www.malware-traffic-analysis.net Open in urlscan Pro
199.201.110.204 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.malware-traffic-analysis.net/2017/04/19/index2.html
Effective URL:
https://www.malware-traffic-analysis.net/2017/04/19/index2.html
Submission: On January 09 via api (January 9th 2021, 8:00:54 am UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 199.201.110.204, located in Phoenix, United States and belongs to SSASN2, US. The main domain is www.malware-traffic-analysis.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 10th 2020. Valid for: a year.

This is the only time www.malware-traffic-analysis.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 10	199.201.110.204 199.201.110.204		20454 (SSASN2) (SSASN2)
9	1

10 199.201.110.204 (Phoenix, United States) 1 redirects

ASN20454 (SSASN2, US)
PTR: nc-ph-1926-75.web-hosting.com

www.malware-traffic-analysis.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	malware-traffic-analysis.net 1 redirects www.malware-traffic-analysis.net	1 MB
9	1

	Domain	Requested by
10	www.malware-traffic-analysis.net	1 redirects www.malware-traffic-analysis.net
9	1

This site contains no links.

Subject Issuer	Validity	Valid
malware-traffic-analysis.net Sectigo RSA Domain Validation Secure Server CA	`2020-10-10` - `2021-11-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.malware-traffic-analysis.net/2017/04/19/index2.html
Frame ID: B477C324D3E9A7D5A501BA420F87643A
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.malware-traffic-analysis.net/2017/04/19/index2.html HTTP 301
https://www.malware-traffic-analysis.net/2017/04/19/index2.html Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1270 kB
Transfer

2412 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.malware-traffic-analysis.net/2017/04/19/index2.html HTTP 301
https://www.malware-traffic-analysis.net/2017/04/19/index2.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index2.html Show response www.malware-traffic-analysis.net/2017/04/19/ Redirect Chain http://www.malware-traffic-analysis.net/2017/04/19/index2.html https://www.malware-traffic-analysis.net/2017/04/19/index2.html	11 KB 4 KB	460ms 153ms	Document text/html	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Full URL https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `3ce7dd1f36e8786b4ffec7ac69372f91b97f07bb576cd2d88d841e62d051e645` Request headers Host www.malware-traffic-analysis.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:19 GMT Server Apache/2.4.41 (Ubuntu) Last-Modified Wed, 19 Apr 2017 23:34:26 GMT ETag "2a4d-54d8d77038480-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 4087 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html Redirect headers Date Sat, 09 Jan 2021 08:00:19 GMT Server Apache/2.4.41 (Ubuntu) Location https://www.malware-traffic-analysis.net/2017/04/19/index2.html Content-Length 369 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	style.css www.malware-traffic-analysis.net/	2 KB 908 B	158ms 156ms	Stylesheet text/css	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Full URL https://www.malware-traffic-analysis.net/style.css Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:19 GMT Content-Encoding gzip Last-Modified Sun, 31 Dec 2017 02:01:06 GMT Server Apache/2.4.41 (Ubuntu) ETag "7d9-561993d117c80-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 573
GET H/1.1	200 OK	site-logo-01.gif www.malware-traffic-analysis.net/	13 KB 14 KB	310ms 152ms	Image image/gif	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/site-logo-01.gif Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:19 GMT Last-Modified Mon, 08 Aug 2016 00:35:11 GMT Server Apache/2.4.41 (Ubuntu) ETag "359b-5398496bd2dc0" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 13723
GET H/1.1	200 OK	2017-04-19-Dridex-malspam-image-01.jpg www.malware-traffic-analysis.net/2017/04/19/	880 KB 881 KB	456ms 152ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/19/2017-04-19-Dridex-malspam-image-01.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:20 GMT Last-Modified Wed, 19 Apr 2017 23:34:21 GMT Server Apache/2.4.41 (Ubuntu) ETag "dc1b1-54d8d76b73940" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 901553
GET H/1.1	200 OK	2017-04-19-Dridex-malspam-image-02.jpg www.malware-traffic-analysis.net/2017/04/19/	157 KB 158 KB	459ms 152ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/19/2017-04-19-Dridex-malspam-image-02.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `7bae96042bf872c29e96f6f8b6e5594875f9cf9f30ce217387570746ca0f70c3` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:20 GMT Last-Modified Wed, 19 Apr 2017 23:34:21 GMT Server Apache/2.4.41 (Ubuntu) ETag "27543-54d8d76b73940" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 161091
GET H/1.1	200 OK	2017-04-19-Dridex-malspam-image-03.jpg www.malware-traffic-analysis.net/2017/04/19/	72 KB 72 KB	462ms 152ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/19/2017-04-19-Dridex-malspam-image-03.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `3997adb249c62e8f1c19da2ce656ed61de8a67b842f9052fea6a8859bab49537` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:20 GMT Last-Modified Wed, 19 Apr 2017 23:34:21 GMT Server Apache/2.4.41 (Ubuntu) ETag "11ef3-54d8d76b73940" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 73459
GET H/1.1	200 OK	2017-04-19-Dridex-malspam-image-04.jpg www.malware-traffic-analysis.net/2017/04/19/	480 KB 0	463ms 153ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/19/2017-04-19-Dridex-malspam-image-04.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:20 GMT Last-Modified Wed, 19 Apr 2017 23:34:22 GMT Server Apache/2.4.41 (Ubuntu) ETag "818d1-54d8d76c67b80" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 530641
GET H/1.1	200 OK	2017-04-19-Dridex-malspam-image-05.jpg www.malware-traffic-analysis.net/2017/04/19/	141 KB 141 KB	310ms 152ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/19/2017-04-19-Dridex-malspam-image-05.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash `8f825e7ff98e46e030baf47f158ec51214c9caf8b0ac8168851009cf1e91e5ce` Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:20 GMT Last-Modified Wed, 19 Apr 2017 23:34:22 GMT Server Apache/2.4.41 (Ubuntu) ETag "2322e-54d8d76c67b80" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 143918
GET H/1.1	200 OK	2017-04-19-Dridex-malspam-image-06.jpg www.malware-traffic-analysis.net/2017/04/19/	656 KB 0	263ms 152ms	Image image/jpeg	199.201.110.204 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://www.malware-traffic-analysis.net/2017/04/19/2017-04-19-Dridex-malspam-image-06.jpg Requested by Host: www.malware-traffic-analysis.net URL: https://www.malware-traffic-analysis.net/2017/04/19/index2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.201.110.204 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS nc-ph-1926-75.web-hosting.com Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers Referer https://www.malware-traffic-analysis.net/2017/04/19/index2.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sat, 09 Jan 2021 08:00:20 GMT Last-Modified Wed, 19 Apr 2017 23:34:23 GMT Server Apache/2.4.41 (Ubuntu) ETag "a7a96-54d8d76d5bdc0" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 686742

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.malware-traffic-analysis.net
199.201.110.204
2e3dd8abdd469e2e1bc581cc553bbd48f739a876c7abbd002cc0710e32d2eade
3997adb249c62e8f1c19da2ce656ed61de8a67b842f9052fea6a8859bab49537
3ce7dd1f36e8786b4ffec7ac69372f91b97f07bb576cd2d88d841e62d051e645
45a4160923abff381f10116e66c511bd2a5ae199a4bbe7c24589c5ae75518cc2
7bae96042bf872c29e96f6f8b6e5594875f9cf9f30ce217387570746ca0f70c3
8f825e7ff98e46e030baf47f158ec51214c9caf8b0ac8168851009cf1e91e5ce

www.malware-traffic-analysis.net Open in urlscan Pro 199.201.110.204 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

1270 kBTransfer

2412 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

Indicators

www.malware-traffic-analysis.net Open in urlscan Pro
199.201.110.204 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1270 kB
Transfer

2412 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions