www2.popuser.easywan.net Open in urlscan Pro
195.234.152.104 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www2.popuser.easywan.net/
Submission: On January 09 via automatic, source certstream-suspicious (January 9th 2024, 11:48:27 am UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 195.234.152.104, located in Germany and belongs to GTT-BACKBONE GTT, US. The main domain is www2.popuser.easywan.net.
TLS certificate: Issued by R3 on January 9th 2024. Valid for: 3 months.

This is the only time www2.popuser.easywan.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
9	195.234.152.104 195.234.152.104		3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
9	1

9 195.234.152.104 (Germany)

ASN3257 (GTT-BACKBONE GTT, US)
PTR: lb01.easywan.net

www2.popuser.easywan.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	easywan.net www2.popuser.easywan.net	16 KB
9	1

	Domain	Requested by
9	www2.popuser.easywan.net	www2.popuser.easywan.net
9	1

This site contains no links.

Subject Issuer	Validity	Valid
www2.popuser.easywan.net R3	`2024-01-09` - `2024-04-08`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://www2.popuser.easywan.net/
Frame ID: 037A55A4EF306F15EF68F15477D01158
Requests: 1 HTTP requests in this frame

Frame: https://www2.popuser.easywan.net/menu.php
Frame ID: EC5C61DBBB9BA103714C866799DE1B48
Requests: 2 HTTP requests in this frame

Frame: https://www2.popuser.easywan.net/orange.html
Frame ID: 7D5771C85404DBA6FE4F550DC3385FE9
Requests: 1 HTTP requests in this frame

Frame: https://www2.popuser.easywan.net/inhalt.php
Frame ID: 3A9E0EB9B73EAF23D4DA48611D9DA342
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

easywan GmbH Version 1.3.1

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

16 kB
Transfer

17 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www2.popuser.easywan.net/	2 KB 1 KB	163ms 48ms	Document text/html	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www2.popuser.easywan.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `a1520b0122716b9ea8937c2c3cc7513a8a08f7e94ea85cdcbececf3dccb5bad7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 09 Jan 2024 11:48:22 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET H/1.1	200 OK	menu.php Show response www2.popuser.easywan.net/ Frame EC5C	342 B 483 B	47ms 47ms	Document text/html	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www2.popuser.easywan.net/menu.php Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `c32270cd8f80051fb3862e12e741b5e01464a6fe60407a381764340ef96827d1` Request headers Referer https://www2.popuser.easywan.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 09 Jan 2024 11:48:23 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET H/1.1	200 OK	orange.html Show response www2.popuser.easywan.net/ Frame 7D57	302 B 494 B	94ms 47ms	Document text/html	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www2.popuser.easywan.net/orange.html Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `31d70f49f3c72b4fcda1e914d973a356ba9d1ac84c5c17a1ffa0418171b796a0` Request headers Referer https://www2.popuser.easywan.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 09 Jan 2024 11:48:23 GMT ETag W/"12e-585b0349d0fc0" Last-Modified Thu, 04 Apr 2019 08:32:07 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET H/1.1	200 OK	inhalt.php Show response www2.popuser.easywan.net/ Frame 3A9E	3 KB 1 KB	137ms 47ms	Document text/html	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www2.popuser.easywan.net/inhalt.php Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `a923710a91ba44843b9f835443df2c6d27721215c21799188118201571bb8268` Request headers Referer https://www2.popuser.easywan.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 09 Jan 2024 11:48:23 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked
GET H/1.1	200 OK	www.popuser.easywan.net.gif www2.popuser.easywan.net/logos-extern/ Frame EC5C	2 KB 3 KB	90ms 47ms	Image image/gif	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www2.popuser.easywan.net/logos-extern/www.popuser.easywan.net.gif Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/menu.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `04a9879f3e70702db8759b80a2ed5678c9c9f70a1004da441a5f087ec5494edc` Request headers accept-language de-DE,de;q=0.9 Referer https://www2.popuser.easywan.net/menu.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Date Tue, 09 Jan 2024 11:48:23 GMT Last-Modified Thu, 04 Apr 2019 08:31:19 GMT Server nginx/1.18.0 (Ubuntu) ETag "94d-585b031c0a3c0" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 2381
GET H/1.1	200 OK	smb.css www2.popuser.easywan.net/ Frame 3A9E	2 KB 2 KB	48ms 48ms	Stylesheet text/css	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www2.popuser.easywan.net/smb.css Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/inhalt.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `4300e7423ed624538c21eb7ff23117b41112fb08b9526fcfb7f883115f85a593` Request headers accept-language de-DE,de;q=0.9 Referer https://www2.popuser.easywan.net/inhalt.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Date Tue, 09 Jan 2024 11:48:23 GMT Last-Modified Thu, 04 Apr 2019 08:32:07 GMT Server nginx/1.18.0 (Ubuntu) ETag "886-585b0349d0fc0" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 2182
GET H/1.1	200 OK	cookie.js Show response www2.popuser.easywan.net/ Frame 3A9E	1 KB 2 KB	47ms 47ms	Script application/javascript	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www2.popuser.easywan.net/cookie.js Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/inhalt.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `ade5fde3cac276d570a46e1e9f32dc77af15b93bfdf76151c7780a670f09c1e2` Request headers accept-language de-DE,de;q=0.9 Referer https://www2.popuser.easywan.net/inhalt.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Date Tue, 09 Jan 2024 11:48:23 GMT Last-Modified Thu, 04 Apr 2019 08:32:08 GMT Server nginx/1.18.0 (Ubuntu) ETag "57f-585b034ac5200" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 1407
GET H/1.1	200 OK	trans.gif www2.popuser.easywan.net/grafics/ Frame 3A9E	42 B 292 B	47ms 47ms	Image image/gif	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www2.popuser.easywan.net/grafics/trans.gif Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/inhalt.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `b5cb7e721223edeaabb7cad91570b4b75ac95371cb9a593d8fb6b49d3f6c7553` Request headers accept-language de-DE,de;q=0.9 Referer https://www2.popuser.easywan.net/inhalt.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Date Tue, 09 Jan 2024 11:48:23 GMT Last-Modified Thu, 04 Apr 2019 08:35:48 GMT Server nginx/1.18.0 (Ubuntu) ETag "2a-585b041c94100" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Content-Length 42
GET H/1.1	200 OK	login.jpg www2.popuser.easywan.net/grafics/ Frame 3A9E	6 KB 6 KB	49ms 49ms	Image image/jpeg	195.234.152.104 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www2.popuser.easywan.net/grafics/login.jpg Requested by Host: www2.popuser.easywan.net URL: https://www2.popuser.easywan.net/inhalt.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 195.234.152.104 , Germany, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS lb01.easywan.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `158c2854e874a9ac6c333d92a79cb2385be0e160118a06dc4d71e527afbce14d` Request headers accept-language de-DE,de;q=0.9 Referer https://www2.popuser.easywan.net/inhalt.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Date Tue, 09 Jan 2024 11:48:23 GMT Last-Modified Thu, 04 Apr 2019 08:35:49 GMT Server nginx/1.18.0 (Ubuntu) ETag "180d-585b041d88340" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 6157

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www2.popuser.easywan.net/	1969-12-31 23:59:59	Name: PHPSESSID Value:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www2.popuser.easywan.net
195.234.152.104
04a9879f3e70702db8759b80a2ed5678c9c9f70a1004da441a5f087ec5494edc
158c2854e874a9ac6c333d92a79cb2385be0e160118a06dc4d71e527afbce14d
31d70f49f3c72b4fcda1e914d973a356ba9d1ac84c5c17a1ffa0418171b796a0
4300e7423ed624538c21eb7ff23117b41112fb08b9526fcfb7f883115f85a593
a1520b0122716b9ea8937c2c3cc7513a8a08f7e94ea85cdcbececf3dccb5bad7
a923710a91ba44843b9f835443df2c6d27721215c21799188118201571bb8268
ade5fde3cac276d570a46e1e9f32dc77af15b93bfdf76151c7780a670f09c1e2
b5cb7e721223edeaabb7cad91570b4b75ac95371cb9a593d8fb6b49d3f6c7553
c32270cd8f80051fb3862e12e741b5e01464a6fe60407a381764340ef96827d1

www2.popuser.easywan.net Open in urlscan Pro 195.234.152.104 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

16 kBTransfer

17 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

Indicators

www2.popuser.easywan.net Open in urlscan Pro
195.234.152.104 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

16 kB
Transfer

17 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions