www.wicar.org Open in urlscan Pro
199.34.228.69  Public Scan

42 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://malware.wicar.org/ Page URL
2. https://www.wicar.org/test-malware.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response malware.wicar.org/	334 B 582 B	713ms 202ms	Document text/html	2607:ff18:80::615 GRIDFURY-AS
General Check archive.org Show headers Download Go to Full URL http://malware.wicar.org/ Protocol HTTP/1.1 Server 2607:ff18:80::615 , United States, ASN40630 (GRIDFURY-AS, US), Reverse DNS Software Apache / Resource Hash 2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 242 Content-Type text/html; charset=UTF-8 Date Mon, 17 Apr 2023 17:07:00 GMT ETag "14e-570a1fa2dc79d" Keep-Alive timeout=5, max=100 Last-Modified Tue, 10 Jul 2018 09:44:32 GMT Server Apache Vary Accept-Encoding Via e1
GET H/1.1	200 OK	Primary Request test-malware.html Show response www.wicar.org/	36 KB 8 KB	1143ms 201ms	Document text/html	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/test-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software Apache / Resource Hash 64a7d6c6a12ce13564c18aadddd9bfca2331f1b26cb2cb6fb8acdfa69cfc3f88 Request headers Referer http://malware.wicar.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control private Connection Keep-Alive Content-Encoding gzip Content-Length 7914 Content-Type text/html; charset=UTF-8 Date Mon, 17 Apr 2023 17:07:01 GMT ETag W/"02e1a35d17bb166a429d48299488f9df-gzip" Keep-Alive timeout=10, max=52 Server Apache Vary X-W-SSL,Accept-Encoding,User-Agent X-Host blu67.sf2p.intern.weebly.net X-UA-Compatible IE=edge,chrome=1
GET H2	200	sites.css cdn2.editmysite.com/css/	210 KB 29 KB	56ms 9ms	Stylesheet text/css	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/css/sites.css?buildTime=1680733730 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 004224d90390c7cd683c2b1911c8ff02da3c2f1dd84db133333f3d704adb7355 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 30, 614 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1017336 x-cache HIT, HIT x-host grn48.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 29746 x-served-by cache-sjc10065-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 05 Apr 2023 22:11:00 GMT server nginx x-timer S1681751222.779338,VS0,VE0 etag W/"642df1f4-347ac" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 19 Apr 2023 22:31:25 GMT
GET H2	200	fancybox.css cdn2.editmysite.com/css/old/	4 KB 1 KB	74ms 27ms	Stylesheet text/css	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/css/old/fancybox.css?1234 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 73, 856 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1000963 x-cache HIT, HIT x-host blu63.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 1218 x-served-by cache-sjc10077-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 05 Apr 2023 22:11:06 GMT server nginx x-timer S1681751222.780571,VS0,VE0 etag "642df1fa-f47" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Thu, 20 Apr 2023 03:04:19 GMT
GET H/1.1	200 OK	main_style.css www.wicar.org/files/	13 KB 3 KB	161ms 159ms	Stylesheet text/css	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/files/main_style.css?1680750716 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software nginx / Resource Hash 8e73a9976890dc39b814f08a593d19fea29eafde8bd6518bef62cf08402a879a Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/test-malware.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers Date Mon, 17 Apr 2023 17:07:01 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Access-Control-Allow-Methods GET, POST, DELETE, OPTIONS Content-Type text/css Vary Accept-Encoding Access-Control-Allow-Origin * X-Host blu14.sf2p.intern.weebly.net Connection keep-alive Access-Control-Allow-Headers Origin, Authorization, Content-Type
GET H2	200	font.css cdn2.editmysite.com/fonts/Open_Sans/	3 KB 562 B	71ms 24ms	Stylesheet text/css	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash f435c7332d3136b59a056b0c7e23926256b057ac7598568a8120f070c2ec30d4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 2, 5203 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 622700 x-cache HIT, HIT x-host blu49.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 367 x-served-by cache-sjc10081-SJC, cache-hhn-etou8220050-HHN last-modified Fri, 07 Apr 2023 18:00:18 GMT server nginx x-timer S1681751222.780343,VS0,VE0 etag "64305a32-a2a" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Mon, 24 Apr 2023 12:08:41 GMT
GET H2	200	jquery-1.8.3.min.js Show response cdn2.editmysite.com/js/	91 KB 33 KB	71ms 25ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/jquery-1.8.3.min.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 7, 37236 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1101526 x-cache HIT, HIT x-host blu31.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33467 x-served-by cache-sjc10032-SJC, cache-hhn-etou8220050-HHN last-modified Mon, 03 Apr 2023 12:56:59 GMT server nginx x-timer S1681751222.780289,VS0,VE0 etag "642acd1b-16dc4" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 18 Apr 2023 23:08:15 GMT
GET H2	200	stl.js Show response cdn2.editmysite.com/js/lang/en/	178 KB 33 KB	71ms 25ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1234& Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9f17849278ea3971ca67fe008881f2e042351b3b0f279c38efde4f4b02ab8f75 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 40, 2 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 973254 x-cache HIT, HIT x-host grn132.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33051 x-served-by cache-sjc10047-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 05 Apr 2023 22:09:45 GMT server nginx x-timer S1681751222.780272,VS0,VE0 etag "642df1a9-2c7eb" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Thu, 20 Apr 2023 10:46:07 GMT
GET H2	200	main.js Show response cdn2.editmysite.com/js/site/	466 KB 143 KB	79ms 33ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/site/main.js?buildTime=1680733730 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ba97504b136b447bea2ecc59111ba5a63200d2662f92936d0f7c206492b989d8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 34, 1 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1017335 x-cache HIT, HIT x-host grn119.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 146400 x-served-by cache-sjc10071-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 05 Apr 2023 22:11:24 GMT server nginx x-timer S1681751222.780257,VS0,VE1 etag "642df20c-74804" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 19 Apr 2023 22:31:26 GMT
GET H2	200	stl.js Show response cdn2.editmysite.com/js/lang/en/	178 KB 32 KB	56ms 10ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1680733730& Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 9f17849278ea3971ca67fe008881f2e042351b3b0f279c38efde4f4b02ab8f75 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 79, 6 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1017337 x-cache HIT, HIT x-host grn48.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 33051 x-served-by cache-sjc10079-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 05 Apr 2023 22:09:45 GMT server nginx x-timer S1681751222.780230,VS0,VE0 etag "642df1a9-2c7eb" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 19 Apr 2023 22:31:25 GMT
GET H2	200	main-customer-accounts-site.js Show response cdn2.editmysite.com/js/site/	521 KB 156 KB	81ms 35ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1680733730 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 33b9a35175b719d6b3e03ba1d8209eebfae25717f3cee3935ceb81d0c0151ff5 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 12, 1 date Mon, 17 Apr 2023 17:07:01 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1017334 x-cache HIT, HIT x-host grn119.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 159030 x-served-by cache-sjc10083-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 05 Apr 2023 22:11:24 GMT server nginx x-timer S1681751222.780166,VS0,VE10 etag "642df20c-825b0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 19 Apr 2023 22:31:27 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	112 KB 44 KB	59ms 22ms	Script application/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 765b6bc307e6fcfcb70ad64d08fecd48b947cf09ca913a3d1fac937274e84bb5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 17:07:01 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 44605 x-xss-protection 0 last-modified Mon, 17 Apr 2023 16:05:35 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 17 Apr 2023 17:07:01 GMT
GET		buttons.js w.sharethis.com/button/	0 0
GET H/1.1	200 OK	bullet.png www.wicar.org/files/theme/	1 KB 2 KB	163ms 163ms	Image image/png	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.wicar.org/files/theme/bullet.png?1680750716 Requested by Host: www.wicar.org URL: https://www.wicar.org/files/main_style.css?1680750716 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software nginx / Resource Hash e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/files/main_style.css?1680750716 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers Date Mon, 17 Apr 2023 17:07:02 GMT X-Storage-Object e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0 Last-Modified Tue, 27 Oct 2020 15:57:36 GMT Server nginx x-amz-request-id tx000000000000001597d05-0061a79988-a9f4046-sfo1 ETag "ade925929d3c8bef998838a29bf90aae" Content-Type image/png; charset=binary x-rgw-object-type Normal X-Storage-Bucket ze459 X-Host blu23.sf2p.intern.weebly.net Connection keep-alive Accept-Ranges bytes Content-Length 1156
GET H3	200	regular.woff2 cdn2.editmysite.com/fonts/Open_Sans/	16 KB 17 KB	33ms 10ms	Font font/woff2	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/regular.woff2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Protocol H3 Security QUIC, , AES_256_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681 Request headers Referer https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Origin https://www.wicar.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 2299, 208 date Mon, 17 Apr 2023 17:07:02 GMT via 1.1 varnish, 1.1 varnish age 1060575 x-cache HIT, HIT x-host grn112.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 16740 x-served-by cache-sjc10052-SJC, cache-hhn-etou8220026-HHN last-modified Fri, 31 Mar 2023 22:53:25 GMT server nginx x-timer S1681751222.056611,VS0,VE0 etag "64276465-4164" content-type font/woff2 access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Wed, 19 Apr 2023 10:30:46 GMT
GET H3	200	bold.woff2 cdn2.editmysite.com/fonts/Open_Sans/	16 KB 16 KB	32ms 9ms	Font font/woff2	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/fonts/Open_Sans/bold.woff2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Protocol H3 Security QUIC, , AES_256_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72 Request headers Referer https://cdn2.editmysite.com/fonts/Open_Sans/font.css?2 Origin https://www.wicar.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 12, 45 date Mon, 17 Apr 2023 17:07:02 GMT via 1.1 varnish, 1.1 varnish age 545758 x-cache HIT, HIT x-host blu154.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 16372 x-served-by cache-sjc10053-SJC, cache-hhn-etou8220026-HHN last-modified Fri, 07 Apr 2023 18:00:18 GMT server nginx x-timer S1681751222.056387,VS0,VE0 etag "64305a32-3ff4" content-type font/woff2 access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Tue, 25 Apr 2023 09:31:04 GMT
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	105ms 18ms	Script text/javascript	2a00:1450:4001:801::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 17 Apr 2023 16:11:05 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 3357 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17168 expires Mon, 17 Apr 2023 18:11:05 GMT
GET H2	200	snowday262.js Show response cdn2.editmysite.com/js/wsnbn/	73 KB 25 KB	11ms 8ms	Script application/javascript	2a04:4e42::302 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn2.editmysite.com/js/wsnbn/snowday262.js Requested by Host: www.wicar.org URL: https://www.wicar.org/test-malware.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::302 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers x-cache-hits 18, 7423 date Mon, 17 Apr 2023 17:07:02 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 376098 x-cache HIT, HIT x-host grn116.sf2p.intern.weebly.net alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 25752 x-served-by cache-sjc10061-SJC, cache-hhn-etou8220050-HHN last-modified Wed, 12 Apr 2023 20:20:19 GMT server nginx x-timer S1681751222.056726,VS0,VE0 etag "64371283-124fe" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 accept-ranges bytes expires Thu, 27 Apr 2023 08:38:43 GMT
POST H/1.1	200 OK	/ Show response www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/	348 B 628 B	246ms 245ms	XHR application/json	199.34.228.69 WEEBLY
General Check archive.org Show headers Download Go to Full URL https://www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails] Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/js/jquery-1.8.3.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 199.34.228.69 , United States, ASN27647 (WEEBLY, US), Reverse DNS pages-custom-21.weebly.com Software Apache / Resource Hash adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.wicar.org/test-malware.html X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers Date Mon, 17 Apr 2023 17:07:02 GMT Server Apache Vary X-W-SSL,User-Agent Content-Type application/json X-Host blu94.sf2p.intern.weebly.net Connection Keep-Alive Keep-Alive timeout=10, max=40 Content-Length 348 X-UA-Compatible IE=edge,chrome=1
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	38ms 7ms	Script text/javascript	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-5568574-11 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.wicar.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Mon, 17 Apr 2023 16:11:32 GMT last-modified Tue, 10 Jan 2023 21:29:14 GMT server Golfe2 age 3330 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20085 expires Mon, 17 Apr 2023 18:11:32 GMT
POST H2	200	tp2 Show response ec.editmysite.com/com.snowplowanalytics.snowplow/	2 B 319 B	531ms 176ms	XHR text/plain	52.25.145.219 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 Requested by Host: cdn2.editmysite.com URL: https://cdn2.editmysite.com/js/wsnbn/snowday262.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.25.145.219 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-25-145-219.us-west-2.compute.amazonaws.com Software nginx / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://www.wicar.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers access-control-allow-origin https://www.wicar.org date Mon, 17 Apr 2023 17:07:03 GMT access-control-allow-credentials true content-type text/plain; charset=UTF-8 server nginx content-length 2 p3p policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
OPTIONS H2	200	tp2 ec.editmysite.com/com.snowplowanalytics.snowplow/	0 0	569ms 175ms	Preflight	52.25.145.219 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.25.145.219 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-25-145-219.us-west-2.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.wicar.org Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type, SP-Anonymous access-control-allow-origin https://www.wicar.org access-control-max-age 600 content-length 0 date Mon, 17 Apr 2023 17:07:02 GMT server nginx
POST H2	200	collect Show response www.google-analytics.com/j/	1 B 205 B	16ms 15ms	XHR text/plain	2a00:1450:4001:830::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j99&a=773710209&t=pageview&_s=1&dl=https%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&dr=http%3A%2F%2Fmalware.wicar.org%2F&ul=en-us&de=UTF-8&dt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1534873697&gjid=181997823&cid=682625254.1681751222&tid=UA-5568574-11&_gid=1178169205.1681751222&_r=1&gtm=457e34c0&jsscut=1&z=896527926 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.wicar.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 17 Apr 2023 17:07:02 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.wicar.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

w.sharethis.com

URL

http://w.sharethis.com/button/buttons.js

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| STATIC_BASE string| ASSETS_BASE string| STYLE_PREFIX function| $ function| jQuery object| Weebly object| _W function| publishedWBJP string| RECAPTCHA_PUBLIC_KEY string| INVISIBLE_RECAPTCHA_PUBLIC_KEY function| _ object| Mustache object| jQBrowser function| PlatformElement function| whenThemeCSSLoaded function| isThemeCSSLoaded function| blogCommentDisplayForm object| YTPlayer object| VimeoPlayer function| Sd function| Rd boolean| Cd function| videojs function| _V_ object| jsonrpc function| getCartCount function| getCartNavElement function| reportCartNavElement function| initPublishedFlyoutMenus boolean| flyoutMenusRefreshable function| initEditorFlyoutMenus function| refreshNavCondense boolean| disableFlyouts function| FlyoutMenu function| objectify object| mejs function| MediaElement function| MediaElementPlayer function| require function| platformElementRequire function| initCustomerAccountsModels object| initEvt string| com_currentSite string| com_userID function| initFlyouts boolean| switchTo5x undefined| windowHref object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| gtag object| dataLayer object| _gaq object| r function| snPlObR string| s object| regEx object| drSegmentsTag undefined| segmentData object| GlobalSnowplowNamespace function| snowday object| google_tag_manager object| google_tag_data object| jQuery183049437001428947647 boolean| lightboxLoaded object| navFlyoutMenu function| refreshPublishedFlyoutMenus string| GoogleAnalyticsObject function| ga object| Snowplow object| gaplugins object| gaGlobal object| gaData object| _gat

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.www.wicar.org/	1969-12-31 23:59:59	Name: is_mobile Value: 0
			www.wicar.org/	1970-01-20 11:29:20	Name: language Value: de_DE
			.wicar.org/	1970-01-20 11:09:13	Name: _snow_ses.ae07 Value: *
			.wicar.org/	1970-01-20 20:45:11	Name: _snow_id.ae07 Value: 6cd3a732-3adc-40e7-bef5-1a8f3fc011c7.1681751222.1.1681751222.1681751222.b250dd14-2306-4103-9ea5-dfff4e803f55
			.wicar.org/	1970-01-20 20:45:11	Name: _ga Value: GA1.2.682625254.1681751222
			.wicar.org/	1970-01-20 11:10:37	Name: _gid Value: GA1.2.1178169205.1681751222
			.wicar.org/	1970-01-20 11:09:11	Name: _gat_gtag_UA_5568574_11 Value: 1
			ec.editmysite.com/	1970-01-20 19:54:47	Name: sp Value: 712063a3-89e8-47bf-b918-64c34ab1e507

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.wicar.org/test-malware.html Message: Mixed Content: The page at 'https://www.wicar.org/test-malware.html' was loaded over HTTPS, but requested an insecure script 'http://w.sharethis.com/button/buttons.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn2.editmysite.com
ec.editmysite.com
malware.wicar.org
ssl.google-analytics.com
w.sharethis.com
www.google-analytics.com
www.googletagmanager.com
www.wicar.org
w.sharethis.com
199.34.228.69
2607:ff18:80::615
2a00:1450:4001:801::2008
2a00:1450:4001:812::2008
2a00:1450:4001:830::200e
2a04:4e42::302
52.25.145.219
004224d90390c7cd683c2b1911c8ff02da3c2f1dd84db133333f3d704adb7355
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be
33b9a35175b719d6b3e03ba1d8209eebfae25717f3cee3935ceb81d0c0151ff5
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3
64a7d6c6a12ce13564c18aadddd9bfca2331f1b26cb2cb6fb8acdfa69cfc3f88
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
765b6bc307e6fcfcb70ad64d08fecd48b947cf09ca913a3d1fac937274e84bb5
865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a
8e73a9976890dc39b814f08a593d19fea29eafde8bd6518bef62cf08402a879a
9f17849278ea3971ca67fe008881f2e042351b3b0f279c38efde4f4b02ab8f75
adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
ba97504b136b447bea2ecc59111ba5a63200d2662f92936d0f7c206492b989d8
d1a17abb1a999842fe425e1a4ace9d90f9c18f3595c21a63d89f0611b90cfd72
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0
f435c7332d3136b59a056b0c7e23926256b057ac7598568a8120f070c2ec30d4