web6682.web07.bero-webspace.de Open in urlscan Pro
109.71.253.24 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://s.id/li2i0n
Effective URL:
https://web6682.web07.bero-webspace.de/schuld/financien.html
Submission: On October 22 via manual (October 22nd 2021, 9:27:13 am UTC) from NL — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 3 countries across 3 domains to perform 17 HTTP transactions. The main IP is 109.71.253.24, located in and belongs to SYNLINQ synlinq.de, DE. The main domain is web6682.web07.bero-webspace.de.
TLS certificate: Issued by R3 on October 21st 2021. Valid for: 3 months.

This is the only time web6682.web07.bero-webspace.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	45.126.59.196 45.126.59.196	132647 (IDNIC-PAN...) (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia)
1 1	2606:4700::68... 2606:4700::6810:f34e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	109.71.253.24 109.71.253.24	44486 (SYNLINQ s...) (SYNLINQ synlinq.de)
17	1

1 45.126.59.196 (Indonesia) 1 redirects

ASN132647 (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia, ID)

s.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:f34e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

shorten-link.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 109.71.253.24 (None, )

ASN44486 (SYNLINQ synlinq.de, DE)
PTR: web07.bero-host.de

web6682.web07.bero-webspace.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	bero-webspace.de web6682.web07.bero-webspace.de	239 KB
1	shorten-link.io 1 redirects shorten-link.io	247 B
1	s.id 1 redirects s.id	746 B
17	3

	Domain	Requested by
17	web6682.web07.bero-webspace.de	web6682.web07.bero-webspace.de
1	shorten-link.io	1 redirects
1	s.id	1 redirects
17	3

This site contains no links.

Subject Issuer	Validity	Valid
web6682.web07.bero-webspace.de R3	`2021-10-21` - `2022-01-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://web6682.web07.bero-webspace.de/schuld/financien.html
Frame ID: 9494D7928249C2556AA513783E74F515
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Mijn Overheid | Belastingdienst

Page URL History Show full URLs

https://s.id/li2i0n HTTP 301
https://shorten-link.io/dkffjer22 HTTP 302
https://web6682.web07.bero-webspace.de/schuld/financien.html Page URL

Page Statistics

17
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

3
Countries

239 kB
Transfer

591 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s.id/li2i0n HTTP 301
https://shorten-link.io/dkffjer22 HTTP 302
https://web6682.web07.bero-webspace.de/schuld/financien.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request financien.html Show response web6682.web07.bero-webspace.de/schuld/ Redirect Chain https://s.id/li2i0n https://shorten-link.io/dkffjer22 https://web6682.web07.bero-webspace.de/schuld/financien.html	13 KB 3 KB	57ms 16ms	Document text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `68f98a79119a895d8b07ac265000aceb29736edf85c7d012e149025906a49c80` Request headers :method GET :authority web6682.web07.bero-webspace.de :scheme https :path /schuld/financien.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Fri, 22 Oct 2021 09:27:09 GMT content-type text/html last-modified Thu, 21 Oct 2021 23:07:42 GMT etag W/"6171f2be-342d" x-powered-by PleskLin content-encoding br Redirect headers date Fri, 22 Oct 2021 09:27:09 GMT content-type text/html; charset=utf-8 location https://web6682.web07.bero-webspace.de/schuld/financien.html cache-control private cf-cache-status MISS expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 6a21b02a098759e3-MXP
GET H2	200	marktplaats.css web6682.web07.bero-webspace.de/schuld/FOD/	103 KB 12 KB	46ms 45ms	Stylesheet text/css	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `398d74f87682fe45a49629d5ff966191f84310ad409efa2ff47a9affc3a5f0bf` Request headers :path /schuld/FOD/marktplaats.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br etag W/"6171715e-19a85" last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin content-type text/css
GET H2	200	client.min.css web6682.web07.bero-webspace.de/schuld/FOD/	120 KB 15 KB	42ms 41ms	Stylesheet text/css	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/client.min.css Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `6b0eedcff94b6a63aa4726b01dd0cd284710ca8b73f35ea018e141f9b778c758` Request headers :path /schuld/FOD/client.min.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br etag W/"6171715e-1df98" last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin content-type text/css
GET H2	200	normalize.112272e5.css web6682.web07.bero-webspace.de/schuld/FOD/	6 KB 2 KB	46ms 45ms	Stylesheet text/css	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/normalize.112272e5.css Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `580818700724d42d7fcc4979b0197971fca1c6d2e0286769237a0ac897df5512` Request headers :path /schuld/FOD/normalize.112272e5.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br etag W/"6171715e-17fa" last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin content-type text/css
GET H2	200	common.js.download Show response web6682.web07.bero-webspace.de/schuld/FOD/	78 KB 27 KB	43ms 43ms	Script application/javascript	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/common.js.download Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `bfe8034d6da06a3fb17b45b8d3813aa8e8e47b3bf650274da27eee2b2a47b0cb` Request headers :path /schuld/FOD/common.js.download pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br etag W/"6171715e-136e8" last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin content-type application/javascript
GET H2	200	util.js.download Show response web6682.web07.bero-webspace.de/schuld/FOD/	143 KB 50 KB	33ms 33ms	Script application/javascript	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/util.js.download Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `584a2c05476de8bbc369a9094e3a888c305a750bf7f6282358a24419ba3c3eaf` Request headers :path /schuld/FOD/util.js.download pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br etag W/"6171715e-23a6c" last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin content-type application/javascript
GET H2	200	fod_logo.jpg web6682.web07.bero-webspace.de/schuld/FOD/	8 KB 8 KB	15ms 15ms	Image image/jpeg	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/fod_logo.jpg Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `daa392a442e0815ae90396224b9f6b0580cc98bbd3eb6f7c2e1f79a3c8689251` Request headers :path /schuld/FOD/fod_logo.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin etag "6171715e-2048" content-type image/jpeg accept-ranges bytes content-length 8264
GET H2	200	obp.dff79601.svg web6682.web07.bero-webspace.de/schuld/FOD/	4 KB 4 KB	14ms 14ms	Image image/svg+xml	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/obp.dff79601.svg Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `0a13f7a510e9cb674c985ada9d5aa5e11b35c907cca576232354f55be52b9e57` Request headers :path /schuld/FOD/obp.dff79601.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin etag "6171715e-eae" content-type image/svg+xml accept-ranges bytes content-length 3758
GET H2	200	js Show response web6682.web07.bero-webspace.de/schuld/FOD/	116 KB 116 KB	35ms 35ms	Script application/octet-stream	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/js Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/financien.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / PleskLin Resource Hash `cffd79ef5ba4424fdd951858e19523ad61fc440df90e251c60f658dd8ecdf418` Request headers :path /schuld/FOD/js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/financien.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/financien.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT last-modified Thu, 21 Oct 2021 13:55:42 GMT server nginx x-powered-by PleskLin etag "6171715e-1d067" content-type application/octet-stream accept-ranges bytes content-length 118887
GET H2	404	bancontact.svg web6682.web07.bero-webspace.de/schuld/FOD/	808 B 808 B	41ms 41ms	Image text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/bancontact.svg Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash `b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187` Request headers :path /schuld/FOD/bancontact.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Marktplaats.Sprite.svg web6682.web07.bero-webspace.de/schuld/FOD/	808 B 808 B	39ms 38ms	Image text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Marktplaats.Sprite.svg Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash `b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187` Request headers :path /schuld/FOD/Marktplaats.Sprite.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Roboto-Light-webfont.woff2 web6682.web07.bero-webspace.de/schuld/FOD/	0 0	39ms 38ms	Font text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Light-webfont.woff2 Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash Request headers :path /schuld/FOD/Roboto-Light-webfont.woff2 pragma no-cache origin https://web6682.web07.bero-webspace.de accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Origin https://web6682.web07.bero-webspace.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Roboto-Regular-webfont.woff2 web6682.web07.bero-webspace.de/schuld/FOD/	0 0	38ms 37ms	Font text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Regular-webfont.woff2 Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash Request headers :path /schuld/FOD/Roboto-Regular-webfont.woff2 pragma no-cache origin https://web6682.web07.bero-webspace.de accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Origin https://web6682.web07.bero-webspace.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Roboto-Regular-webfont.woff web6682.web07.bero-webspace.de/schuld/FOD/	0 0	15ms 15ms	Font text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Regular-webfont.woff Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash Request headers :path /schuld/FOD/Roboto-Regular-webfont.woff pragma no-cache origin https://web6682.web07.bero-webspace.de accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Origin https://web6682.web07.bero-webspace.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Roboto-Light-webfont.woff web6682.web07.bero-webspace.de/schuld/FOD/	0 0	22ms 22ms	Font text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Light-webfont.woff Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash Request headers :path /schuld/FOD/Roboto-Light-webfont.woff pragma no-cache origin https://web6682.web07.bero-webspace.de accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Origin https://web6682.web07.bero-webspace.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Roboto-Regular-webfont.ttf web6682.web07.bero-webspace.de/schuld/FOD/	0 0	15ms 15ms	Font text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Regular-webfont.ttf?v1 Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash Request headers :path /schuld/FOD/Roboto-Regular-webfont.ttf?v1 pragma no-cache origin https://web6682.web07.bero-webspace.de accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Origin https://web6682.web07.bero-webspace.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html
GET H2	404	Roboto-Light-webfont.ttf web6682.web07.bero-webspace.de/schuld/FOD/	0 0	14ms 14ms	Font text/html	109.71.253.24 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Light-webfont.ttf?v1 Requested by Host: web6682.web07.bero-webspace.de URL: https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 109.71.253.24 -, , ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS web07.bero-host.de Software nginx / Resource Hash Request headers :path /schuld/FOD/Roboto-Light-webfont.ttf?v1 pragma no-cache origin https://web6682.web07.bero-webspace.de accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode cors accept / cache-control no-cache sec-fetch-dest font :authority web6682.web07.bero-webspace.de referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css :scheme https sec-fetch-site same-origin :method GET Referer https://web6682.web07.bero-webspace.de/schuld/FOD/marktplaats.css Origin https://web6682.web07.bero-webspace.de Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 22 Oct 2021 09:27:09 GMT content-encoding br last-modified Thu, 21 Oct 2021 23:57:52 GMT server nginx etag W/"328-5cee5a9a77ecd" content-type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Regular-webfont.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Marktplaats.Sprite.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/bancontact.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Light-webfont.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Regular-webfont.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Light-webfont.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Regular-webfont.ttf?v1 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://web6682.web07.bero-webspace.de/schuld/FOD/Roboto-Light-webfont.ttf?v1 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s.id
shorten-link.io
web6682.web07.bero-webspace.de
109.71.253.24
2606:4700::6810:f34e
45.126.59.196
0a13f7a510e9cb674c985ada9d5aa5e11b35c907cca576232354f55be52b9e57
398d74f87682fe45a49629d5ff966191f84310ad409efa2ff47a9affc3a5f0bf
580818700724d42d7fcc4979b0197971fca1c6d2e0286769237a0ac897df5512
584a2c05476de8bbc369a9094e3a888c305a750bf7f6282358a24419ba3c3eaf
68f98a79119a895d8b07ac265000aceb29736edf85c7d012e149025906a49c80
6b0eedcff94b6a63aa4726b01dd0cd284710ca8b73f35ea018e141f9b778c758
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
bfe8034d6da06a3fb17b45b8d3813aa8e8e47b3bf650274da27eee2b2a47b0cb
cffd79ef5ba4424fdd951858e19523ad61fc440df90e251c60f658dd8ecdf418
daa392a442e0815ae90396224b9f6b0580cc98bbd3eb6f7c2e1f79a3c8689251

web6682.web07.bero-webspace.de Open in urlscan Pro 109.71.253.24 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

1 IPs

3 Countries

239 kBTransfer

591 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

8 Console Messages

Indicators

web6682.web07.bero-webspace.de Open in urlscan Pro
109.71.253.24 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

3
Countries

239 kB
Transfer

591 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!