URL: https://malware.hetnieuweinstituut.nl/en
Submission: On July 01 via manual from US

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 27 HTTP transactions. The main IP is 31.3.101.87, located in Netherlands and belongs to XL-AS, NL. The main domain is malware.hetnieuweinstituut.nl.
TLS certificate: Issued by GeoTrust RSA CA 2018 on June 24th 2019. Valid for: 2 years.
This is the only time malware.hetnieuweinstituut.nl was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
25 31.3.101.87 35470 (XL-AS)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
27 3
Domain Requested by
25 malware.hetnieuweinstituut.nl malware.hetnieuweinstituut.nl
2 www.google-analytics.com 1 redirects malware.hetnieuweinstituut.nl
1 www.google.de malware.hetnieuweinstituut.nl
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
27 5
Subject Issuer Validity Valid
*.hetnieuweinstituut.nl
GeoTrust RSA CA 2018
2019-06-24 -
2021-09-22
2 years crt.sh
*.google-analytics.com
Google Internet Authority G3
2019-06-11 -
2019-09-03
3 months crt.sh
*.google.com
Google Internet Authority G3
2019-06-11 -
2019-09-03
3 months crt.sh

This page contains 1 frames:

Primary Page: https://malware.hetnieuweinstituut.nl/en
Frame ID: DCB4CB8FC7337D64404180A332F0DD59
Requests: 27 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • meta generator /^Drupal(?:\s([\d.]+))?/i
  • headers expires /19 Nov 1978/i

Overall confidence: 100%
Detected patterns
  • meta generator /^Drupal(?:\s([\d.]+))?/i
  • headers expires /19 Nov 1978/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

27
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

421 kB
Transfer

898 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25
  • https://www.google-analytics.com/r/collect?v=1&_v=j77&aip=1&a=1812247483&t=pageview&_s=1&dl=https%3A%2F%2Fmalware.hetnieuweinstituut.nl%2Fen&ul=en-us&de=UTF-8&dt=Malware%3A%20Symptoms%20of%20Viral%20Infection%20%7C%20Malware%3A%20Symptoms%20of%20Viral%20Infection&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAQAB~&jid=1526509304&gjid=1539023066&cid=1972879668.1561993577&tid=UA-42358305-1&_gid=1146159407.1561993577&_r=1&z=1809174614 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_gid=1146159407.1561993577&gjid=1539023066&_v=j77&z=1809174614 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_v=j77&z=1809174614 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_v=j77&z=1809174614&slf_rd=1&random=1483671563

27 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request en
malware.hetnieuweinstituut.nl/
41 KB
10 KB
Document
General
Full URL
https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
5b0290e07880d0456fdeb55cc2523516d2f83a06b59bbafd09378cc2369ce819
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN

Request headers

Host
malware.hetnieuweinstituut.nl
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:15 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; preload
X-Frame-Options
SAMEORIGIN SAMEORIGIN
X-Content-Type-Options
nosniff nosniff
X-Drupal-Cache
MISS
Expires
Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control
public, max-age=0
Content-Language
en
X-Generator
Drupal 7 (http://drupal.org)
Link
<https://malware.hetnieuweinstituut.nl/en/home>; rel="canonical",<https://malware.hetnieuweinstituut.nl/en/home>; rel="shortlink"
Etag
"1561993575-1"
Last-Modified
Mon, 01 Jul 2019 15:06:15 GMT
Vary
Cookie,Accept-Encoding
Content-Encoding
gzip
Keep-Alive
timeout=65, max=150
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
css_xE-rWrJf-fncB6ztZfd2huxqgxu4WO-qwma6Xer30m4.css
malware.hetnieuweinstituut.nl/sites/default/files/css/
7 KB
3 KB
Stylesheet
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_xE-rWrJf-fncB6ztZfd2huxqgxu4WO-qwma6Xer30m4.css
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
c44fab5ab25ff9f9dc07aced65f77686ec6a831bb858efaac266ba5deaf7d26e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:15 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2217
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"8a9-58c25e8b55d88"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/css
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=149
Expires
Mon, 15 Jul 2019 15:06:15 GMT
css_IHmHYEN3RB3T8CWpMei8W9ypZru9RKXLEQPJvWBfUag.css
malware.hetnieuweinstituut.nl/sites/default/files/css/
9 KB
3 KB
Stylesheet
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_IHmHYEN3RB3T8CWpMei8W9ypZru9RKXLEQPJvWBfUag.css
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
207987604377441dd3f025a931e8bc5bdca966bbbd44a5cb1103c9bd605f51a8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:15 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2367
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"93f-58c25e8b57cc8"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/css
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=148
Expires
Mon, 15 Jul 2019 15:06:15 GMT
css_XrZz8D2vZrHC9dW2Qq3ow_EC-pSP5fs_Z7caVe2D1Xo.css
malware.hetnieuweinstituut.nl/sites/default/files/css/
1 KB
943 B
Stylesheet
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_XrZz8D2vZrHC9dW2Qq3ow_EC-pSP5fs_Z7caVe2D1Xo.css
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
5eb673f03daf66b1c2f5d5b642ade8c3f102fa948fe5fb3f67b71a55ed83d57a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
439
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"1b7-58c25e8b58c68"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/css
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=147
Expires
Mon, 15 Jul 2019 15:06:16 GMT
css_17XAIXPS6Ew99Tp9UC_cpg59G95_4jofVS-JlGv2D3A.css
malware.hetnieuweinstituut.nl/sites/default/files/css/
115 KB
19 KB
Stylesheet
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_17XAIXPS6Ew99Tp9UC_cpg59G95_4jofVS-JlGv2D3A.css
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
d7b5c02173d2e84c3df53a7d502fdca60e7d1bde7fe23a1f552f89946bf60f70
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
18870
Last-Modified
Tue, 25 Jun 2019 13:29:23 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"49b6-58c25eac17d31"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/css
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=146
Expires
Mon, 15 Jul 2019 15:06:16 GMT
js_v7z_ueNi9EIrZXPI8So7AkuzyXuKekr2jbdDptsM5Oc.js
malware.hetnieuweinstituut.nl/sites/default/files/js/
115 KB
41 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_v7z_ueNi9EIrZXPI8So7AkuzyXuKekr2jbdDptsM5Oc.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
bfbcffb9e362f4422b6573c8f12a3b024bb3c97b8a7a4af68db743a6db0ce4e7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
41192
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"a0e8-58c25e8b5cae9"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=145
Expires
Mon, 15 Jul 2019 15:06:16 GMT
js_H7q2xORKmR9AN8Qx5spKEIBp7R_wG2apAswJoCUZY7I.js
malware.hetnieuweinstituut.nl/sites/default/files/js/
4 KB
2 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_H7q2xORKmR9AN8Qx5spKEIBp7R_wG2apAswJoCUZY7I.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
1fbab6c4e44a991f4037c431e6ca4a108069ed1ff01b66a902cc09a0251963b2
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1345
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"541-58c25e8b5da89"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=144
Expires
Mon, 15 Jul 2019 15:06:16 GMT
js_XGYUMSp7U6SJYGL04Z44IlLRLO9cGjIPMPeM-9LJugw.js
malware.hetnieuweinstituut.nl/sites/default/files/js/
69 KB
20 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_XGYUMSp7U6SJYGL04Z44IlLRLO9cGjIPMPeM-9LJugw.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
5c6614312a7b53a4896062f4e19e382252d12cef5c1a320f30f78cfbd2c9ba0c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
20347
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"4f7b-58c25e8b61909"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=143
