urlscan.io logo urlscan.io
SecurityTrails logo

www.wicar.org Open in urlscan Pro
199.34.228.69  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://malware.wicar.org/
Effective URL: http://www.wicar.org/test-malware.html
Submission: On December 18 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 15 IPs in 4 countries across 7 domains to perform 38 HTTP transactions. The main IP is 199.34.228.69, located in San Francisco, United States and belongs to WEEBLY - Weebly, Inc., US. The main domain is www.wicar.org.
This is the only time www.wicar.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2607:ff18:80:... 40630 (CAPEQUILOG)
1 8 199.34.228.69 27647 (WEEBLY)
7 2a04:4e42::302 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2.16.186.41 20940 (AKAMAI-ASN1)
8 104.111.219.46 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2.16.186.146 20940 (AKAMAI-ASN1)
1 52.55.188.66 14618 (AMAZON-AES)
1 35.166.89.186 16509 (AMAZON-02)
1 3 18.195.194.147 16509 (AMAZON-02)
2 104.111.218.204 16625 (AKAMAI-AS)
1 54.69.19.209 16509 (AMAZON-02)
38 15
1    2607:ff18:80::615 (United States)

ASN40630 (CAPEQUILOG - GridFury, LLC, US)
malware.wicar.org
8    199.34.228.69 (San Francisco, United States)

ASN27647 (WEEBLY - Weebly, Inc., US)
PTR: pages-custom-21.weebly.com
www.wicar.org
7    2a04:4e42::302 (European Union)

ASN54113 (FASTLY - Fastly, US)
cdn2.editmysite.com
1    2a00:1450:4001:809::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
1    2a00:1450:4001:817::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    2.16.186.41 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-41.deploy.static.akamaitechnologies.com
w.sharethis.com
8    104.111.219.46 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-219-46.deploy.static.akamaitechnologies.com
ws.sharethis.com
2    2a00:1450:4001:81c::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    2a00:1450:4001:821::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    2.16.186.146 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-146.deploy.static.akamaitechnologies.com
c.sharethis.mgr.consensu.org
1    52.55.188.66 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-55-188-66.compute-1.amazonaws.com
count-server.sharethis.com
1    35.166.89.186 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-166-89-186.us-west-2.compute.amazonaws.com
ec.editmysite.com
3    18.195.194.147 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
l.sharethis.com
2    104.111.218.204 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-218-204.deploy.static.akamaitechnologies.com
t.sharethis.com
1    54.69.19.209 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-69-19-209.us-west-2.compute.amazonaws.com
ec.editmysite.com
Domain Requested by
8 ws.sharethis.com w.sharethis.com
ws.sharethis.com
cdn2.editmysite.com
www.wicar.org
8 www.wicar.org 1 redirects www.wicar.org
ajax.googleapis.com
7 cdn2.editmysite.com www.wicar.org
cdn2.editmysite.com
3 l.sharethis.com 1 redirects www.wicar.org
2 t.sharethis.com www.wicar.org
t.sharethis.com
2 ec.editmysite.com cdn2.editmysite.com
www.wicar.org
2 fonts.gstatic.com ajax.googleapis.com
2 www.google-analytics.com www.wicar.org
1 count-server.sharethis.com ws.sharethis.com
1 c.sharethis.mgr.consensu.org w.sharethis.com
1 w.sharethis.com www.wicar.org
1 ajax.googleapis.com www.wicar.org
1 fonts.googleapis.com www.wicar.org
1 malware.wicar.org
38 14
Subject Issuer Validity Valid
*.googleapis.com
Google Internet Authority G3		 2018-11-27 -
2019-02-19		 3 months crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA		 2018-02-14 -
2019-02-14		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2018-11-27 -
2019-02-19		 3 months crt.sh
*.sharethis.mgr.consensu.org
DigiCert ECC Secure Server CA		 2018-07-31 -
2019-07-31		 a year crt.sh

This page contains 5 frames:

Primary Page: http://www.wicar.org/test-malware.html
Frame ID: 1AD1CE22073836DD2A5A94790A90AD51
Requests: 34 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 4A594B7563CB7FC392C8D57A41FFC929
Requests: 1 HTTP requests in this frame

Frame: http://t.sharethis.com/1/d/t.dhj?rnd=1545106851698&cid=c010&dmn=www.wicar.org
Frame ID: 120FB90ED33F9380DC7F5515CCB13523
Requests: 1 HTTP requests in this frame

Frame: http://t.sharethis.com/a/t_.htm?ver=0.208.8512&cid=c010
Frame ID: 2AFB49D04544BEF63983C287C9D49319
Requests: 1 HTTP requests in this frame

