX2445xCqKVEj%2FR32af5nRZ6IfWwTtMs9IDYuUurIwyu15RclECJkzaVBkSF6CKcUvFr%2B7PWbhiJypa8OjjeIw1%2BvbmIv3gOn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-varnish: 313544610 313295006
cache-control: max-age=15854400, public
cf-ray: 75db1b033ea39237-FRA

GET
H2 200 all.min.js Show response
www.2-spyware.com/news/wp-content/themes/AskIt/js/ 23 KB
7 KB 26ms
25ms Script
application/javascript 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/js/all.min.js?ver=1649410853
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 456afc2c22b317a8508cba95c384388993f911de600fe2b4bc1fdfc7129d3202

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Jun 2022 10:29:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3831866
etag: W/"5ab9-5e0605e5a1f00-gzip"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2FsyBdIG44i9kf2Ol0%2FLlVYRlbcmknUTy890mLnzsYzSbTjATFKdHFcTb2d10PHt%2BokGy3r3I0HHNYaJTQQeSAWgZ6QGLSuGjJDnfyTnLOORfz2JhxsR3Qo9AM%2FwP4LBlhNYRdf1TaFE5IF90s63"}],"group":"cf-nel","max_age":604800}
x-varnish: 354034093 354022510
content-type: application/javascript
cache-control: max-age=15854400, public
cf-ray: 75db1b033ea59237-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 320ms
38ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 21 Oct 2022 15:15:57 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 1614
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Fri, 21 Oct 2022 17:15:57 GMT

GET
H2 200 logo2x.png
www.2-spyware.com/news/wp-content/themes/AskIt/langs/2-spyware.com/ 6 KB
7 KB 26ms
25ms Image
image/png 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/themes/AskIt/langs/2-spyware.com/logo2x.png
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b29e71a8a2c4fe105520843c7a89104eef2e83629eae7587ab1668d75e515341

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 11612129
content-length: 6472
last-modified: Thu, 11 Jun 2020 12:55:56 GMT
server: cloudflare
etag: "1948-5a7ce7b392f00"
vary: User-Agent, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ByrO0wxAaAha03OucSjH7mfqU8dbYJLbH96AC9GTFwfOq83hvCXoBfHWDUI32U%2BGjGUJkv3T84sd9lBMZijameORkU3PCCw8avyfJesBD3mJJKuJDdKfF9SJWEvGKmT3%2BiAupMiA6cB3aVDZoJcp"}],"group":"cf-nel","max_age":604800}
x-varnish: 337116207
content-type: image/png
cache-control: max-age=15854400, public
accept-ranges: bytes
cf-ray: 75db1b034eaa9237-FRA

GET
H2 200 libexec-virus-mac-malware-installs-adware_en-400x267.jpg.webp
www.2-spyware.com/news/wp-content/uploads/virusai/ 7 KB
8 KB 487ms
465ms Image
image/webp 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/virusai/libexec-virus-mac-malware-installs-adware_en-400x267.jpg.webp
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc87d89a1cfb7a7921222677f5a23f588a8cb24a3a5b4d1bfc6b366122ef8552

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
cf-cache-status: MISS
last-modified: Thu, 30 Jul 2020 15:36:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "1d64-5abaa6fd70f3b"
vary: User-Agent, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DsCRMqsltP3LY59jL%2FoxihrvcI%2B1tXko6rPFpWrqlTxOEIaejM7CN4ee1f30nu2X5HxplecHIoCWEBOg6Lw1%2FVINzDhSr6yqE4Y3LVCRkgB8LBhjtMS1y2F2sZALuIYO18WpOuvcT8XOIgFNbhel"}],"group":"cf-nel","max_age":604800}
x-varnish: 362597116
content-type: image/webp
cache-control: max-age=15854400, public
accept-ranges: bytes
cf-ray: 75db1b036f169237-FRA
content-length: 7524

GET
DATA 200
OK truncated
/ 116 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 254c92a8c9718fae1cf0bde4bde5f96027df45fc72ac2b9e5497df220b6ce517

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e83163f4fc8379d2c40924e85256c1422bc97efa935845803aac39cc698554f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 116 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 974dc1308695cbc5c659b0bc59cd7893190f9849736338cfd335049ebf84885f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 213 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08fb2690e59c3d9c8792720208d53650c1e2d3620a34b92c8b909d9f5c600874

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 888 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e4d09d99c552a22d735e9914efd81d2f26ade9005154c04ee42470f88e39d5d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 visited-porn-sites-you-are-infected_en-300x169.jpg
www.2-spyware.com/news/wp-content/uploads/news/ 13 KB
13 KB 24ms
23ms Image
image/jpeg 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/news/visited-porn-sites-you-are-infected_en-300x169.jpg
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 883d9a29c0bd21f2e8472bce8248478330399b76c3a2aa8eb27c30c518eafa74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4163097
content-length: 12969
cf-bgj: h2pri
last-modified: Wed, 02 Jun 2021 07:20:06 GMT
server: cloudflare
etag: "32a9-5c3c349be379b"
vary: User-Agent, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rC0OLAQMKIgA%2BhOIqXtYG89LBhLBEnlRewpLI%2FxvXXkpLWE8L6k3Yk5EK0A6f6Dh8z%2FnqW%2Fd3sPq%2FC5lxEQEBMT59UUhNj8Ia2jc4KXNnW3NAP6GGTMXZicRUoZGQh6qYvuwwj%2BIgcNQkAoizJY1"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
x-varnish: 353261765
cache-control: max-age=15854400, public
accept-ranges: bytes
cf-ray: 75db1b0458719237-FRA

GET
H2 200 stay-home-stay-safe-use-vpn_en-300x169.jpg
www.2-spyware.com/news/wp-content/uploads/news/ 13 KB
14 KB 30ms
29ms Image
image/jpeg 2606:4700:20::681a:542
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.2-spyware.com/news/wp-content/uploads/news/stay-home-stay-safe-use-vpn_en-300x169.jpg
Requested by: Host: www.2-spyware.com
URL: https://www.2-spyware.com/remove-libexec-virus.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:542 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5c0bb759daea41dfbd90a739c37771c2711bd8851a3b68b0360ea7f2f871c4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/remove-libexec-virus.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 21 Oct 2022 15:42:51 GMT
via: 1.1 varnish
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7396514
content-length: 13613
cf-bgj: h2pri
last-modified: Tue, 31 Mar 2020 14:32:30 GMT
server: cloudflare
etag: "352d-5a227700c2d9a"
vary: User-Agent, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BuxXLOuuKONWt3Mb4aQX5uhwUs%2FxDZwH%2BtN2KFvwXZ%2BToFLSGjXGcVG3TosMk3yatc6kVA2j9Hdr%2BgzD9WJp5ALfXbakLtYXTiggsoVfiCdfVSFEXIMUxqMTXb1yZ9Bs422qqZuOlm1vDva2Bg9K"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
x-varnish: 313545303
cache-control: max-age=15854400, public
accept-ranges: bytes
cf-ray: 75db1b0458739237-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
209 B 50ms
46ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=107843370&t=pageview&_s=1&dl=https%3A%2F%2Fwww.2-spyware.com%2Fremove-libexec-virus.html&ul=en-us&de=UTF-8&dt=Remove%20Libexec%20virus%20(Virus%20Removal%20Guide)%20-%20Free%20Instructions&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=316047818&gjid=1085578664&cid=1863362883.1666366972&tid=UA-60636-1&_gid=2088681681.1666366972&_r=1&_slc=1&z=229811495

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.2-spyware.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 21 Oct 2022 15:42:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.2-spyware.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK count.php
www.hey.lt/ 471 B
1 KB 101ms
29ms Image
image/png 109.235.67.100
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hey.lt/count.php?id=spyware

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

109.235.67.100 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),

Reverse DNS

server.hey.lt

Software

Apache /

Resource Hash

f78d91d3117ad15d973ac545dfe28dcc60289af8d6a0fbb3093488d1961119bf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.2-spyware.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 21 Oct 2022 15:42:51 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Server: Apache
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
P3P: CP="NID"
Content-Type: image/png
Cache-Control: max-age=604800
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Connection: close
Content-Length: 471
Expires: Thu, 1 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.2-spyware.com/	1970-01-20 16:28:46	Name: _ga Value: GA1.2.1863362883.1666366972
.2-spyware.com/	1970-01-20 06:54:13	Name: _gid Value: GA1.2.2088681681.1666366972
.2-spyware.com/	1970-01-20 06:52:47	Name: _gat Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.2-spyware.com
www.google-analytics.com
www.hey.lt
109.235.67.100
2606:4700:20::681a:542
2a00:1450:4001:82b::200e
08fb2690e59c3d9c8792720208d53650c1e2d3620a34b92c8b909d9f5c600874
1022620da2db546471ebebd0914aac55e6133099cd1be4aee62a29c14ef747b0
16c7f1315f4fe5316debec23145568a7841f2c52943f806985ee6a5cc9f20f9f
254c92a8c9718fae1cf0bde4bde5f96027df45fc72ac2b9e5497df220b6ce517
3e83163f4fc8379d2c40924e85256c1422bc97efa935845803aac39cc698554f
456afc2c22b317a8508cba95c384388993f911de600fe2b4bc1fdfc7129d3202
6e4d09d99c552a22d735e9914efd81d2f26ade9005154c04ee42470f88e39d5d
7f108e1d5678eb11a3af690b9aca312a485fa5315292dafdfdc23968ab1cf433
883d9a29c0bd21f2e8472bce8248478330399b76c3a2aa8eb27c30c518eafa74
974dc1308695cbc5c659b0bc59cd7893190f9849736338cfd335049ebf84885f
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
b29e71a8a2c4fe105520843c7a89104eef2e83629eae7587ab1668d75e515341
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
c5c0bb759daea41dfbd90a739c37771c2711bd8851a3b68b0360ea7f2f871c4e
f78d91d3117ad15d973ac545dfe28dcc60289af8d6a0fbb3093488d1961119bf
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc87d89a1cfb7a7921222677f5a23f588a8cb24a3a5b4d1bfc6b366122ef8552

www.2-spyware.com Open in urlscan Pro 2606:4700:20::681a:542 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

159 kBTransfer

432 kBSize

3 Cookies

23 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

39 JavaScript Global Variables

3 Cookies

Indicators

www.2-spyware.com Open in urlscan Pro
2606:4700:20::681a:542 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

159 kB
Transfer

432 kB
Size

3
Cookies

12 HTTP transactions
5 data transactions