Expires
Mon, 15 Jul 2019 15:06:16 GMT
randomgreen.js
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/js/
3 KB
2 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/js/randomgreen.js?ptnpgz
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
75a0b51fe882856478d944f4c379a0c80897f91b20454926f74af12452aefc5c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1061
Last-Modified
Thu, 09 Aug 2018 14:22:24 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"aa3-573015b17c800-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
application/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=142
Expires
Mon, 15 Jul 2019 15:06:16 GMT
js_SmC9L1vS6A2kqLeG0s1HpdSliz10t9_r6OVkUfIxKxo.js
malware.hetnieuweinstituut.nl/sites/default/files/js/
10 KB
3 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_SmC9L1vS6A2kqLeG0s1HpdSliz10t9_r6OVkUfIxKxo.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
4a60bd2f5bd2e80da4a8b786d2cd47a5d4a58b3d74b7dfebe8e56451f2312b1a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2667
Last-Modified
Tue, 25 Jun 2019 13:29:02 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"a6b-58c25e976f96e"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=141
Expires
Mon, 15 Jul 2019 15:06:16 GMT
js_ldatvWGL3LDiLtFAvhWGwnJCP_plvQLyMX5RURsLY3s.js
malware.hetnieuweinstituut.nl/sites/default/files/js/
4 KB
2 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_ldatvWGL3LDiLtFAvhWGwnJCP_plvQLyMX5RURsLY3s.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
95d6adbd618bdcb0e22ed140be1586c272423ffa65bd02f2317e51511b0b637b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
1679
Last-Modified
Tue, 25 Jun 2019 13:28:50 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"68f-58c25e8c36762"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=140
Expires
Mon, 15 Jul 2019 15:06:16 GMT
js_KSYNJPMZvw_PDmqXOILVk9D-kitbozcDfExBwbgJ4hk.js
malware.hetnieuweinstituut.nl/sites/default/files/js/
117 KB
23 KB
Script
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_KSYNJPMZvw_PDmqXOILVk9D-kitbozcDfExBwbgJ4hk.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
29260d24f319bf0fcf0e6a973882d593d0fe922b5ba337037c4c41c1b809e219
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
23172
Last-Modified
Tue, 25 Jun 2019 13:28:49 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"5a84-58c25e8b6866a"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
text/javascript
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=139
Expires
Mon, 15 Jul 2019 15:06:16 GMT
mobile_landscape.gif
malware.hetnieuweinstituut.nl/sites/default/files/cover-6017-42350/
29 KB
30 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/cover-6017-42350/mobile_landscape.gif
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
0d32d503a26c95b5c09184092a18cd2761472168c4517a19f9161fd2eb877d24
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 05 Jun 2019 15:59:58 GMT
Server
Apache
ETag
"74fa-58a95b0693b80"
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Cache-Control
max-age=3600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=138
Content-Length
29946
Expires
Mon, 01 Jul 2019 16:06:16 GMT
arrow-hint.svg
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/
525 B
889 B
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/arrow-hint.svg
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
846752ac1c3604c4039d27735820fb5fb4f046e2633f3a8b87ef32029da08839
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
375
Last-Modified
Mon, 20 Jun 2016 07:01:51 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"20d-535b04757b5c0-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
image/svg+xml
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=137
Expires
Mon, 15 Jul 2019 15:06:16 GMT
interpretation_ramsomware_pollocrypt_jack_featherstone_and_bas_van_de_poel_1.jpg
malware.hetnieuweinstituut.nl/sites/default/files/styles/width_1024/public/
132 KB
132 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/styles/width_1024/public/interpretation_ramsomware_pollocrypt_jack_featherstone_and_bas_van_de_poel_1.jpg?itok=ySi-LR-I
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
d969ab5c4ca60700316b02c5e5318de12cfddb8864e59c89854bc8ccc091a5d1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 10 Jun 2019 09:04:00 GMT
Server
Apache
ETag
"20ebe-58af4760ce173"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
max-age=3600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=134
Content-Length
134846
Expires
Mon, 01 Jul 2019 16:06:16 GMT
kaspersky_logo_green.png_fe03a1c7.png
malware.hetnieuweinstituut.nl/sites/default/files/styles/magazine_sponsor_logo/public/
6 KB
6 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/sites/default/files/styles/magazine_sponsor_logo/public/kaspersky_logo_green.png_fe03a1c7.png?itok=qfI8cWi7
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
8a1cc0785a5f3a3863b780a57620bb76e872d4c5f91b6892463555b7fddff63e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 05 Jun 2019 14:32:51 GMT
Server
Apache
ETag