Frame: https://ws.sharethis.com/secure5x/index.html
Frame ID: 7F2F4425C7C9188B027E9DD82BFA7F5D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://malware.wicar.org/ Page URL
  2. https://www.wicar.org/test-malware.html HTTP 301
    http://www.wicar.org/test-malware.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /cdn\d+\.editmysite\.com/i
Overall confidence: 100%
Detected patterns
  • env /^mejs$/i
Overall confidence: 100%
Detected patterns
  • env /^VideoJS$/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • env /^Mustache$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

38
Requests

39 %
HTTPS

40 %
IPv6

7
Domains

14
Subdomains

15
IPs

4
Countries

546 kB
Transfer

1858 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://malware.wicar.org/ Page URL
  2. https://www.wicar.org/test-malware.html HTTP 301
    http://www.wicar.org/test-malware.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15
  • http://www.google-analytics.com/ga.js HTTP 307
  • https://www.google-analytics.com/ga.js
Request Chain 28
  • http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1735818538&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&utmhid=1983369653&utmr=http%3A%2F%2Fmalware.wicar.org%2F&utmp=%2Ftest-malware.html&utmht=1545106851599&utmac=UA-5568574-11&utmcc=__utma%3D236560519.1412083162.1545106852.1545106852.1545106852.1%3B%2B__utmz%3D236560519.1545106852.1.1.utmcsr%3Dmalware.wicar.org%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=79872595&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
  • https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1735818538&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&utmhid=1983369653&utmr=http%3A%2F%2Fmalware.wicar.org%2F&utmp=%2Ftest-malware.html&utmht=1545106851599&utmac=UA-5568574-11&utmcc=__utma%3D236560519.1412083162.1545106852.1545106852.1545106852.1%3B%2B__utmz%3D236560519.1545106852.1.1.utmcsr%3Dmalware.wicar.org%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=79872595&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Request Chain 30
  • https://l.sharethis.com/pview?event=pview&version=buttons.js&lang=en&fpc=80351f7-167bf8b8619-1d744080-1&sessionID=1545106851353.49512&hostname=www.wicar.org&location=%2Ftest-malware.html&product=widget&stid=&publisher=30b8e150-a6b5-45df-91ea-89ffddc9341e&st_optout=false&refDomain=malware.wicar.org&refQuery=&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sharURL=&buttonType=ERROR&destination=ERROR&source=ERROR&title=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&ts1545106851353.0=&sop=false HTTP 301
  • https://l.sharethis.com/sc?cm=ZGAPjFwYdaMAAAAUUHpkAw%3D%3D&uid=true&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sop=false

38 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
malware.wicar.org/ 		334 B
582 B 		Document
General
Check archive.org
Download Go to
Full URL
http://malware.wicar.org/
Protocol
HTTP/1.1
Server
2607:ff18:80::615 , United States, ASN40630 (CAPEQUILOG - GridFury, LLC, US),
Reverse DNS
Software
Apache /
Resource Hash
2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be

Request headers

Host
malware.wicar.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:49 GMT
Server
Apache
Last-Modified
Tue, 10 Jul 2018 09:44:32 GMT
ETag
"14e-570a1fa2dc79d"
Accept-Ranges
bytes
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Via
e1
Content-Length
242
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Primary Request Cookie set test-malware.html
www.wicar.org/
Redirect Chain
  • https://www.wicar.org/test-malware.html
  • http://www.wicar.org/test-malware.html
37 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
Apache /
Resource Hash
b477796605d635be2eab9b000106fd0468f27b9583bb509833c98d3165a06f0c

Request headers

Host
www.wicar.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://malware.wicar.org/
Accept-Encoding
gzip, deflate
Cookie
is_mobile=0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://malware.wicar.org/

