ftp.s-sniffer.top Open in urlscan Pro
2606:4700:30::681c:22d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ftp.s-sniffer.top/webmoney/
Submission: On September 30 via automatic, source phishtank (September 30th 2018, 10:00:41 pm UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700:30::681c:22d, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ftp.s-sniffer.top.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 30th 2018. Valid for: a year.

This is the only time ftp.s-sniffer.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:30:... 2606:4700:30::681c:22d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
6	91.200.28.69 91.200.28.69	43776 (RELSOFTCO...) (RELSOFTCOM-NET Relsoft Communications Route)
1	91.200.28.72 91.200.28.72	43776 (RELSOFTCO...) (RELSOFTCOM-NET Relsoft Communications Route)
8	3

1 2606:4700:30::681c:22d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ftp.s-sniffer.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 91.200.28.69 (Russian Federation)

ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU)

login.wmtransfer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.200.28.72 (Russian Federation)

ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU)

login.wmtransfer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	wmtransfer.com login.wmtransfer.com	42 KB
1	s-sniffer.top ftp.s-sniffer.top	3 KB
8	2

	Domain	Requested by
7	login.wmtransfer.com	ftp.s-sniffer.top
1	ftp.s-sniffer.top
8	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2018-09-30` - `2019-09-30`	a year	crt.sh
*.wmtransfer.com Network Solutions OV Server CA 2	`2016-03-22` - `2019-05-01`	3 years	crt.sh

This page contains 1 frames:

Primary Page: https://ftp.s-sniffer.top/webmoney/
Frame ID: 0CA6CF266D031BA72CDB90CBAEEF0984
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

44 kB
Transfer

116 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ftp.s-sniffer.top/webmoney/ 9 KB
3 KB 61ms
44ms Document
text/html 2606:4700:30::681c:22d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://ftp.s-sniffer.top/webmoney/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:30::681c:22d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a9065bf10da9fc05bb8188ad113da54621a1c11d8837797fa97a8b5e83d1521

Request headers

:method: GET
:authority: ftp.s-sniffer.top
:scheme: https
:path: /webmoney/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Sun, 30 Sep 2018 22:00:31 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d55c9be43cac320bcdc1a1f5dc3d88a5e1538344831; expires=Mon, 30-Sep-19 22:00:31 GMT; path=/; domain=.s-sniffer.top; HttpOnly
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4629f679d9809ab2-FRA
content-encoding: gzip

GET
H/1.1 200
OK /
login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/ 77 KB
14 KB 213ms
47ms Stylesheet
text/css 91.200.28.69
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
Requested by: Host: ftp.s-sniffer.top
URL: https://ftp.s-sniffer.top/webmoney/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.200.28.69 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: c08110eacf2201570d007b862d871d0b31434792198b4d1d7989da00e49ab693

Request headers

Referer: https://ftp.s-sniffer.top/webmoney/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Content-Encoding: gzip
ETag: "23ff884569e8097fcc52f9c09f1cb50832587539e4723477800114658038edc2c6d97518098e0fcd447bfd63a740a974f2ee91bb8d618b3cbdd37c551d328ea8"
Last-Modified: Sun, 30 Sep 2018 18:10:17 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/css; charset=utf-8
Via: 1.1 login.wmtransfer.com
Cache-Control: public, must-revalidate, max-age=2578186
Connection: Keep-Alive
Keep-Alive: timeout=30, max=100
Content-Length: 13582
Expires: Tue, 30 Oct 2018 18:10:17 GMT

GET
H/1.1 200
OK more.png
login.wmtransfer.com/assets/gate/img/ 701 B
1 KB 46ms
45ms Image
image/png 91.200.28.69
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/more.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.200.28.69 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 0576832d4903d586dcf13ea414efc21e1e6d9c2535b70a0437ed95cbcba8a7e8

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 13:36:44 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "612aa33d2273d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=99
Content-Length: 701

