![](/screenshots/ce42d8f2-0666-4f09-ae6e-12a8afe3c485.png)
77.105.160.40
Open in
urlscan Pro
77.105.160.40
Public Scan
Effective URL: https://77.105.160.40/login.php
Submission Tags: c2 malware atlantida Search All
Submission: On July 15 via api from US — Scanned from DE
Summary
TLS certificate: Issued by localhost on November 10th 2009. Valid for: 10 years.
This is the only time 77.105.160.40 was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 77.105.160.40 77.105.160.40 | 216309 (EVILEMPIR...) (EVILEMPIRE-AS) | |
2 | 2606:4700::68... 2606:4700::6812:ba1f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
1 | 199.232.196.193 199.232.196.193 | 54113 (FASTLY) (FASTLY) | |
6 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 410 |
46 KB |
1 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7108 |
435 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
24 KB |
6 | 3 |
Domain | Requested by | |
---|---|---|
2 | cdn.jsdelivr.net |
77.105.160.40
|
1 | i.imgur.com |
77.105.160.40
|
1 | code.jquery.com |
77.105.160.40
|
6 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
localhost localhost |
2009-11-10 - 2019-11-08 |
10 years | crt.sh |
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA |
2024-05-04 - 2025-05-04 |
a year | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-15 - 2025-02-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://77.105.160.40/login.php
Frame ID: 0FF285F92A314A44CBE78B541A4B07C6
Requests: 6 HTTP requests in this frame
Screenshot
![](/screenshots/ce42d8f2-0666-4f09-ae6e-12a8afe3c485.png)
Page Title
AtlantidaPage URL History Show full URLs
-
http://77.105.160.40/login.php
HTTP 307
https://77.105.160.40/login.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://77.105.160.40/login.php
HTTP 307
https://77.105.160.40/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
77.105.160.40/ Redirect Chain
|
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.slim.min.js
code.jquery.com/ |
71 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GY7HXsD.jpg
i.imgur.com/ |
434 KB 435 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
77.105.160.40/ |
300 B 540 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
i.imgur.com
199.232.196.193
2606:4700::6812:ba1f
2a04:4e42:200::649
77.105.160.40
2ccb8eef35ba330dbc17031936bba846d9ef2721b1fe45f1ca600e02bc0c904d
3bc015841633f6b270050786d54c2e528a9f34968953b4a28abed3012e765d53
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
ddc68b598b492d65ccd4779d0a3027e2355d38d386fbbcebe985d0fa5b1c39c1
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194