dev4356.sviluppo.host Open in urlscan Pro
149.62.187.159 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/
Effective URL:
https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/
Submission: On October 25 via manual (October 25th 2025, 11:06:06 am UTC) from DE — Scanned from US

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 149.62.187.159, located in Italy and belongs to HOST-SPA Host SpA, IT. The main domain is dev4356.sviluppo.host.
TLS certificate: Issued by E8 on October 23rd 2025. Valid for: 3 months.

This is the only time dev4356.sviluppo.host was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Telekom (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.216.241.51 52.216.241.51	16509 (AMAZON-02) (AMAZON-02)
15	149.62.187.159 149.62.187.159	47242 (HOST-SPA ...) (HOST-SPA Host SpA)
19	2

1 52.216.241.51 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: s3-website-us-east-1.amazonaws.com

7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

15 149.62.187.159 (Italy)

ASN47242 (HOST-SPA Host SpA, IT)
PTR: w3009.shared.host.it

dev4356.sviluppo.host	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
15	sviluppo.host dev4356.sviluppo.host	569 KB
1	amazonaws.com 1 redirects 7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com	319 B
0	telekom.com Failed accounts.login.idm.telekom.com Failed
19	3

	Domain	Requested by
15	dev4356.sviluppo.host	dev4356.sviluppo.host
1	7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com	1 redirects
0	accounts.login.idm.telekom.com Failed	dev4356.sviluppo.host
19	3

This site contains no links.

Subject Issuer	Validity	Valid
dev4356.sviluppo.host E8	`2025-10-23` - `2026-01-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/
Frame ID: ABA652A8A73964E929090BA7E1AA80E0
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Telekom Login

Page URL History Show full URLs

http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ HTTP 307
https://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ HTTP 307
http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ HTTP 301
https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Page URL

Page Statistics

19
Requests

79 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

569 kB
Transfer

664 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ HTTP 307
https://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ HTTP 307
http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ HTTP 301
https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Redirect Chain http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ https://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ http://7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com/ https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/	55 KB 17 KB	1093ms 367ms	Document text/html	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software nginx / PHP/7.4.33 Resource Hash `d443b045d5afcffe647a4d1c10eeb017e5fe37f169859d1533c2badfd5ee6526` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding br content-length 17297 content-type text/html; charset=UTF-8 date Sat, 25 Oct 2025 11:06:08 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding,User-Agent x-powered-by PHP/7.4.33 Redirect headers Content-Length 0 Date Sat, 25 Oct 2025 11:06:08 GMT Location https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Server AmazonS3 x-amz-id-2 QOn8y0ZtwOwmyv18ZQ0Ou74Cf43af+meu/NiOBFe7Y5AlAh9Dl7HBJSdEL4UHkCog3TwgU0M0Hw= x-amz-request-id DK3S6D2D6RJAQDDQ
GET H2	200	scale-components.css dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/	59 KB 12 KB	176ms 174ms	Stylesheet text/css	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software nginx / Resource Hash `76b22ae956aaeef6c892cbed2ff2f7d97ff7e90fa416b781e072e0bb972d0d80` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers cache-control public, max-age=604800 content-encoding br etag "ec3a-68fb8bbd-34d649fa6712db67;br" expires Sat, 01 Nov 2025 11:06:08 GMT accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 11654 date Sat, 25 Oct 2025 11:06:08 GMT content-type text/css last-modified Fri, 24 Oct 2025 14:22:53 GMT server nginx vary Accept-Encoding,User-Agent
GET H2	200	login-26.26.1.css dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/	16 KB 5 KB	731ms 729ms	Stylesheet text/css	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/login-26.26.1.css Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software nginx / Resource Hash `76e6f68ba71dd7f93ffba9961ac10d0f7f7bd2d2ef7da9a2786257a141d617b7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers cache-control public, max-age=604800 content-encoding br etag "4079-68fb8bbd-7c5d903cadad4caf;br" expires Sat, 01 Nov 2025 11:06:08 GMT accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 4387 date Sat, 25 Oct 2025 11:06:08 GMT content-type text/css last-modified Fri, 24 Oct 2025 14:22:53 GMT server nginx vary Accept-Encoding,User-Agent
GET H2	200	logo.png dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/images/	1 KB 2 KB	729ms 728ms	Image image/png	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Show image Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/images/logo.png Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software nginx / Resource Hash `0667b50afadc8da61db4eb692d976519cf3c49f9d8a63c6ef7c883e720847551` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers cache-control public, max-age=604800 etag "4f0-68fb8bbd-abd459f4ba1e8dfb;;;" expires Sat, 01 Nov 2025 11:06:08 GMT accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1264 date Sat, 25 Oct 2025 11:06:08 GMT content-type image/png last-modified Fri, 24 Oct 2025 14:22:53 GMT server nginx vary User-Agent
POST H3	200	heartbeat.php Show response dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/	35 B 233 B	137ms 136ms	Fetch application/json	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/heartbeat.php Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / PHP/7.4.33 Resource Hash `bbba0aea7efc141ec573ca6162ccd36a59c50543f0d13ae9c7cf2ed7b0d8975e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers content-encoding br alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 39 date Sat, 25 Oct 2025 11:06:09 GMT content-type application/json x-powered-by PHP/7.4.33 vary Accept-Encoding,User-Agent server LiteSpeed
GET H3	200	bg.jpg dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/images/	401 KB 402 KB	403ms 403ms	Image image/jpeg	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Show image Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/images/bg.jpg Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/login-26.26.1.css Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / Resource Hash `ad1d8695e1595c989e0d0a0dfc1c89faf1da98a3ef8fe2f2d424eca4af7a11e6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/login-26.26.1.css Response headers cache-control public, max-age=604800 etag "644ac-68fb8bbd-3bbd641dfeb2dbfc;;;" expires Sat, 01 Nov 2025 11:06:09 GMT accept-ranges bytes content-length 410796 date Sat, 25 Oct 2025 11:06:09 GMT content-type image/jpeg last-modified Fri, 24 Oct 2025 14:22:53 GMT server LiteSpeed vary User-Agent
GET		TeleNeoWeb-ExtraBold.woff accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/	0 0

GET		TeleNeoWeb-Medium.woff accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/	0 0

GET		TeleNeoWeb-Bold.woff accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/	0 0

GET		TeleNeoWeb-Regular.woff accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/	0 0

GET H3	200	TeleNeoWeb-ExtraBold.woff2 dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//	65 KB 65 KB	133ms 133ms	Font font/woff2	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//TeleNeoWeb-ExtraBold.woff2 Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / Resource Hash `57e63f0bdefcf32d37bafd97b735cf4e86baffdba971dfb180e99395d1ff6e3b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Origin https://dev4356.sviluppo.host Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Response headers cache-control public, max-age=604800 etag "10380-68fb8bbd-2fa5a85991da4071;;;" expires Sat, 01 Nov 2025 11:06:10 GMT accept-ranges bytes content-length 66432 date Sat, 25 Oct 2025 11:06:10 GMT content-type font/woff2 last-modified Fri, 24 Oct 2025 14:22:53 GMT server LiteSpeed vary User-Agent
GET H3	404	TeleNeoWeb-Bold.woff2 dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//	0 0	133ms 132ms	Font text/html	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//TeleNeoWeb-Bold.woff2 Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Origin https://dev4356.sviluppo.host Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 1251 pragma no-cache date Sat, 25 Oct 2025 11:06:10 GMT content-type text/html vary User-Agent server LiteSpeed
GET H3	404	TeleNeoWeb-Medium.woff2 dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//	0 0	133ms 132ms	Font text/html	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//TeleNeoWeb-Medium.woff2 Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Origin https://dev4356.sviluppo.host Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 1251 pragma no-cache date Sat, 25 Oct 2025 11:06:10 GMT content-type text/html vary User-Agent server LiteSpeed
GET H3	200	TeleNeoWeb-Regular.woff2 dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//	65 KB 65 KB	132ms 131ms	Font font/woff2	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//TeleNeoWeb-Regular.woff2 Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / Resource Hash `19da9c1badf7913448c569ea95117f6975b6e55588508aa570f9bedc2d2efd28` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Origin https://dev4356.sviluppo.host Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/css/scale-components.css Response headers cache-control public, max-age=604800 etag "10428-68fb8bbd-8bdbd98102bbf3c6;;;" expires Sat, 01 Nov 2025 11:06:10 GMT accept-ranges bytes content-length 66600 date Sat, 25 Oct 2025 11:06:10 GMT content-type font/woff2 last-modified Fri, 24 Oct 2025 14:22:53 GMT server LiteSpeed vary User-Agent
GET H3	404	favicon.ico dev4356.sviluppo.host/	1 KB 1 KB	135ms 134ms	Other text/html	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / Resource Hash `4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 1251 pragma no-cache date Sat, 25 Oct 2025 11:06:10 GMT content-type text/html vary User-Agent server LiteSpeed
POST H3	200	heartbeat.php Show response dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/	35 B 120 B	135ms 135ms	Fetch application/json	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/heartbeat.php Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / PHP/7.4.33 Resource Hash `bbba0aea7efc141ec573ca6162ccd36a59c50543f0d13ae9c7cf2ed7b0d8975e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers content-encoding br content-length 39 date Sat, 25 Oct 2025 11:06:11 GMT content-type application/json x-powered-by PHP/7.4.33 vary Accept-Encoding,User-Agent server LiteSpeed
POST H3	200	heartbeat.php Show response dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/	35 B 76 B	146ms 145ms	Fetch application/json	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/heartbeat.php Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / PHP/7.4.33 Resource Hash `bbba0aea7efc141ec573ca6162ccd36a59c50543f0d13ae9c7cf2ed7b0d8975e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers content-encoding br content-length 39 date Sat, 25 Oct 2025 11:06:13 GMT content-type application/json x-powered-by PHP/7.4.33 vary Accept-Encoding,User-Agent server LiteSpeed
POST H3	200	heartbeat.php Show response dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/	35 B 76 B	136ms 133ms	Fetch application/json	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/heartbeat.php Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / PHP/7.4.33 Resource Hash `bbba0aea7efc141ec573ca6162ccd36a59c50543f0d13ae9c7cf2ed7b0d8975e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers content-encoding br content-length 39 date Sat, 25 Oct 2025 11:06:15 GMT content-type application/json x-powered-by PHP/7.4.33 vary Accept-Encoding,User-Agent server LiteSpeed
POST H3	200	heartbeat.php Show response dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/	35 B 76 B	135ms 134ms	Fetch application/json	149.62.187.159 HOST-SPA Host SpA
General Check archive.org Download Go to Full URL https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/includes/heartbeat.php Requested by Host: dev4356.sviluppo.host URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Protocol H3 Security QUIC, , AES_128_GCM Server 149.62.187.159 , Italy, ASN47242 (HOST-SPA Host SpA, IT), Reverse DNS w3009.shared.host.it Software LiteSpeed / PHP/7.4.33 Resource Hash `bbba0aea7efc141ec573ca6162ccd36a59c50543f0d13ae9c7cf2ed7b0d8975e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded Referer https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Response headers content-encoding br content-length 39 date Sat, 25 Oct 2025 11:06:17 GMT content-type application/json x-powered-by PHP/7.4.33 vary Accept-Encoding,User-Agent server LiteSpeed

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-ExtraBold.woff

Domain: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Medium.woff

Domain: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Bold.woff

Domain: accounts.login.idm.telekom.com
URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Regular.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Telekom (Telecommunication)

2 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| sendFinalHeartbeat function| sendHeartbeat

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dev4356.sviluppo.host/	1969-12-31 23:59:59	Name: PHPSESSID Value: ebbc737b0a5541e84ae275bd788f2f43

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Message: Access to font at 'https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-ExtraBold.woff' from origin 'https://dev4356.sviluppo.host' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-ExtraBold.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Message: Access to font at 'https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Bold.woff' from origin 'https://dev4356.sviluppo.host' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Bold.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Message: Access to font at 'https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Medium.woff' from origin 'https://dev4356.sviluppo.host' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Medium.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/ Message: Access to font at 'https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Regular.woff' from origin 'https://dev4356.sviluppo.host' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://accounts.login.idm.telekom.com/static/scale/scale-components//fonts/TeleNeoWeb/TeleNeoWeb-Regular.woff Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//TeleNeoWeb-Bold.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://dev4356.sviluppo.host/v2/v2/M2MM6676565D72F0AE4B1A0BE379DR456245/font//TeleNeoWeb-Medium.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://dev4356.sviluppo.host/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7fx7nue1a8omr28.s3-website-us-east-1.amazonaws.com
accounts.login.idm.telekom.com
dev4356.sviluppo.host
accounts.login.idm.telekom.com
149.62.187.159
52.216.241.51
0667b50afadc8da61db4eb692d976519cf3c49f9d8a63c6ef7c883e720847551
19da9c1badf7913448c569ea95117f6975b6e55588508aa570f9bedc2d2efd28
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
57e63f0bdefcf32d37bafd97b735cf4e86baffdba971dfb180e99395d1ff6e3b
76b22ae956aaeef6c892cbed2ff2f7d97ff7e90fa416b781e072e0bb972d0d80
76e6f68ba71dd7f93ffba9961ac10d0f7f7bd2d2ef7da9a2786257a141d617b7
ad1d8695e1595c989e0d0a0dfc1c89faf1da98a3ef8fe2f2d424eca4af7a11e6
bbba0aea7efc141ec573ca6162ccd36a59c50543f0d13ae9c7cf2ed7b0d8975e
d443b045d5afcffe647a4d1c10eeb017e5fe37f169859d1533c2badfd5ee6526

dev4356.sviluppo.host Open in urlscan Pro 149.62.187.159 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

19 Requests

79 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

569 kBTransfer

664 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Window variables

1 Cookies

11 Console Messages

Indicators

dev4356.sviluppo.host Open in urlscan Pro
149.62.187.159 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

79 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

569 kB
Transfer

664 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!