GET
H/1.1 200
OK login-sprites.png
login.wmtransfer.com/assets/gate/img/ 18 KB
18 KB 92ms
46ms Image
image/png 91.200.28.69
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/login-sprites.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.200.28.69 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 40fb25aa3236b99537bffec0821bd461e1f3682599e43b1621d5c7f24c748813

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 13:36:44 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "4e3a33d2273d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=98
Content-Length: 18097

GET
H/1.1 200
OK light-24.png
login.wmtransfer.com/assets/gate/img/ 1 KB
2 KB 137ms
45ms Image
image/png 91.200.28.69
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/light-24.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.200.28.69 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 09ff86e63f7c5000a1e7a7e2b1073099508d9c268254150687b40158fd78dd0e

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 13:36:44 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "2ab5a23d2273d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=97
Content-Length: 1411

GET
H/1.1 200
OK classic-24.png
login.wmtransfer.com/assets/gate/img/ 2 KB
2 KB 183ms
45ms Image
image/png 91.200.28.69
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/classic-24.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.200.28.69 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 6b7dd806a8bb63d586cc37a663cb5fe236ae140510c1132ff67817fadbe976cc

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 13:36:44 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "f8ea23d2273d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=96
Content-Length: 1775

GET
H/1.1 200
OK login-password-24.png
login.wmtransfer.com/assets/gate/img/ 296 B
659 B 227ms
45ms Image
image/png 91.200.28.69
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/login-password-24.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.200.28.69 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: e4ee2cb8966c1978efc93207ee8031c74f8c9b709b3b6683549128578e6de114

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 13:36:44 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "3cdca23d2273d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=95
Content-Length: 296

GET
H/1.1 200
OK logo-webmoney-login.svg
login.wmtransfer.com/assets/gate/img/ 9 KB
4 KB 228ms
42ms Image
image/svg+xml 91.200.28.72
RELSOFTCOM-NET Re...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.wmtransfer.com/assets/gate/img/logo-webmoney-login.svg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.200.28.72 , Russian Federation, ASN43776 (RELSOFTCOM-NET Relsoft Communications Route, RU),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

056fcab5aed6f56fc16a26da0b1658979318b8a04a0e6a8babe0a04dcdbee512

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 30 Sep 2018 22:00:30 GMT
Via: 1.1 login.wmtransfer.com
Vary: Accept-Encoding
Last-Modified: Thu, 07 Dec 2017 15:21:56 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "c255461e6f6fd31:0-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Encoding: gzip
Keep-Alive: timeout=30, max=100
Content-Length: 3883

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.s-sniffer.top/	1970-01-19 04:04:40	Name: __cfduid Value: d55c9be43cac320bcdc1a1f5dc3d88a5e1538344831

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ftp.s-sniffer.top
login.wmtransfer.com
2606:4700:30::681c:22d
91.200.28.69
91.200.28.72
056fcab5aed6f56fc16a26da0b1658979318b8a04a0e6a8babe0a04dcdbee512
0576832d4903d586dcf13ea414efc21e1e6d9c2535b70a0437ed95cbcba8a7e8
09ff86e63f7c5000a1e7a7e2b1073099508d9c268254150687b40158fd78dd0e
3a9065bf10da9fc05bb8188ad113da54621a1c11d8837797fa97a8b5e83d1521
40fb25aa3236b99537bffec0821bd461e1f3682599e43b1621d5c7f24c748813
6b7dd806a8bb63d586cc37a663cb5fe236ae140510c1132ff67817fadbe976cc
c08110eacf2201570d007b862d871d0b31434792198b4d1d7989da00e49ab693
e4ee2cb8966c1978efc93207ee8031c74f8c9b709b3b6683549128578e6de114

ftp.s-sniffer.top Open in urlscan Pro 2606:4700:30::681c:22d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

44 kBTransfer

116 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

Indicators

ftp.s-sniffer.top Open in urlscan Pro
2606:4700:30::681c:22d Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

44 kB
Transfer

116 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions