URL:
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php 6yr old
Submission Tags: c2 malware kpot Search All
Submission: On September 01 via api (September 1st 2020, 4:47:04 am UTC) from US

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 78.142.29.185, located in Bulgaria and belongs to VERDINA, BZ. The main domain is www.depressedpenguin.com. 6yr old
This is the only time www.depressedpenguin.com was scanned on urlscan.io!

Domain & IP information

IP Address AS Autonomous System
1 78.142.29.185 78.142.29.185 201133 (VERDINA) (VERDINA)
2 2001:4de0:ac1... 2001:4de0:ac19::1:b:3b 20446 (HIGHWINDS3) (HIGHWINDS3)
1 2001:4de0:ac1... 2001:4de0:ac19::1:b:1a 20446 (HIGHWINDS3) (HIGHWINDS3)
1 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b 20446 (HIGHWINDS3) (HIGHWINDS3)
1 2a04:4e42:3::621 2a04:4e42:3::621 54113 (FASTLY) (FASTLY)
6 5
Apex Domain
Subdomains
Transfer
3 bootstrapcdn.com
stackpath.bootstrapcdn.com 9yr old
maxcdn.bootstrapcdn.com 10yr old
45 KB
1 jsdelivr.net
cdn.jsdelivr.net 14yr old
8 KB
1 jquery.com
code.jquery.com 13yr old
30 KB
1 depressedpenguin.com
www.depressedpenguin.com 6yr old
1 KB
6 4
Domain Requested by
2 stackpath.bootstrapcdn.com www.depressedpenguin.com
1 cdn.jsdelivr.net www.depressedpenguin.com
1 code.jquery.com www.depressedpenguin.com
1 maxcdn.bootstrapcdn.com www.depressedpenguin.com
1 www.depressedpenguin.com
6 5

This site contains no links.

Subject Issuer Validity Valid
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA
2019-09-14 -
2020-10-13
1yr crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2yr crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2020-08-17 -
2021-04-17
8mo crt.sh

This page contains 1 frames:

Primary Page: http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Frame ID: B5629659F42DE91D2236FFC695718E9C
Requests: 6 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.


Detected technologies

(Programming languages)
Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

(UI frameworks)
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

(Web servers)
Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

(Font scripts)
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

83 %
HTTPS

80 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

85 kB
Transfer

356 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.

0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H/1.1
200
OK
Primary Request Cookie set login.php Show response
www.depressedpenguin.com/IuygdNHZT973IPcf/
2 KB
1 KB
157ms
89ms
Document
text/html
78.142.29.185
VERDINA
General
Full URL
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Protocol
HTTP/1.1
Server
78.142.29.185 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
dns.theonionhost.com
Software
LiteSpeed / PHP/7.2.33
Resource Hash
cb13695b4e81eb37d386fd065efc7b882716f075bce76a3b38bdd79e5c15f27c

Request headers

Host
www.depressedpenguin.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
X-Powered-By
PHP/7.2.33
Set-Cookie
PHPSESSID=afc882be045d2933856f7a9325c6677a; expires=Sun, 03-May-2071 10:04:08 GMT; Max-Age=1598937424; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Content-Type
text/html; charset=UTF-8
Content-Length
880
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Tue, 01 Sep 2020 04:47:04 GMT
Server
LiteSpeed
GET
H2
200
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/
157 KB
24 KB
27ms
10ms
Stylesheet
text/css
2001:4de0:ac19::1:b:3b
HIGHWINDS3
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Requested by
Host: www.depressedpenguin.com
URL: http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 01 Sep 2020 04:47:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 May 2020 17:29:51 GMT
status
200
etag
"1589304591"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
23841
GET
H2
200
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/
30 KB
7 KB
25ms
8ms
Stylesheet
text/css
2001:4de0:ac19::1:b:1a
HIGHWINDS3
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www.depressedpenguin.com
URL: http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 01 Sep 2020 04:47:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:35:20 GMT
status
200
etag
"1544639720"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
7050
GET
H2
200
jquery-3.5.1.min.js Show response
code.jquery.com/
87 KB
30 KB
26ms
8ms
Script
application/javascript
2001:4de0:ac19::1:b:1b
HIGHWINDS3
General
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: www.depressedpenguin.com
URL: http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 01 Sep 2020 04:47:04 GMT
content-encoding
gzip
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
nginx
status
200
etag
W/"5eb09f0f-15d84"
vary
Accept-Encoding
x-hw
1598935624.dop053.fr8.t,1598935624.cds209.fr8.hn,1598935624.cds142.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30879
GET
H2
200
popper.min.js Show response
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/
21 KB
8 KB
22ms
5ms
Script
application/javascript
2a04:4e42:3::621
FASTLY
General
Full URL
https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js
Requested by
Host: www.depressedpenguin.com
URL: http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
2520208
x-cache
HIT
status
200
content-length
7510
etag
W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
x-served-by
cache-fra19162-FRA
date
Tue, 01 Sep 2020 04:47:04 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
GET
H2
200
bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/
59 KB
15 KB
27ms
10ms
Script
text/javascript
2001:4de0:ac19::1:b:3b
HIGHWINDS3
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js
Requested by
Host: www.depressedpenguin.com
URL: http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://www.depressedpenguin.com/IuygdNHZT973IPcf/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 01 Sep 2020 04:47:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 May 2020 17:27:09 GMT
status
200
etag
"1589304429"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14885

Verdicts & Comments Add Verdict or Comment

5 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| Popper object| bootstrap

1 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
www.depressedpenguin.com/ 1970-02-07
00:17:53
Name: PHPSESSID
Value: afc882be045d2933856f7a9325c6677a