Submitted URL: http://xyz.trellix.info/malware
Effective URL: http://xyz.trellix.info/index2.php
Submission: On October 17 via manual from US — Scanned from FR

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 51.195.73.73, located in France and belongs to OVH, FR. The main domain is xyz.trellix.info.
This is the only time xyz.trellix.info was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 4 51.195.73.73 16276 (OVH)
2 1
Apex Domain
Subdomains
Transfer
4 trellix.info
xyz.trellix.info
1 KB
2 1
Domain Requested by
4 xyz.trellix.info 2 redirects
2 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://xyz.trellix.info/index2.php
Frame ID: C5E15169C25B9AEC4E513E9C4B7DD967
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://xyz.trellix.info/malware HTTP 307
    https://xyz.trellix.info/malware HTTP 307
    http://xyz.trellix.info/malware HTTP 302
    http://xyz.trellix.info/index2.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1 kB
Transfer

0 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://xyz.trellix.info/malware HTTP 307
    https://xyz.trellix.info/malware HTTP 307
    http://xyz.trellix.info/malware HTTP 302
    http://xyz.trellix.info/index2.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://xyz.trellix.info/favicon.ico HTTP 302
  • http://xyz.trellix.info/index2.php

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index2.php
xyz.trellix.info/
Redirect Chain
  • http://xyz.trellix.info/malware
  • https://xyz.trellix.info/malware
  • http://xyz.trellix.info/malware
  • http://xyz.trellix.info/index2.php
125 B
358 B
Document
General
Full URL
http://xyz.trellix.info/index2.php
Protocol
HTTP/1.1
Server
51.195.73.73 , France, ASN16276 (OVH, FR),
Reverse DNS
redirects.domaisy.de
Software
nginx / PHP/7.4.33
Resource Hash
4b04a27c0484f685e15f533a50ef55f45b3533114ba2cc06827c1034c4921494

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Thu, 17 Oct 2024 15:03:24 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Powered-By
PHP/7.4.33

Redirect headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 17 Oct 2024 15:03:24 GMT
Location
index2.php
Server
nginx
Transfer-Encoding
chunked
X-Powered-By
PHP/7.4.33
index2.php
xyz.trellix.info/
Redirect Chain
  • http://xyz.trellix.info/favicon.ico
  • http://xyz.trellix.info/index2.php
125 B
358 B
Other
General
Full URL
http://xyz.trellix.info/index2.php
Protocol
HTTP/1.1
Server
51.195.73.73 , France, ASN16276 (OVH, FR),
Reverse DNS
redirects.domaisy.de
Software
nginx / PHP/7.4.33
Resource Hash
4b04a27c0484f685e15f533a50ef55f45b3533114ba2cc06827c1034c4921494

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://xyz.trellix.info/index2.php

Response headers

Transfer-Encoding
chunked
Content-Encoding
gzip
Connection
keep-alive
Date
Thu, 17 Oct 2024 15:03:24 GMT
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Server
nginx
X-Powered-By
PHP/7.4.33

Redirect headers

Transfer-Encoding
chunked
Location
index2.php
Date
Thu, 17 Oct 2024 15:03:24 GMT
Content-Type
text/html; charset=UTF-8
X-Powered-By
PHP/7.4.33
Server
nginx
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

xyz.trellix.info
51.195.73.73
4b04a27c0484f685e15f533a50ef55f45b3533114ba2cc06827c1034c4921494