"1638-58a9478deba68"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=3600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=132
Content-Length
5688
Expires
Mon, 01 Jul 2019 16:06:16 GMT
ministerie_onderwijs.svg
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/
59 KB
20 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/ministerie_onderwijs.svg
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
091e704f0885fc062d4a044111c29e969509137c853ed500195eef47d92fd0c9
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
19562
Last-Modified
Thu, 09 Aug 2018 14:22:24 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"eb85-573015b17c800-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
image/svg+xml
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=131
Expires
Mon, 15 Jul 2019 15:06:16 GMT
bankgiroloterij.svg
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/
11 KB
5 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/bankgiroloterij.svg
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
184570c008f1ebfbc55045ad906bb1922d7f3089cde7dc931369360a2996209b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
4483
Last-Modified
Thu, 09 Aug 2018 14:22:24 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"2da3-573015b17c800-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
image/svg+xml
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=130
Expires
Mon, 15 Jul 2019 15:06:16 GMT
tudelft.svg
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/
6 KB
3 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/tudelft.svg
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
36d1451ac1297d31c4158ffe37145112c67a6a64ef4c705d41e6c898b86322cc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
2669
Last-Modified
Thu, 09 Aug 2018 14:22:24 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"16c8-573015b17c800-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
image/svg+xml
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=129
Expires
Mon, 15 Jul 2019 15:06:16 GMT
ministerie_buitenlandse.svg
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/
49 KB
16 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/ministerie_buitenlandse.svg
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
9ed48f08fa78fbe80e79b0529090304799e142f3314949292ae831bb8364180c
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:17 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
16099
Last-Modified
Thu, 09 Aug 2018 14:22:24 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"c25a-573015b17c800-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
image/svg+xml
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=128
Expires
Mon, 15 Jul 2019 15:06:17 GMT
volkskracht.svg
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/
12 KB
4 KB
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/images/volkskracht.svg
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
c8f2064725d8999bce18b179ca8b7537f254752219d59bdd57a2cdbceae41638
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:17 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Content-Length
4064
Last-Modified
Thu, 09 Aug 2018 14:22:24 GMT
Server
Apache
X-Frame-Options
SAMEORIGIN
ETag
"307c-573015b17c800-gzip"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=63072000; preload
Content-Type
image/svg+xml
Cache-Control
max-age=1209600
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=127
Expires
Mon, 15 Jul 2019 15:06:17 GMT
analytics.js
www.google-analytics.com/
43 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 20 Jun 2019 21:35:04 GMT
server
Golfe2
age
1148
date
Mon, 01 Jul 2019 14:47:08 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17707
expires
Mon, 01 Jul 2019 16:47:08 GMT
menu-leaf.png
malware.hetnieuweinstituut.nl/misc/
126 B
580 B
Image
General
Full URL
https://malware.hetnieuweinstituut.nl/misc/menu-leaf.png
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_v7z_ueNi9EIrZXPI8So7AkuzyXuKekr2jbdDptsM5Oc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
e457a1f5c855a40b853c0f8f6421db58c3e7b443444389e3ac1cb128bb02fc97
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_xE-rWrJf-fncB6ztZfd2huxqgxu4WO-qwma6Xer30m4.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 01 Jul 2019 15:06:17 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Wed, 16 Jan 2019 23:30:12 GMT
Server
Apache
ETag
"7e-57f9ba8c9a900"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=3600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=126
Content-Length
126
Expires
Mon, 01 Jul 2019 16:06:17 GMT
fontello.woff
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/fonts/fontello/font/
5 KB
5 KB
Font
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/fonts/fontello/font/fontello.woff?95795438
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_v7z_ueNi9EIrZXPI8So7AkuzyXuKekr2jbdDptsM5Oc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
98c5d814fc124a16607602022756ad3dcabe3971ef2251a5197f05e9e6248c57
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_17XAIXPS6Ew99Tp9UC_cpg59G95_4jofVS-JlGv2D3A.css
Origin
https://malware.hetnieuweinstituut.nl

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 20 Jun 2016 07:01:51 GMT
Server
Apache
ETag
"1304-535b04757b5c0"
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-font-woff
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=136
Content-Length
4868
Expires
Mon, 15 Jul 2019 15:06:16 GMT
e5b89697-9108-43cd-9361-b666daecdf2d.woff
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/fonts/
25 KB
25 KB
Font
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/fonts/e5b89697-9108-43cd-9361-b666daecdf2d.woff
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_v7z_ueNi9EIrZXPI8So7AkuzyXuKekr2jbdDptsM5Oc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
cbfcca60757b777469c75012db37f8d8f02fac085e9a09145e9ebde5f834b933
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_17XAIXPS6Ew99Tp9UC_cpg59G95_4jofVS-JlGv2D3A.css
Origin
https://malware.hetnieuweinstituut.nl

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 20 Jun 2016 07:01:51 GMT
Server
Apache
ETag
"6408-535b04757b5c0"
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-font-woff
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=135
Content-Length
25608
Expires
Mon, 15 Jul 2019 15:06:16 GMT
2e87438f-a86f-4908-9c51-b2bcd0f56327.woff
malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/fonts/
26 KB
26 KB
Font
General
Full URL
https://malware.hetnieuweinstituut.nl/profiles/hni/themes/magazines/fonts/2e87438f-a86f-4908-9c51-b2bcd0f56327.woff
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/sites/default/files/js/js_v7z_ueNi9EIrZXPI8So7AkuzyXuKekr2jbdDptsM5Oc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
31.3.101.87 , Netherlands, ASN35470 (XL-AS, NL),
Reverse DNS
vps48751.public.cloudvps.com
Software
Apache /
Resource Hash
a33ad9a21ac8a743155846d01c1a4b436383512ad4bc42f1cde540477a93c00a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://malware.hetnieuweinstituut.nl/sites/default/files/css/css_17XAIXPS6Ew99Tp9UC_cpg59G95_4jofVS-JlGv2D3A.css
Origin
https://malware.hetnieuweinstituut.nl

Response headers

Date
Mon, 01 Jul 2019 15:06:16 GMT
Strict-Transport-Security
max-age=63072000; preload
X-Content-Type-Options
nosniff
Last-Modified
Mon, 20 Jun 2016 07:01:51 GMT
Server
Apache
ETag
"67f0-535b04757b5c0"
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-font-woff
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=65, max=133
Content-Length
26608
Expires
Mon, 15 Jul 2019 15:06:16 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j77&aip=1&a=1812247483&t=pageview&_s=1&dl=https%3A%2F%2Fmalware.hetnieuweinstituut.nl%2Fen&ul=en-us&de=UTF-8&dt=Malware%3A%20Symptoms%20of%20Viral%...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_gid=1146159407.1561993577&gjid=1539023066&_v=j77&z=1809174614
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_v=j77&z=1809174614
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_v=j77&z=1809174614&slf_rd=1&random=1483671563
42 B
109 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_v=j77&z=1809174614&slf_rd=1&random=1483671563
Requested by
Host: malware.hetnieuweinstituut.nl
URL: https://malware.hetnieuweinstituut.nl/en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://malware.hetnieuweinstituut.nl/en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 01 Jul 2019 15:06:17 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 01 Jul 2019 15:06:17 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-42358305-1&cid=1972879668.1561993577&jid=1526509304&_v=j77&z=1809174614&slf_rd=1&random=1483671563
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| Drupal undefined| $ function| jQuery object| jQuery17205526304553525658 function| FastClick function| tinycolor string| GoogleAnalyticsObject function| ga function| _ object| $label number| element_height number| grid_count object| $this object| $self object| $header object| $body object| $html object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| viewport_size object| cover_data string| screen_position

4 Cookies

Domain/Path Name / Value
.malware.hetnieuweinstituut.nl/ Name: _ga
Value: GA1.3.1972879668.1561993577
.malware.hetnieuweinstituut.nl/ Name: _gat
Value: 1
.malware.hetnieuweinstituut.nl/ Name: _gid
Value: GA1.3.1146159407.1561993577
malware.hetnieuweinstituut.nl/ Name: has_js
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; preload
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

malware.hetnieuweinstituut.nl
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
2a00:1450:4001:808::2003
2a00:1450:4001:815::2004
2a00:1450:4001:81e::200e
2a00:1450:400c:c02::9c
31.3.101.87
091e704f0885fc062d4a044111c29e969509137c853ed500195eef47d92fd0c9
0d32d503a26c95b5c09184092a18cd2761472168c4517a19f9161fd2eb877d24
184570c008f1ebfbc55045ad906bb1922d7f3089cde7dc931369360a2996209b
1fbab6c4e44a991f4037c431e6ca4a108069ed1ff01b66a902cc09a0251963b2
207987604377441dd3f025a931e8bc5bdca966bbbd44a5cb1103c9bd605f51a8
29260d24f319bf0fcf0e6a973882d593d0fe922b5ba337037c4c41c1b809e219
36d1451ac1297d31c4158ffe37145112c67a6a64ef4c705d41e6c898b86322cc
4a60bd2f5bd2e80da4a8b786d2cd47a5d4a58b3d74b7dfebe8e56451f2312b1a
5b0290e07880d0456fdeb55cc2523516d2f83a06b59bbafd09378cc2369ce819
5c6614312a7b53a4896062f4e19e382252d12cef5c1a320f30f78cfbd2c9ba0c
5eb673f03daf66b1c2f5d5b642ade8c3f102fa948fe5fb3f67b71a55ed83d57a
75a0b51fe882856478d944f4c379a0c80897f91b20454926f74af12452aefc5c
846752ac1c3604c4039d27735820fb5fb4f046e2633f3a8b87ef32029da08839
8a1cc0785a5f3a3863b780a57620bb76e872d4c5f91b6892463555b7fddff63e
95d6adbd618bdcb0e22ed140be1586c272423ffa65bd02f2317e51511b0b637b
98c5d814fc124a16607602022756ad3dcabe3971ef2251a5197f05e9e6248c57
9ed48f08fa78fbe80e79b0529090304799e142f3314949292ae831bb8364180c
a33ad9a21ac8a743155846d01c1a4b436383512ad4bc42f1cde540477a93c00a
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
bfbcffb9e362f4422b6573c8f12a3b024bb3c97b8a7a4af68db743a6db0ce4e7
c44fab5ab25ff9f9dc07aced65f77686ec6a831bb858efaac266ba5deaf7d26e
c8f2064725d8999bce18b179ca8b7537f254752219d59bdd57a2cdbceae41638
cbfcca60757b777469c75012db37f8d8f02fac085e9a09145e9ebde5f834b933
d7b5c02173d2e84c3df53a7d502fdca60e7d1bde7fe23a1f552f89946bf60f70
d969ab5c4ca60700316b02c5e5318de12cfddb8864e59c89854bc8ccc091a5d1
e457a1f5c855a40b853c0f8f6421db58c3e7b443444389e3ac1cb128bb02fc97
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629