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Server
Apache
Vary
X-W-SSL,Accept-Encoding,User-Agent
Set-Cookie
language=en; expires=Tue, 01-Jan-2019 04:20:50 GMT; Max-Age=1209600; path=/ gdpr-kb=1; expires=Fri, 15-Dec-2028 04:20:50 GMT; Max-Age=315360000; path=/
Cache-Control
private
ETag
W/"1416ec99e2fa0d702122314fda60f9e2-gzip"
Content-Encoding
gzip
X-Host
pages26.sf2p.intern.weebly.net
X-UA-Compatible
IE=edge,chrome=1
Content-Length
7992
Keep-Alive
timeout=10, max=66
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Server
Apache
Set-Cookie
is_mobile=0; path=/; domain=www.wicar.org
Vary
X-W-SSL,User-Agent
Cache-Control
no-cache
Location
http://www.wicar.org/test-malware.html
X-Host
pages34.sf2p.intern.weebly.net
X-UA-Compatible
IE=edge,chrome=1
Content-Length
396
Keep-Alive
timeout=10, max=75
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Cookie set gdprscript.js
www.wicar.org/gdpr/ 		227 B
628 B 		Script
General
Check archive.org
Download Go to
Full URL
http://www.wicar.org/gdpr/gdprscript.js?buildTime=1544741031&hasRemindMe=true&stealth=false
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
Apache /
Resource Hash
6cc73aa4822bdc024366ba999d93b6a62c18b3ef40814f8f253dfc557075c22b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.wicar.org/test-malware.html
Cookie
is_mobile=0; language=en; gdpr-kb=1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Server
Apache
Vary
X-W-SSL,User-Agent
Content-Type
application/javascript
Set-Cookie
language=en; expires=Tue, 01-Jan-2019 04:20:50 GMT; Max-Age=1209600; path=/
Cache-Control
private
X-Host
pages28.sf2p.intern.weebly.net
Connection
Keep-Alive
Keep-Alive
timeout=10, max=71
Content-Length
227
X-UA-Compatible
IE=edge,chrome=1
Cookie set gdprscript.js
www.wicar.org/gdpr/ 		227 B
628 B 		Script
General
Check archive.org
Download Go to
Full URL
http://www.wicar.org/gdpr/gdprscript.js?buildTime=1531158876&hasRemindMe=true&stealth=false
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
Apache /
Resource Hash
6cc73aa4822bdc024366ba999d93b6a62c18b3ef40814f8f253dfc557075c22b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://www.wicar.org/test-malware.html
Cookie
is_mobile=0; language=en; gdpr-kb=1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
Apache
Vary
X-W-SSL,User-Agent
Content-Type
application/javascript
Set-Cookie
language=en; expires=Tue, 01-Jan-2019 04:20:51 GMT; Max-Age=1209600; path=/
Cache-Control
private
X-Host
pages49.sf2p.intern.weebly.net
Connection
Keep-Alive
Keep-Alive
timeout=10, max=37
Content-Length
227
X-UA-Compatible
IE=edge,chrome=1
sites.css
cdn2.editmysite.com/css/ 		229 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/css/sites.css?buildTime=1531158876
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e6137374f011ef7f8a2a23b2dd5de55c5fa30836eb098e71016c2fd832fc0e70

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Via
1.1 varnish, 1.1 varnish
Age
842173
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
33141
X-Served-By
cache-sjc3131-SJC, cache-fra19127-FRA
Last-Modified
Fri, 07 Dec 2018 01:20:51 GMT
Server
nginx
X-Timer
S1545106851.926995,VS0,VE0
ETag
W/"5c09caf3-395f9"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Expires
Sat, 22 Dec 2018 10:24:37 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
1, 1
fancybox.css
cdn2.editmysite.com/css/old/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/css/old/fancybox.css?1531158876
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Via
1.1 varnish, 1.1 varnish
Age
642352
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1218
X-Served-By
cache-sjc3127-SJC, cache-fra19123-FRA
Last-Modified
Fri, 07 Dec 2018 01:20:51 GMT
Server
nginx
X-Timer
S1545106851.928494,VS0,VE0
ETag
"5c09caf3-f47"
Vary
Accept-Encoding
Content-Type
text/css
Access-Control-Allow-Origin
*
Expires
Mon, 24 Dec 2018 17:54:58 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
1, 1
main_style.css
www.wicar.org/files/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.wicar.org/files/main_style.css?1531218832
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
nginx /
Resource Hash
88977edfdc9d0c8916026ebd3737611160bf272728da352c7e983d52867dd495

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.wicar.org/test-malware.html
Cookie
is_mobile=0; language=en; gdpr-kb=1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, DELETE, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Transfer-Encoding
chunked
X-Host
pages42.sf2p.intern.weebly.net
Connection
keep-alive
Access-Control-Allow-Headers
Origin, Authorization, Content-Type
Expires
Wed, 19 Dec 2018 04:20:51 GMT
css
fonts.googleapis.com/ 		14 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,700,400italic,700italic&subset=latin,latin-ext
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:809::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
f79af0ee328d223e6530d2b59c3f73302b73d32e2db7028bbb3f90c05f5c6d04
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 18 Dec 2018 04:20:50 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 18 Dec 2018 04:20:50 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ 		91 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:817::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 12 Dec 2018 00:04:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
533772
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
33593
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Dec 2019 00:04:38 GMT
stl.js
cdn2.editmysite.com/js/lang/en/ 		126 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1531158876&
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
04742cb3d5ec78b22274103f49cffb8da319562194bad74acd2e89898b666460

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Via
1.1 varnish, 1.1 varnish
Age
642351
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
22118
X-Served-By
cache-sjc3147-SJC, cache-fra19125-FRA
Last-Modified
Fri, 07 Dec 2018 01:20:51 GMT
Server
nginx
X-Timer
S1545106851.928703,VS0,VE0
ETag
W/"5c09caf3-1f964"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Expires
Mon, 24 Dec 2018 17:54:59 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
1, 1
main.js
cdn2.editmysite.com/js/site/ 		465 KB
147 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/js/site/main.js?buildTime=1531158876
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
fd64e82222597fee43cab68d2e67881504d020d2624d657df4ef87a4528729e6

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Via
1.1 varnish, 1.1 varnish
Age
582905
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
149555
X-Served-By
cache-sjc3150-SJC, cache-fra19141-FRA
Last-Modified
Tue, 11 Dec 2018 01:17:47 GMT
Server
nginx
X-Timer
S1545106851.928715,VS0,VE1
ETag
W/"5c0f103b-7434f"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Expires
Tue, 25 Dec 2018 10:25:46 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
1, 1
starting-18-dec_1_orig.gif
www.wicar.org/uploads/5/6/3/3/56336967/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.wicar.org/uploads/5/6/3/3/56336967/starting-18-dec_1_orig.gif
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
nginx /
Resource Hash
81a2485f358b111ed0aa67424b95ebdefc15031afa5e81a141d7f6a2ffb96240

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.wicar.org/test-malware.html
Cookie
is_mobile=0; language=en; gdpr-kb=1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Last-Modified
Sun, 17 Dec 2017 23:58:01 GMT
Server
nginx
ETag
"88a4e2194-1183-5609200f37440"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4483
buttons.js
w.sharethis.com/button/ 		54 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://w.sharethis.com/button/buttons.js
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2.16.186.41 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-41.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
c0cfd2b54531b41a7b98600414c056cea05974d19e6ac6e6e7837d7600206dcc

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
ETag
W/"5bff75bd-d810"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=259200
Connection
keep-alive
Content-Length
15319
Expires
Fri, 21 Dec 2018 03:36:14 GMT
main-customer-accounts-site.js
cdn2.editmysite.com/js/site/ 		485 KB
150 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1531158876
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
a3291fbf7d4957743266734a3787bb901028d597f6b6c9b986b0f32e992f39cb

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:50 GMT
Via
1.1 varnish, 1.1 varnish
Age
642351
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
153377
X-Served-By
cache-sjc3141-SJC, cache-fra19123-FRA
Last-Modified
Fri, 07 Dec 2018 01:20:51 GMT
Server
nginx
X-Timer
S1545106851.935526,VS0,VE1
ETag
W/"5c09caf3-7931a"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Expires
Mon, 24 Dec 2018 17:54:59 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
1, 1
snowday261.js
cdn2.editmysite.com/js/wsnbn/ 		73 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/js/wsnbn/snowday261.js
Requested by
Host: cdn2.editmysite.com
URL: http://cdn2.editmysite.com/js/site/main.js?buildTime=1531158876
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
1529c73abb48b223f2c5337afea8ab4f0cefe98348c17205c4c8161223608a43

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Via
1.1 varnish, 1.1 varnish
Age
395618
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
25690
X-Served-By
cache-sjc3140-SJC, cache-fra19123-FRA
Last-Modified
Wed, 12 Dec 2018 21:50:28 GMT
Server
nginx
X-Timer
S1545106851.344145,VS0,VE0
ETag
W/"5c1182a4-12441"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Expires
Thu, 27 Dec 2018 14:27:13 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
3, 65201
async-buttons.js
ws.sharethis.com/button/ 		89 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.sharethis.com/button/async-buttons.js
Requested by
Host: w.sharethis.com
URL: http://w.sharethis.com/button/buttons.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
d85f2d1d31a221ddcd51c0249cc5b90a1248ff72c43f6d8ed61d013b09745bda

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
ETag
W/"5bff75e9-162e8"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=254850
Connection
keep-alive
Content-Length
18855
Expires
Fri, 21 Dec 2018 03:08:21 GMT
ga.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/ga.js
  • https://www.google-analytics.com/ga.js
45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/ga.js
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 05 Nov 2018 21:10:09 GMT
server
Golfe2
age
3228
date
Tue, 18 Dec 2018 03:27:03 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
17168
expires
Tue, 18 Dec 2018 05:27:03 GMT

Redirect headers

Location
https://www.google-analytics.com/ga.js
Non-Authoritative-Reason
HSTS
snowday262.js
cdn2.editmysite.com/js/wsnbn/ 		73 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn2.editmysite.com/js/wsnbn/snowday262.js
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
2a04:4e42::302 , European Union, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Via
1.1 varnish, 1.1 varnish
Age
414032
X-Cache
HIT, HIT
Connection
keep-alive
Content-Encoding
gzip
Content-Length
25723
X-Served-By
cache-sjc3125-SJC, cache-fra19123-FRA
Last-Modified
Wed, 12 Dec 2018 21:50:28 GMT
Server
nginx
X-Timer
S1545106851.441361,VS0,VE0
ETag
W/"5c1182a4-124fe"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Expires
Thu, 27 Dec 2018 09:20:19 GMT
Cache-Control
max-age=1209600
Accept-Ranges
bytes
X-Cache-Hits
1, 70424
bullet.png
www.wicar.org/files/theme/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.wicar.org/files/theme/bullet.png?1531218832
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
nginx /
Resource Hash
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.wicar.org/files/main_style.css?1531218832
Cookie
is_mobile=0; language=en; gdpr-kb=true; __unam=80351f7-167bf8b8619-1d744080-1
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.wicar.org/files/main_style.css?1531218832
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Last-Modified
Mon, 08 Jun 2015 23:18:52 GMT
Server
nginx
ETag
"5ea7f50da-484-51809dd696f00"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1156
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,700,400italic,700italic&subset=latin,latin-ext
Origin
http://www.wicar.org

Response headers

Date
Wed, 12 Dec 2018 01:41:28 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 21:49:46 GMT
Server
sffe
Age
527963
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
8892
X-XSS-Protection
1; mode=block
Expires
Thu, 12 Dec 2019 01:41:28 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Protocol
HTTP/1.1
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://fonts.googleapis.com/css?family=Open+Sans:400,300,300italic,700,400italic,700italic&subset=latin,latin-ext
Origin
http://www.wicar.org

Response headers

Date
Fri, 07 Dec 2018 21:40:24 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 11 Oct 2017 21:49:39 GMT
Server
sffe
Age
888027
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
8800
X-XSS-Protection
1; mode=block
Expires
Sat, 07 Dec 2019 21:40:24 GMT
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 4A59 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: w.sharethis.com
URL: http://w.sharethis.com/button/buttons.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.146 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-146.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
c.sharethis.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://www.wicar.org/test-malware.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.wicar.org/test-malware.html

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
ETag
W/"26b-4977387000"
Last-Modified
Tue, 01 Jan 1980 00:00:00 GMT
Vary
Accept-Encoding
Content-Length
334
Cache-Control
public, max-age=3600
Date
Tue, 18 Dec 2018 04:20:51 GMT
Connection
keep-alive
/
www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/ 		348 B
630 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.wicar.org/ajax/api/JsonRPC/CustomerAccounts/?CustomerAccounts[CustomerAccounts::getAccountDetails]
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Protocol
HTTP/1.1
Server
199.34.228.69 San Francisco, United States, ASN27647 (WEEBLY - Weebly, Inc., US),
Reverse DNS
pages-custom-21.weebly.com
Software
Apache /
Resource Hash
adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49

Request headers

Pragma
no-cache
Origin
http://www.wicar.org
Accept-Encoding
gzip, deflate
Host
www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json; charset=UTF-8
Accept
application/json, text/javascript, */*; q=0.01
Cache-Control
no-cache
X-Requested-With
XMLHttpRequest
Cookie
is_mobile=0; language=en; gdpr-kb=true; __unam=80351f7-167bf8b8619-1d744080-1
Connection
keep-alive
Referer
http://www.wicar.org/test-malware.html
Content-Length
83
Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.wicar.org/test-malware.html
Origin
http://www.wicar.org
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
Apache
Vary
X-W-SSL,User-Agent
Content-Type
application/json
X-Host
pages29.sf2p.intern.weebly.net
Connection
Keep-Alive
Keep-Alive
timeout=10, max=59
Content-Length
348
X-UA-Compatible
IE=edge,chrome=1
buttons-secure.css
ws.sharethis.com/button/css/ 		23 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ws.sharethis.com/button/css/buttons-secure.css
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/async-buttons.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
95dc1b83a7c030dd13ab3e29df921f10e04208b28734f172ea232854264c3b05

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Nov 2018 05:15:21 GMT
Server
nginx/1.12.2
ETag
W/"5bff75e9-5a76"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Content-Length
3851
get_counts
count-server.sharethis.com/v2.0/ 		273 B
382 B 		Script
General
Check archive.org
Download Go to
Full URL
https://count-server.sharethis.com/v2.0/get_counts?url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&cb=stButtons.processCB&wd=true
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/async-buttons.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.55.188.66 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-55-188-66.compute-1.amazonaws.com
Software
/
Resource Hash
735dbfc4d964f12f9a6d639ac25b225413b77731ddbfe9f6f02da18f8009c5dd

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:52 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
225
Content-Type
application/json
facebook_counter.png
ws.sharethis.com/images/2017/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ws.sharethis.com/images/2017/facebook_counter.png
Requested by
Host: cdn2.editmysite.com
URL: http://cdn2.editmysite.com/js/wsnbn/snowday262.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
3488c49147b809d1e457c14a37bf3a79b0455fd159c121325e8f737eea45eb75

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
nginx/1.12.2
ETag
"5bff75ba-977"
Content-Type
image/png
Cache-Control
max-age=29898676
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2423
Expires
Fri, 29 Nov 2019 05:32:07 GMT
twitter_counter.png
ws.sharethis.com/images/2017/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ws.sharethis.com/images/2017/twitter_counter.png
Requested by
Host: cdn2.editmysite.com
URL: http://cdn2.editmysite.com/js/wsnbn/snowday262.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
aeae37bae2130513ef8b5ea4fde8fd776b32ff8969b848b59399a63d9455e29a

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
nginx/1.12.2
ETag
"5bff75ba-9ae"
Content-Type
image/png
Cache-Control
max-age=29898701
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2478
Expires
Fri, 29 Nov 2019 05:32:32 GMT
linkedin_counter.png
ws.sharethis.com/images/2017/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ws.sharethis.com/images/2017/linkedin_counter.png
Requested by
Host: cdn2.editmysite.com
URL: http://cdn2.editmysite.com/js/wsnbn/snowday262.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
0e3f83554765fa48514ce0a169441466f92010d01cdc716003e02317bffc6993

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
nginx/1.12.2
ETag
"5bff75ba-9e1"
Content-Type
image/png
Cache-Control
max-age=29898688
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2529
Expires
Fri, 29 Nov 2019 05:32:19 GMT
tp2
ec.editmysite.com/com.snowplowanalytics.snowplow/ 		0
445 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: cdn2.editmysite.com
URL: http://cdn2.editmysite.com/js/wsnbn/snowday262.js
Protocol
HTTP/1.1
Server
35.166.89.186 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-166-89-186.us-west-2.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
http://www.wicar.org
Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
Apache-Coyote/1.1
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
POST
Content-Type
text/plain
Access-Control-Allow-Origin
http://www.wicar.org
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
Content-Length
0
__utm.gif
www.google-analytics.com/r/
Redirect Chain
  • http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1735818538&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%20...
  • https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1735818538&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%2...
35 B
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1735818538&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&utmhid=1983369653&utmr=http%3A%2F%2Fmalware.wicar.org%2F&utmp=%2Ftest-malware.html&utmht=1545106851599&utmac=UA-5568574-11&utmcc=__utma%3D236560519.1412083162.1545106852.1545106852.1545106852.1%3B%2B__utmz%3D236560519.1545106852.1.1.utmcsr%3Dmalware.wicar.org%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=79872595&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 18 Dec 2018 04:20:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1735818538&utmhn=www.wicar.org&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Test%20Malware!%20-%20WICAR.org%20-%C2%A0Test%20Your%20Anti-Malware%20Solution!&utmhid=1983369653&utmr=http%3A%2F%2Fmalware.wicar.org%2F&utmp=%2Ftest-malware.html&utmht=1545106851599&utmac=UA-5568574-11&utmcc=__utma%3D236560519.1412083162.1545106852.1545106852.1545106852.1%3B%2B__utmz%3D236560519.1545106852.1.1.utmcsr%3Dmalware.wicar.org%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=79872595&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Non-Authoritative-Reason
HSTS
bubble_arrow.png
ws.sharethis.com/secure/images/ 		979 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ws.sharethis.com/secure/images/bubble_arrow.png
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
516630dc137782b6ea784ed6891b487b8a2fff9be9ed921977008453039cc1fe

Request headers

Referer
https://ws.sharethis.com/button/css/buttons-secure.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
nginx/1.12.2
ETag
"5bff75e9-3d3"
Content-Type
image/png
Cache-Control
max-age=29898675
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
979
Expires
Fri, 29 Nov 2019 05:32:06 GMT
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=buttons.js&lang=en&fpc=80351f7-167bf8b8619-1d744080-1&sessionID=1545106851353.49512&hostname=www.wicar.org&location=%2Ftest-malware.html&product=wi...
  • https://l.sharethis.com/sc?cm=ZGAPjFwYdaMAAAAUUHpkAw%3D%3D&uid=true&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sop=false
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGAPjFwYdaMAAAAUUHpkAw%3D%3D&uid=true&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sop=false
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.194.147 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Location
/sc?cm=ZGAPjFwYdaMAAAAUUHpkAw%3D%3D&uid=true&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sop=false
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
http://www.wicar.org
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
152
Stid
ZGAPjFwYdaMAAAAUUHpkAw==

Redirect headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Access-Control-Allow-Origin
http://www.wicar.org
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZGAPjFwYdaMAAAAUUHpkAw%3D%3D&uid=true&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sop=false
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
152
Stid
ZGAPjFwYdaMAAAAUUHpkAw==
sc
l.sharethis.com/ 		51 B
470 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGAPjFwYdaMAAAAUUHpkAw%3D%3D&uid=true&url=http%3A%2F%2Fwww.wicar.org%2Ftest-malware.html&sop=false
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.194.147 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
8b9df301259fe620bc27f72d301056a3b6925853501542a3e66ed6940eacf39d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.wicar.org/test-malware.html
Origin
http://www.wicar.org

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
http://www.wicar.org
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGAPjFwYdaMAAAAUUHpkAw==
Access-Control-Allow-Headers
*
Content-Length
51
p.js
ws.sharethis.com/button/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.sharethis.com/button/p.js
Requested by
Host: w.sharethis.com
URL: http://w.sharethis.com/button/buttons.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash
97875e1cc37494327341a6d4444231a16127ab958907b9e879a87eb99808c7a0

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
ETag
W/"5bff75c0-bc6"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=255226
Connection
keep-alive
Content-Length
1182
Expires
Fri, 21 Dec 2018 03:14:37 GMT
t.dhj
t.sharethis.com/1/d/ Frame 120F 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://t.sharethis.com/1/d/t.dhj?rnd=1545106851698&cid=c010&dmn=www.wicar.org
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
104.111.218.204 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-218-204.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
db76301af6a5c920ee86c4b775c7038ef4e92fc0208322717d9655f3fa1ede3f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://www.wicar.org/test-malware.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="DSP LAW NID OUR DEL SAM BUS UNI PUR COM NAV INT STA PRE LOC OTC"
Cache-Control
private, max-age=3600
Connection
keep-alive
Content-Type
application/javascript
Content-Length
956
Expires
Tue, 18 Dec 2018 05:20:51 GMT
t_.htm
t.sharethis.com/a/ Frame 2AFB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
http://t.sharethis.com/a/t_.htm?ver=0.208.8512&cid=c010
Requested by
Host: t.sharethis.com
URL: http://t.sharethis.com/1/d/t.dhj?rnd=1545106851698&cid=c010&dmn=www.wicar.org
Protocol
HTTP/1.1
Server
104.111.218.204 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-218-204.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
t.sharethis.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://www.wicar.org/test-malware.html
Accept-Encoding
gzip, deflate
Cookie
__stid=ZGAPjFwYdaMAAAAUUHpkAw==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.wicar.org/test-malware.html

Response headers

Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
783
Cache-Control
max-age=604800
Expires
Tue, 25 Dec 2018 04:20:51 GMT
Date
Tue, 18 Dec 2018 04:20:51 GMT
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="DSP LAW NID OUR DEL SAM BUS UNI PUR COM NAV INT STA PRE LOC OTC"
Content-Type
text/html
tp2
ec.editmysite.com/com.snowplowanalytics.snowplow/ 		0
413 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://ec.editmysite.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.wicar.org
URL: http://www.wicar.org/test-malware.html
Protocol
HTTP/1.1
Server
54.69.19.209 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-69-19-209.us-west-2.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://www.wicar.org/test-malware.html
Origin
http://www.wicar.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Tue, 18 Dec 2018 04:20:51 GMT
Server
Apache-Coyote/1.1
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin
http://www.wicar.org
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/plain
Content-Length
0
index.html
ws.sharethis.com/secure5x/ Frame 7F2F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ws.sharethis.com/secure5x/index.html
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/async-buttons.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.219.46 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-219-46.deploy.static.akamaitechnologies.com
Software
nginx/1.12.2 /
Resource Hash

Request headers

Host
ws.sharethis.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://www.wicar.org/test-malware.html
Accept-Encoding
gzip, deflate, br
Cookie
__stid=ZGAPjFwYdaMAAAAUUHpkAw==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.wicar.org/test-malware.html

Response headers

Content-Encoding
gzip
Content-Type
text/html
ETag
W/"5bff75e9-3984"
Last-Modified
Thu, 29 Nov 2018 05:15:21 GMT
Server
nginx/1.12.2
Vary
Accept-Encoding
Content-Length
4117
Date
Tue, 18 Dec 2018 04:20:53 GMT
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

120 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| STATIC_BASE string| ASSETS_BASE string| STYLE_PREFIX function| $ function| jQuery object| Weebly object| _W function| publishedWBJP string| RECAPTCHA_PUBLIC_KEY string| INVISIBLE_RECAPTCHA_PUBLIC_KEY function| _ object| Mustache object| jQBrowser function| PlatformElement function| whenThemeCSSLoaded function| isThemeCSSLoaded function| blogCommentDisplayForm object| YTPlayer object| VimeoPlayer function| Sd function| Rd boolean| Cd function| videojs function| _V_ object| jsonrpc object| GlobalSnowplowNamespace function| _wsp function| getCartCount function| getCartNavElement function| reportCartNavElement function| initPublishedFlyoutMenus boolean| flyoutMenusRefreshable function| initEditorFlyoutMenus function| refreshNavCondense boolean| disableFlyouts function| FlyoutMenu function| objectify object| mejs function| MediaElement function| MediaElementPlayer function| require function| platformElementRequire function| initCustomerAccountsModels object| initEvt string| com_currentSite string| com_userID function| initFlyouts boolean| switchTo5x object| stlib function| _$d function| _$d0 function| _$d_ function| _$d1 function| _$d2 function| _$de function| _$dt object| _all_services boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus string| customProduct string| stWidgetVersion object| stButtons object| stWidget boolean| sop_pview_logged object| ShareThisEvent object| stLight boolean| st_showing boolean| opt_out undefined| windowHref object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| _gaq object| r function| snPlObR string| s object| regEx function| snowday object| doNotTrack object| jQuery18308860730710989102 boolean| lightboxLoaded object| navFlyoutMenu function| refreshPublishedFlyoutMenus object| Snowplow function| init_hash boolean| showHoverbarReskinned boolean| isEsiLoaded boolean| stShowNewMobileWidget boolean| isMobileButtonLoaded boolean| stRecentServices boolean| iswhatsappCustomButton boolean| isKikCustomButton boolean| stIsLoggedIn object| servicesLoggedIn object| stFastShareObj boolean| useFastShare object| stButtonsLib function| Shareable function| shareLog string| __stPubGA object| async_buttons function| foursquareCallback function| __stgetPubGA function| plusoneCallback boolean| openWidget object| _gat object| gaGlobal string| header string| baseURL string| messageSet

2 Cookies

Domain/Path Name / Value
.t.sharethis.com/ Name: pxcelPage_c010
Value: 0_11_1545106851798
.sharethis.com/ Name: __stid
Value: ZGAPjFwYdaMAAAAUUHpkAw==

2 Console Messages

Source Level URL
Text
console-api info URL: http://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1531158876(Line 7)
Message:
Download the Vue Devtools extension for a better development experience: https://github.com/vuejs/vue-devtools
console-api info URL: http://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1531158876(Line 7)
Message:
You are running Vue in development mode. Make sure to turn on production mode when deploying for production. See more tips at https://vuejs.org/guide/deployment.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
c.sharethis.mgr.consensu.org
cdn2.editmysite.com
count-server.sharethis.com
ec.editmysite.com
fonts.googleapis.com
fonts.gstatic.com
l.sharethis.com
malware.wicar.org
t.sharethis.com
w.sharethis.com
ws.sharethis.com
www.google-analytics.com
www.wicar.org
104.111.218.204
104.111.219.46
18.195.194.147
199.34.228.69
2.16.186.146
2.16.186.41
2607:ff18:80::615
2a00:1450:4001:809::200a
2a00:1450:4001:817::200a
2a00:1450:4001:81c::200e
2a00:1450:4001:821::2003
2a04:4e42::302
35.166.89.186
52.55.188.66
54.69.19.209
04742cb3d5ec78b22274103f49cffb8da319562194bad74acd2e89898b666460
0e3f83554765fa48514ce0a169441466f92010d01cdc716003e02317bffc6993
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1529c73abb48b223f2c5337afea8ab4f0cefe98348c17205c4c8161223608a43
2ceb98ecb7945f6423b5aedc10c0f346365c3fe3f599ca6b857e5665cb1b65be
3488c49147b809d1e457c14a37bf3a79b0455fd159c121325e8f737eea45eb75
516630dc137782b6ea784ed6891b487b8a2fff9be9ed921977008453039cc1fe
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3
6cc73aa4822bdc024366ba999d93b6a62c18b3ef40814f8f253dfc557075c22b
735dbfc4d964f12f9a6d639ac25b225413b77731ddbfe9f6f02da18f8009c5dd
81a2485f358b111ed0aa67424b95ebdefc15031afa5e81a141d7f6a2ffb96240
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
88977edfdc9d0c8916026ebd3737611160bf272728da352c7e983d52867dd495
8b9df301259fe620bc27f72d301056a3b6925853501542a3e66ed6940eacf39d
95dc1b83a7c030dd13ab3e29df921f10e04208b28734f172ea232854264c3b05
97875e1cc37494327341a6d4444231a16127ab958907b9e879a87eb99808c7a0
a3291fbf7d4957743266734a3787bb901028d597f6b6c9b986b0f32e992f39cb
adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49
aeae37bae2130513ef8b5ea4fde8fd776b32ff8969b848b59399a63d9455e29a
b477796605d635be2eab9b000106fd0468f27b9583bb509833c98d3165a06f0c
c0cfd2b54531b41a7b98600414c056cea05974d19e6ac6e6e7837d7600206dcc
d85f2d1d31a221ddcd51c0249cc5b90a1248ff72c43f6d8ed61d013b09745bda
db76301af6a5c920ee86c4b775c7038ef4e92fc0208322717d9655f3fa1ede3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4598c4de9b0cb9f51a572208fa909295ea8168c1d7fcb8941fee869706811a0
e6137374f011ef7f8a2a23b2dd5de55c5fa30836eb098e71016c2fd832fc0e70
f79af0ee328d223e6530d2b59c3f73302b73d32e2db7028bbb3f90c05f5c6d04
fd64e82222597fee43cab68d2e67881504d020d2624d657df4ef87a4528729e6
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be