ftp.s-sniffer.net Open in urlscan Pro
2400:cb00:2048:1::6818:6449 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ftp.s-sniffer.net/webmoney/
Submission: On September 20 via automatic, source phishtank (September 20th 2018, 12:08:11 am UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2400:cb00:2048:1::6818:6449, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ftp.s-sniffer.net.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on September 19th 2018. Valid for: a year.

This is the only time ftp.s-sniffer.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2400:cb00:204... 2400:cb00:2048:1::6818:6449	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7	91.227.52.69 91.227.52.69	56806 (ASCOM4S) (ASCOM4S)
8	2

1 2400:cb00:2048:1::6818:6449 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ftp.s-sniffer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 91.227.52.69 (Russian Federation)

ASN56806 (ASCOM4S, RU)

login.wmtransfer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	wmtransfer.com login.wmtransfer.com	42 KB
1	s-sniffer.net ftp.s-sniffer.net	3 KB
8	2

	Domain	Requested by
7	login.wmtransfer.com	ftp.s-sniffer.net
1	ftp.s-sniffer.net
8	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2018-09-19` - `2019-09-19`	a year	crt.sh
*.wmtransfer.com Network Solutions OV Server CA 2	`2016-03-22` - `2019-05-01`	3 years	crt.sh

This page contains 1 frames:

Primary Page: https://ftp.s-sniffer.net/webmoney/
Frame ID: CD904E1C02F3A40723BB4AF638061E46
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

44 kB
Transfer

116 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ftp.s-sniffer.net/webmoney/ 9 KB
3 KB 58ms
41ms Document
text/html 2400:cb00:2048:1::6818:6449
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://ftp.s-sniffer.net/webmoney/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2400:cb00:2048:1::6818:6449 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3a9065bf10da9fc05bb8188ad113da54621a1c11d8837797fa97a8b5e83d1521

Request headers

:method: GET
:authority: ftp.s-sniffer.net
:scheme: https
:path: /webmoney/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Thu, 20 Sep 2018 00:08:01 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d8cc94182ae54df42d7f49747a5a581a31537402081; expires=Fri, 20-Sep-19 00:08:01 GMT; path=/; domain=.s-sniffer.net; HttpOnly
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 45d00e1f2ad9976e-FRA
content-encoding: gzip

GET
H/1.1 200
OK /
login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/ 77 KB
14 KB 190ms
45ms Stylesheet
text/css 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to

Full URL: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
Requested by: Host: ftp.s-sniffer.net
URL: https://ftp.s-sniffer.net/webmoney/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: c08110eacf2201570d007b862d871d0b31434792198b4d1d7989da00e49ab693

Request headers

Referer: https://ftp.s-sniffer.net/webmoney/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Content-Encoding: gzip
ETag: "23ff884569e8097fcc52f9c09f1cb50832587539e4723477800114658038edc2c6d97518098e0fcd447bfd63a740a974f2ee91bb8d618b3cbdd37c551d328ea8"
Last-Modified: Wed, 19 Sep 2018 18:07:32 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/css; charset=utf-8
Via: 1.1 login.wmtransfer.com
Cache-Control: public, must-revalidate, max-age=2570371
Connection: Keep-Alive
Keep-Alive: timeout=30, max=100
Content-Length: 13582
Expires: Fri, 19 Oct 2018 18:07:32 GMT

GET
H/1.1 200
OK more.png
login.wmtransfer.com/assets/gate/img/ 701 B
1 KB 43ms
43ms Image
image/png 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/more.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 0576832d4903d586dcf13ea414efc21e1e6d9c2535b70a0437ed95cbcba8a7e8

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 10:16:38 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "85247849673d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=99
Content-Length: 701

GET
H/1.1 200
OK login-sprites.png
login.wmtransfer.com/assets/gate/img/ 18 KB
18 KB 87ms
43ms Image
image/png 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/login-sprites.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 40fb25aa3236b99537bffec0821bd461e1f3682599e43b1621d5c7f24c748813

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 10:14:45 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "fd8b136673d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=98
Content-Length: 18097

GET
H/1.1 200
OK light-24.png
login.wmtransfer.com/assets/gate/img/ 1 KB
2 KB 126ms
42ms Image
image/png 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/light-24.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 09ff86e63f7c5000a1e7a7e2b1073099508d9c268254150687b40158fd78dd0e

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 10:18:49 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "6daf7697673d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=100
Content-Length: 1411

GET
H/1.1 200
OK classic-24.png
login.wmtransfer.com/assets/gate/img/ 2 KB
2 KB 129ms
43ms Image
image/png 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/classic-24.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 6b7dd806a8bb63d586cc37a663cb5fe236ae140510c1132ff67817fadbe976cc

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 10:16:09 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "fb72ec37673d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=97
Content-Length: 1775

GET
H/1.1 200
OK login-password-24.png
login.wmtransfer.com/assets/gate/img/ 296 B
659 B 169ms
57ms Image
image/png 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.wmtransfer.com/assets/gate/img/login-password-24.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: e4ee2cb8966c1978efc93207ee8031c74f8c9b709b3b6683549128578e6de114

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Via: 1.1 login.wmtransfer.com
Last-Modified: Fri, 20 Jan 2017 10:16:10 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "93a9ad38673d21:0"
Content-Type: image/png
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=30, max=100
Content-Length: 296

GET
H/1.1 200
OK logo-webmoney-login.svg
login.wmtransfer.com/assets/gate/img/ 9 KB
4 KB 168ms
44ms Image
image/svg+xml 91.227.52.69
ASCOM4S

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.wmtransfer.com/assets/gate/img/logo-webmoney-login.svg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.227.52.69 , Russian Federation, ASN56806 (ASCOM4S, RU),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

056fcab5aed6f56fc16a26da0b1658979318b8a04a0e6a8babe0a04dcdbee512

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://login.wmtransfer.com/combres.axd/gate.css/5a995d22bf6ebe2180d915fb95983a5b0801cbd594babb67c33a02155bff627190ee1f7d89cf78e95b853db81bf377917073bec9f7b04cbf7d9dafa613750517/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 20 Sep 2018 00:08:01 GMT
Via: 1.1 login.wmtransfer.com
Vary: Accept-Encoding
Last-Modified: Thu, 07 Dec 2017 15:21:56 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
ETag: "c255461e6f6fd31:0-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Encoding: gzip
Keep-Alive: timeout=30, max=99
Content-Length: 3883

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.s-sniffer.net/	1970-01-19 03:48:58	Name: __cfduid Value: d8cc94182ae54df42d7f49747a5a581a31537402081

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ftp.s-sniffer.net
login.wmtransfer.com
2400:cb00:2048:1::6818:6449
91.227.52.69
056fcab5aed6f56fc16a26da0b1658979318b8a04a0e6a8babe0a04dcdbee512
0576832d4903d586dcf13ea414efc21e1e6d9c2535b70a0437ed95cbcba8a7e8
09ff86e63f7c5000a1e7a7e2b1073099508d9c268254150687b40158fd78dd0e
3a9065bf10da9fc05bb8188ad113da54621a1c11d8837797fa97a8b5e83d1521
40fb25aa3236b99537bffec0821bd461e1f3682599e43b1621d5c7f24c748813
6b7dd806a8bb63d586cc37a663cb5fe236ae140510c1132ff67817fadbe976cc
c08110eacf2201570d007b862d871d0b31434792198b4d1d7989da00e49ab693
e4ee2cb8966c1978efc93207ee8031c74f8c9b709b3b6683549128578e6de114

ftp.s-sniffer.net Open in urlscan Pro 2400:cb00:2048:1::6818:6449 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

44 kBTransfer

116 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

Indicators

ftp.s-sniffer.net Open in urlscan Pro
2400:cb00:2048:1::6818:6449 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

44 kB
Transfer

116 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions