fevreka.com Open in urlscan Pro
176.98.40.88 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qr.de/9ZQNrV
Effective URL:
https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Submission: On May 22 via manual (May 22nd 2024, 5:20:16 am UTC) from NL — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 176.98.40.88, located in Turkey and belongs to SKYVDS, TR. The main domain is fevreka.com.
TLS certificate: Issued by R3 on April 29th 2024. Valid for: 3 months.

This is the only time fevreka.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: International Card Services (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	188.40.28.36 188.40.28.36	24940 (HETZNER-AS) (HETZNER-AS)
1 1	52.59.165.42 52.59.165.42	16509 (AMAZON-02) (AMAZON-02)
10	176.98.40.88 176.98.40.88	207508 (SKYVDS) (SKYVDS)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
12	3

1 188.40.28.36 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: www256.your-server.de

qr.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.59.165.42 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: eu-ip-1.short.io

f3xm.short.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 176.98.40.88 (Turkey)

ASN207508 (SKYVDS, TR)
PTR: offeicialis.com

fevreka.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	fevreka.com fevreka.com	121 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380	31 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 237	5 KB
1	short.gy 1 redirects f3xm.short.gy	69 B
1	qr.de 1 redirects qr.de	288 B
12	5

	Domain	Requested by
10	fevreka.com	fevreka.com
1	ajax.googleapis.com	fevreka.com
1	cdnjs.cloudflare.com	fevreka.com
1	f3xm.short.gy	1 redirects
1	qr.de	1 redirects
12	5

This site contains no links.

Subject Issuer	Validity	Valid
*.fevreka.com R3	`2024-04-29` - `2024-07-28`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Frame ID: C696039C21207DF2D5B578240D1FE448
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://qr.de/9ZQNrV HTTP 302
https://f3xm.short.gy/hgPLJFn HTTP 302
https://fevreka.com/FOIN/new.php Page URL
https://fevreka.com/FOIN/2.php?session=664d808ada0dd Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Axios (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

157 kB
Transfer

375 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://qr.de/9ZQNrV HTTP 302
https://f3xm.short.gy/hgPLJFn HTTP 302
https://fevreka.com/FOIN/new.php Page URL
https://fevreka.com/FOIN/2.php?session=664d808ada0dd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://qr.de/9ZQNrV HTTP 302
https://f3xm.short.gy/hgPLJFn HTTP 302
https://fevreka.com/FOIN/new.php

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

new.php
fevreka.com/FOIN/
Redirect Chain

https://qr.de/9ZQNrV
https://f3xm.short.gy/hgPLJFn
https://fevreka.com/FOIN/new.php

91 B
440 B

526ms
99ms

Document
text/html

176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/new.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 87
content-type: text/html; charset=UTF-8
date: Wed, 22 May 2024 05:20:10 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding

Redirect headers

content-length: 0
date: Wed, 22 May 2024 05:20:11 GMT
location: https://fevreka.com/FOIN/new.php

GET
H2 200 Primary Request 2.php Show response
fevreka.com/FOIN/ 7 KB
2 KB 103ms
103ms Document
text/html 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/new.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 2b097828784ec71fa4aa8d9e0249427482444a974f388010ffce7edebb281af4

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://fevreka.com/FOIN/new.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: public, max-age=0
content-encoding: br
content-length: 1814
content-type: text/html; charset=UTF-8
date: Wed, 22 May 2024 05:20:11 GMT
expires: Wed, 22 May 2024 05:20:10 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H3 200 bootstrap.min.css
fevreka.com/FOIN/css2/ 159 KB
21 KB 51ms
51ms Stylesheet
text/css 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/css2/bootstrap.min.css
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
content-encoding: br
last-modified: Sun, 19 Dec 2021 02:21:25 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=10368000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 21193
expires: max-age=A10368000, public

GET
H3 200 style.css
fevreka.com/FOIN/css2/ 3 KB
922 B 55ms
54ms Stylesheet
text/css 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/css2/style.css
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 910897ec77032d0a11794e948e064a7987ec4f82b1230de7cc29c3c6e55880e3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
content-encoding: br
last-modified: Sun, 19 Dec 2021 05:29:06 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=10368000
accept-ranges: bytes
content-length: 877
expires: max-age=A10368000, public

GET
H3 200 logo.svg
fevreka.com/FOIN/img/ 12 KB
4 KB 56ms
55ms Image
image/svg+xml 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fevreka.com/FOIN/img/logo.svg
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 9c0c1ee6fe664464f2702f3ece60682252d922da056ecc4d240079be8a37a711

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
content-encoding: br
last-modified: Sun, 19 Dec 2021 02:23:13 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=10368000
accept-ranges: bytes
content-length: 4499
expires: max-age=A10368000, public

GET
H3 200 axios.min.js Show response
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ 14 KB
5 KB 42ms
23ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js

Requested by

Host: fevreka.com
URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1145039
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Tue, 22 Dec 2020 05:22:54 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fe182ae-3813"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k3meo41b9CQ1hN89U4IcRbD6nGp5KN88vyke5rB14SpEX%2FAXj%2BT%2BcbUj87%2BFRwazsBi6cRg5Pyc7oX3CAlA%2FxLtfzrweon9%2BvcOg6Kk3Ya5TIMultAByf7kBPmFW2IsMrATFzlV1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 887a5b0b8fc95d9f-FRA
expires: Mon, 12 May 2025 05:20:12 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 127ms
35ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: fevreka.com
URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 21 May 2024 14:17:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54179
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 May 2025 14:17:13 GMT

GET
H3 200 SunOT-Regular.woff2
fevreka.com/FOIN/css2/fonts/ 27 KB
27 KB 53ms
52ms Font
application/font-woff2 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/css2/fonts/SunOT-Regular.woff2
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/css2/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 33614fb78d209168a3a4cd90bcc0af25e3982e9ef5c2aa192daeb02812ed4137

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/css2/style.css
Origin: https://fevreka.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
last-modified: Sun, 19 Dec 2021 04:48:55 GMT
server: LiteSpeed
content-type: application/font-woff2
cache-control: public, max-age=10368000
accept-ranges: bytes
content-length: 27284
expires: max-age=A10368000, public

GET
H3 200 icons.woff
fevreka.com/FOIN/css2/fonts/ 11 KB
11 KB 71ms
71ms Font
x-font/woff 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/css2/fonts/icons.woff
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/css2/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: c1f3874cc3f5467a309962d1f127dc7c0f5bfdba58e6084a779d4dacefcefb8d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/css2/style.css
Origin: https://fevreka.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
last-modified: Sun, 19 Dec 2021 02:23:45 GMT
server: LiteSpeed
content-type: x-font/woff
cache-control: public, max-age=0
accept-ranges: bytes
content-length: 11160
expires: max-age=A10368000, public

GET
H3 200 SunOT-Light.woff2
fevreka.com/FOIN/css2/fonts/ 27 KB
27 KB 80ms
79ms Font
application/font-woff2 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/css2/fonts/SunOT-Light.woff2
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/css2/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 0c1a127d9d0097a2459b13c9b28c764baf2453925b9272e0dd866bc5982aed4b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/css2/style.css
Origin: https://fevreka.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
last-modified: Sun, 19 Dec 2021 04:48:55 GMT
server: LiteSpeed
content-type: application/font-woff2
cache-control: public, max-age=10368000
accept-ranges: bytes
content-length: 27208
expires: max-age=A10368000, public

GET
H3 200 SunOT-SemiBold.woff2
fevreka.com/FOIN/css2/fonts/ 27 KB
27 KB 97ms
97ms Font
application/font-woff2 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/FOIN/css2/fonts/SunOT-SemiBold.woff2
Requested by: Host: fevreka.com
URL: https://fevreka.com/FOIN/css2/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 4954682d5d7c93b356e5999ec80baa32b9f59eb1f0c61c4834a4c1efa46640ed

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/css2/style.css
Origin: https://fevreka.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 22 May 2024 05:20:11 GMT
last-modified: Sun, 19 Dec 2021 04:48:55 GMT
server: LiteSpeed
content-type: application/font-woff2
cache-control: public, max-age=10368000
accept-ranges: bytes
content-length: 27208
expires: max-age=A10368000, public

GET
H3 404 favicon.ico
fevreka.com/ 1 KB
1 KB 51ms
51ms Other
text/html 176.98.40.88
SKYVDS

General

Check archive.org

Show headers Download Go to

Full URL: https://fevreka.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 176.98.40.88 , Turkey, ASN207508 (SKYVDS, TR),
Reverse DNS: offeicialis.com
Software: LiteSpeed /
Resource Hash: 5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fevreka.com/FOIN/2.php?session=664d808ada0dd
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 22 May 2024 05:20:11 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
server: LiteSpeed
content-length: 1238
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: International Card Services (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| axios function| $ function| jQuery

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
qr.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: c2978bfed0079d05250595777b60148e
qr.de/	1970-01-20 20:46:02	Name: qr_test Value: 1716355211
fevreka.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 22ccd434ad0683fe7f57a53c4f5c30f0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://fevreka.com/FOIN/2.php?session=664d808ada0dd Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://fevreka.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
f3xm.short.gy
fevreka.com
qr.de
104.17.25.14
176.98.40.88
188.40.28.36
2a00:1450:4001:813::200a
52.59.165.42
0c1a127d9d0097a2459b13c9b28c764baf2453925b9272e0dd866bc5982aed4b
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
2b097828784ec71fa4aa8d9e0249427482444a974f388010ffce7edebb281af4
33614fb78d209168a3a4cd90bcc0af25e3982e9ef5c2aa192daeb02812ed4137
4954682d5d7c93b356e5999ec80baa32b9f59eb1f0c61c4834a4c1efa46640ed
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
910897ec77032d0a11794e948e064a7987ec4f82b1230de7cc29c3c6e55880e3
9c0c1ee6fe664464f2702f3ece60682252d922da056ecc4d240079be8a37a711
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
c1f3874cc3f5467a309962d1f127dc7c0f5bfdba58e6084a779d4dacefcefb8d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

fevreka.com Open in urlscan Pro 176.98.40.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

3 IPs

3 Countries

157 kBTransfer

375 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

fevreka.com Open in urlscan Pro
176.98.40.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

157 kB
Transfer

375 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!