urlscan.io logo urlscan.io
SecurityTrails logo

ellefsen.be Open in urlscan Pro
51.210.38.95  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ellefsen.be/wp-admin/STRATO_LOGIN/apps/auth/error.php
Submission: On March 10 via api from IE — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 51.210.38.95, located in France and belongs to OVH, FR. The main domain is ellefsen.be.
TLS certificate: Issued by R3 on January 27th 2023. Valid for: 3 months.
This is the only time ellefsen.be was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Strato AG (Online)

Domain & IP information

IP Address AS Autonomous System
1 51.210.38.95 16276 (OVH)
1 2
Apex Domain
Subdomains		 Transfer
1 ellefsen.be
ellefsen.be
327 KB
1 1
Domain Requested by
1 ellefsen.be
1 1

This site contains links to these domains. Also see Links.

Domain
www.strato.de
my.hidrive.com
webmail.strato.com
www.youtube.com
Subject Issuer Validity Valid
ellefsen.be
R3		 2023-01-27 -
2023-04-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ellefsen.be/wp-admin/STRATO_LOGIN/apps/auth/error.php
Frame ID: 03AF39E6DD69C7F8EA52462373CC502E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

STRATO Kunden-Login | Schneller Zugang zu Ihren Produkten

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

392 kB
Transfer

764 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request error.php
ellefsen.be/wp-admin/STRATO_LOGIN/apps/auth/ 		580 KB
327 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ellefsen.be/wp-admin/STRATO_LOGIN/apps/auth/error.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.210.38.95 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
73fcdb68bdb3dc8228aef93a5b43661b769e48f23343cd05b404f6234369ad95

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 10 Mar 2023 21:25:29 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
vary
Accept-Encoding
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76868546c85c1adaa0ef82c36c651974b6508777eb6e86fe0b634ccb4cdf3686

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60f9b5203842a4fe2d52f7c96f3c57b755bbf8f347535469739bcc6f95a9c4b5

Request headers

Referer
Origin
https://ellefsen.be
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		34 KB
34 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8c78ba3845d49d4a688c86bd6498d721f5ab16841e29303f05b1a4f5016669a3

Request headers

Referer
Origin
https://ellefsen.be
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
application/x-font-woff
truncated
/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
efc029e0546f49ed87c043e09393a995468c2ab1a139332b3aca0fdbe93fe51e

Request headers

Referer
Origin
https://ellefsen.be
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3921e73297b13444ca101f904f7900ac82e3e52748c32fa9b3cad6c84f255f42

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		39 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
298db845b6461ec9f34e1d6322565eb9ec958199adb95806aafff4d6c03592d0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		49 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
02632fcbe02c55e405a6249f87d54725117884e44cf893d3ddeeb3785e437a0e

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		18 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c9ae0a8ed95a7a3bd3e407032b3dc24861c3bbce48e95dd9098751aed0e32583

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Strato AG (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| savepage_ShadowLoader

1 Cookies

Domain/Path Name / Value
ellefsen.be/ Name: PHPSESSID
Value: 4u3bo0el0qe08r8vd2jbl2si1e