worms.thecybershadow.net

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2a01:4f9:2a:188b::1, located in Germany and belongs to HETZNER-AS, DE. The main domain is worms.thecybershadow.net.
TLS certificate: Issued by R3 on May 24th 2024. Valid for: 3 months.

This is the only time worms.thecybershadow.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 5	2a01:4f9:2a:1... 2a01:4f9:2a:188b::1	24940 (HETZNER-AS) (HETZNER-AS)
1 2	104.18.23.19 104.18.23.19	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

5 2a01:4f9:2a:188b::1 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

worms.thecybershadow.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.23.19 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.w3.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	thecybershadow.net 1 redirects worms.thecybershadow.net	31 KB
2	w3.org 1 redirects www.w3.org — Cisco Umbrella Rank: 25275	2 KB
0	google-analytics.com Failed www.google-analytics.com Failed
6	3

	Domain	Requested by
5	worms.thecybershadow.net	1 redirects worms.thecybershadow.net
2	www.w3.org	1 redirects worms.thecybershadow.net
0	www.google-analytics.com Failed	worms.thecybershadow.net
6	3

This site contains links to these domains. Also see Links.

Domain
snoop.worms2d.info
validator.w3.org
wormnet.team17.com
worms.tom.ru
wormnet.steps.club
home.thecybershadow.net
wormnet.net
wn.staging.wormnet.net

Subject Issuer	Validity	Valid
worms.thecybershadow.net R3	`2024-05-24` - `2024-08-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://worms.thecybershadow.net/wormnet/
Frame ID: 61BBD0ABDDC1D4486AB8D40FE3A975FE
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WormNET server list

Page URL History Show full URLs

http://worms.thecybershadow.net/ HTTP 307
https://worms.thecybershadow.net/ HTTP 302
https://worms.thecybershadow.net/wormnet/ Page URL

Page Statistics

6
Requests

67 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

33 kB
Transfer

31 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://snoop.worms2d.info/
Title: Web Snooper

Search URL Search Domain Scan URL

URL: http://validator.w3.org/check?uri=referer

Search URL Search Domain Scan URL

URL: http://wormnet.team17.com/
Title: wormnet.team17.com

Search URL Search Domain Scan URL

URL: http://worms.tom.ru/
Title: worms.tom.ru

Search URL Search Domain Scan URL

URL: http://wormnet.steps.club/
Title: wormnet.steps.club

Search URL Search Domain Scan URL

URL: http://home.thecybershadow.net/
Title: home.thecybershadow.net

Search URL Search Domain Scan URL

URL: http://wormnet.net/
Title: wormnet.net

Search URL Search Domain Scan URL

URL: http://wn.staging.wormnet.net/
Title: wn.staging.wormnet.net

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://worms.thecybershadow.net/ HTTP 307
https://worms.thecybershadow.net/ HTTP 302
https://worms.thecybershadow.net/wormnet/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://www.w3.org/Icons/valid-xhtml10.gif HTTP 301
https://www.w3.org/Icons/valid-xhtml10.png

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
worms.thecybershadow.net/wormnet/
Redirect Chain

http://worms.thecybershadow.net/
https://worms.thecybershadow.net/
https://worms.thecybershadow.net/wormnet/

9 KB
9 KB

35ms
35ms

Document
text/html

2a01:4f9:2a:188b::1
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://worms.thecybershadow.net/wormnet/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a01:4f9:2a:188b::1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) / PHP/7.0.33-0ubuntu0.16.04.16
Resource Hash: 0c56acdb7c9d83a530b83bc66b948b2e90b60bcd3fae3cda0f702922200bcce9

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Sun, 09 Jun 2024 17:38:47 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.29 (Ubuntu)
Transfer-Encoding: chunked
X-Powered-By: PHP/7.0.33-0ubuntu0.16.04.16

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sun, 09 Jun 2024 17:38:47 GMT
Keep-Alive: timeout=5, max=100
Location: wormnet/
Server: Apache/2.4.29 (Ubuntu)
X-Powered-By: PHP/7.0.33-0ubuntu0.16.04.16

GET
H/1.1 200
OK mywormnet.gif
worms.thecybershadow.net/wormnet/ 6 KB
6 KB 32ms
31ms Image
image/gif 2a01:4f9:2a:188b::1
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://worms.thecybershadow.net/wormnet/mywormnet.gif
Requested by: Host: worms.thecybershadow.net
URL: https://worms.thecybershadow.net/wormnet/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a01:4f9:2a:188b::1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: f0dc08b064570ea46d8d1457eca350a749f2550979ff97d0f5d9524afb52349d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://worms.thecybershadow.net/wormnet/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 09 Jun 2024 17:38:47 GMT
Last-Modified: Thu, 21 Sep 2006 22:00:00 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "1645-41dfdd8519800"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5701

GET
H3

200

valid-xhtml10.png
www.w3.org/Icons/
Redirect Chain

https://www.w3.org/Icons/valid-xhtml10.gif
https://www.w3.org/Icons/valid-xhtml10.png

1 KB
2 KB

69ms
69ms

Image
image/png

104.18.23.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.w3.org/Icons/valid-xhtml10.png

Requested by

Host: worms.thecybershadow.net
URL: https://worms.thecybershadow.net/wormnet/

Protocol

H3

Server

104.18.23.19 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c944a6759cc99cf47597586621ffa02c7602feeaa0d047e55ff3914ff1656bdd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://cms.w3.org/ https://cms-dev.w3.org/; upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubdomains; preload

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://worms.thecybershadow.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date: Sun, 09 Jun 2024 17:38:47 GMT
content-security-policy: frame-ancestors 'self' https://cms.w3.org/ https://cms-dev.w3.org/; upgrade-insecure-requests
strict-transport-security: max-age=15552000; includeSubdomains; preload
cf-cache-status: HIT
x-backend: www-mirrors
age: 292210
cf-polished: origSize=1882
alt-svc: h3=":443"; ma=86400
content-length: 1339
x-request-id: 88b9b4411d3abaf3
cf-bgj: imgq:100,h2pri
last-modified: Fri, 14 Jul 2006 01:43:32 GMT
server: cloudflare
etag: "75a-41880ced83900"
vary: Accept-Encoding
content-type: image/png; qs=0.7
cache-control: public, max-age=604800, s-maxage=604800
accept-ranges: bytes
cf-ray: 8912e5b73ca710eb-CPH
expires: Fri, 05 Jul 2024 21:52:31 GMT

Redirect headers

date: Sun, 09 Jun 2024 17:38:47 GMT
strict-transport-security: max-age=15552000; includeSubdomains; preload
content-security-policy: frame-ancestors 'self' https://cms.w3.org/ https://cms-dev.w3.org/; upgrade-insecure-requests
cf-cache-status: BYPASS
x-backend: www-mirrors
server: cloudflare
vary: Accept-Encoding
content-type: text/html; charset=iso-8859-1
location: https://www.w3.org/Icons/valid-xhtml10.png
cache-control: max-age=21600
cf-ray: 8912e5b62b5c10eb-CPH
alt-svc: h3=":443"; ma=86400
x-request-id: 8912e5b62b5c10eb
expires: Sun, 09 Jun 2024 23:38:47 GMT

GET urchin.js
www.google-analytics.com/ 0
0

GET
H/1.1 200
OK walogobg.png
worms.thecybershadow.net/ 14 KB
14 KB 53ms
30ms Image
image/png 2a01:4f9:2a:188b::1
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://worms.thecybershadow.net/walogobg.png
Requested by: Host: worms.thecybershadow.net
URL: https://worms.thecybershadow.net/wormnet/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a01:4f9:2a:188b::1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: ec6575e3c42ae5165be4daab8b3d2caa33319a1e60f3f68ba0c34dccde9719ab

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://worms.thecybershadow.net/wormnet/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 09 Jun 2024 17:38:47 GMT
Last-Modified: Wed, 27 Sep 2006 22:00:00 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "3784-41e768b5dd800"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 14212

GET
H/1.1 200
OK favicon.ico
worms.thecybershadow.net/ 1 KB
2 KB 32ms
32ms Other
image/vnd.microsoft.icon 2a01:4f9:2a:188b::1
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://worms.thecybershadow.net/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a01:4f9:2a:188b::1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: db44672d995ea39a237cd354934dc5f1ff70b5a642b2dedec71e9c074c7a3e5d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://worms.thecybershadow.net/wormnet/
Accept-Language: fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 09 Jun 2024 17:38:47 GMT
Last-Modified: Sat, 09 Jan 2010 23:36:02 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "57e-47cc3c460fc80"
Content-Type: image/vnd.microsoft.icon
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 1406

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google-analytics.com
URL: http://www.google-analytics.com/urchin.js

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.w3.org/	1970-01-20 21:12:36	Name: __cf_bm Value: CHwTSlSRF_BEtmStVuWdoiIEkC9swzaQ6bV0g0ko5uU-1717954727-1.0.1.1-JISQcWM2fnl_3V1e.UIj7sbIYBuM_79LmH5_KMWC2sKzIkgsgRQRClzTNSyCCdCCBXyanNVJaH_Bvs8cxn6Wzg

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://worms.thecybershadow.net/wormnet/ Message: Mixed Content: The page at 'https://worms.thecybershadow.net/wormnet/' was loaded over HTTPS, but requested an insecure element 'http://www.w3.org/Icons/valid-xhtml10.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://worms.thecybershadow.net/wormnet/(Line 213) Message: Mixed Content: The page at 'https://worms.thecybershadow.net/wormnet/' was loaded over HTTPS, but requested an insecure element 'http://www.w3.org/Icons/valid-xhtml10.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://worms.thecybershadow.net/wormnet/ Message: Mixed Content: The page at 'https://worms.thecybershadow.net/wormnet/' was loaded over HTTPS, but requested an insecure script 'http://www.google-analytics.com/urchin.js'. This request has been blocked; the content must be served over HTTPS.
other	warning	URL: https://worms.thecybershadow.net/wormnet/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://worms.thecybershadow.net/wormnet/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

worms.thecybershadow.net
www.google-analytics.com
www.w3.org
www.google-analytics.com
104.18.23.19
2a01:4f9:2a:188b::1
0c56acdb7c9d83a530b83bc66b948b2e90b60bcd3fae3cda0f702922200bcce9
c944a6759cc99cf47597586621ffa02c7602feeaa0d047e55ff3914ff1656bdd
db44672d995ea39a237cd354934dc5f1ff70b5a642b2dedec71e9c074c7a3e5d
ec6575e3c42ae5165be4daab8b3d2caa33319a1e60f3f68ba0c34dccde9719ab
f0dc08b064570ea46d8d1457eca350a749f2550979ff97d0f5d9524afb52349d

worms.thecybershadow.net Open in urlscan Pro 2a01:4f9:2a:188b::1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

67 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

33 kBTransfer

31 kBSize

1 Cookies

8 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

1 Cookies

5 Console Messages

Indicators

worms.thecybershadow.net Open in urlscan Pro
2a01:4f9:2a:188b::1 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

33 kB
Transfer

31 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions