urlscan.io logo urlscan.io
SecurityTrails logo

www.cargokoehler.de Open in urlscan Pro
81.169.236.145  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://oracle-avant-testnet.blogspot.be/
Effective URL: https://www.cargokoehler.de/log1/i/flow/login.php
Submission: On July 06 via api from IE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 21 HTTP transactions. The main IP is 81.169.236.145, located in Germany and belongs to STRATO STRATO AG, DE. The main domain is www.cargokoehler.de.
TLS certificate: Issued by R3 on June 15th 2022. Valid for: 3 months.
This is the only time www.cargokoehler.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Twitter (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 3 2a00:1450:400... 15169 (GOOGLE)
9 81.169.236.145 6724 (STRATO ST...)
9 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
21 4
3    2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
oracle-avant-testnet.blogspot.be
oracle-avant-testnet.blogspot.com
9    81.169.236.145 (Germany)

ASN6724 (STRATO STRATO AG, DE)
PTR: h2916694.stratoserver.net
www.cargokoehler.de
9    2606:4700:10::ac43:2642 (United States)

ASN13335 (CLOUDFLARENET, US)
embed.tawk.to
va.tawk.to
2    2606:4700:10::6816:1983 (United States)

ASN13335 (CLOUDFLARENET, US)
va.tawk.to
embed.tawk.to
Apex Domain
Subdomains		 Transfer
11 tawk.to
embed.tawk.to — Cisco Umbrella Rank: 8273
va.tawk.to — Cisco Umbrella Rank: 7866
134 KB
9 cargokoehler.de
www.cargokoehler.de
81 KB
2 blogspot.com
oracle-avant-testnet.blogspot.com
16 KB
1 blogspot.be
oracle-avant-testnet.blogspot.be
441 B
21 4
Domain Requested by
9 www.cargokoehler.de oracle-avant-testnet.blogspot.com
www.cargokoehler.de
8 embed.tawk.to www.cargokoehler.de
embed.tawk.to
3 va.tawk.to embed.tawk.to
2 oracle-avant-testnet.blogspot.com 1 redirects
1 oracle-avant-testnet.blogspot.be 1 redirects
21 5

This site contains no links.

Subject Issuer Validity Valid
misc-sni.blogspot.com
GTS CA 1C3		 2022-06-06 -
2022-08-29		 3 months crt.sh
cargokoehler.de
R3		 2022-06-15 -
2022-09-13		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-28 -
2023-05-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.cargokoehler.de/log1/i/flow/login.php
Frame ID: B0E24B8A72DBF6E940F55E31C4536590
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Twitter

Page URL History Show full URLs

  1. http://oracle-avant-testnet.blogspot.be/ HTTP 302
    http://oracle-avant-testnet.blogspot.com/ HTTP 301
    https://oracle-avant-testnet.blogspot.com/ Page URL
  2. https://www.cargokoehler.de/log1/i/flow/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //embed\.tawk\.to
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

230 kB
Transfer

857 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://oracle-avant-testnet.blogspot.be/ HTTP 302
    http://oracle-avant-testnet.blogspot.com/ HTTP 301
    https://oracle-avant-testnet.blogspot.com/ Page URL
  2. https://www.cargokoehler.de/log1/i/flow/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://oracle-avant-testnet.blogspot.be/ HTTP 302
  • http://oracle-avant-testnet.blogspot.com/ HTTP 301
  • https://oracle-avant-testnet.blogspot.com/

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
oracle-avant-testnet.blogspot.com/
Redirect Chain
  • http://oracle-avant-testnet.blogspot.be/
  • http://oracle-avant-testnet.blogspot.com/
  • https://oracle-avant-testnet.blogspot.com/
70 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://oracle-avant-testnet.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
15174
content-type
text/html; charset=UTF-8
date
Wed, 06 Jul 2022 20:25:04 GMT
etag
W/"fb20361e7c848b661843cde01333cbc01e72dd684f44b732f3e6302c6fa42c38"
expires
Wed, 06 Jul 2022 20:25:04 GMT
last-modified
Wed, 06 Jul 2022 15:36:24 GMT
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

Cache-Control
private, max-age=0
Content-Encoding
gzip
Content-Length
185
Content-Security-Policy
frame-ancestors 'self'
Content-Type
text/html; charset=UTF-8
Date
Wed, 06 Jul 2022 20:25:04 GMT
Expires
Wed, 06 Jul 2022 20:25:04 GMT
Location
https://oracle-avant-testnet.blogspot.com/
Server
GSE
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Primary Request login.php
www.cargokoehler.de/log1/i/flow/ 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/login.php
Requested by
Host: oracle-avant-testnet.blogspot.com
URL: https://oracle-avant-testnet.blogspot.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PHP/7.3.33 PleskLin
Resource Hash
ae1e8d13b6bb654346aef617cb6990509c3587ec8f1922711a9d9e15bd849bb9

Request headers

Referer
https://oracle-avant-testnet.blogspot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1214
Content-Type
text/html; charset=UTF-8
Date
Wed, 06 Jul 2022 20:25:05 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Vary
Accept-Encoding
X-Powered-By
PHP/7.3.33 PleskLin
jquery-3.6.0.min.js
www.cargokoehler.de/log1/i/flow/js/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/js/jquery-3.6.0.min.js
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Dec 2021 02:13:54 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"15d9d-5d2c146543c80-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
30902
jquery.redirect.js
www.cargokoehler.de/log1/i/flow/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/js/jquery.redirect.js
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Dec 2021 04:30:54 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"18d2-5d2c330477b80-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2178
login.js
www.cargokoehler.de/log1/i/flow/js/ 		623 B
680 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/js/login.js
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
b126d9a214a72de525e4092536f8b196706433328d7bf122c295937d4ba99a10

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Dec 2021 12:39:08 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"26f-5d2ca02567300-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
323
bootstrap.min.js
www.cargokoehler.de/log1/i/flow/bootstrap/js/ 		61 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/bootstrap/js/bootstrap.min.js
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
4b24eee82c2b7ce85ace76193e8a25570dabc6863b94a60a42fa9bb6a37ddc72

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 Oct 2021 16:25:08 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"f3e8-5cf6c27668100-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
15286
bootstrap.min.css
www.cargokoehler.de/log1/i/flow/bootstrap/css/ 		158 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/bootstrap/css/bootstrap.min.css
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Content-Encoding
gzip
Last-Modified
Thu, 28 Oct 2021 16:25:08 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"278e1-5cf6c27668100-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
24150
style.css
www.cargokoehler.de/log1/i/flow/css/ 		2 KB
893 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cargokoehler.de/log1/i/flow/css/style.css
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
a31468a8bcc6a38df3e647708976a861d3579155082a3dc8ec193a58b73f7d38

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Content-Encoding
gzip
Last-Modified
Fri, 10 Dec 2021 10:11:38 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"717-5d2c7f2d62a80-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
549
twitter.png
www.cargokoehler.de/log1/i/flow/img/ 		787 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cargokoehler.de/log1/i/flow/img/twitter.png
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
a6cdb2fe9d4f3c136d30f4e57f96a0aa063ddb093c1c6fefcf3943eee3e834b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Last-Modified
Fri, 10 Dec 2021 03:55:52 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"313-5d2c2b2fd8200"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
787
Other.png
www.cargokoehler.de/log1/i/flow/img/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cargokoehler.de/log1/i/flow/img/Other.png
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
81.169.236.145 , Germany, ASN6724 (STRATO STRATO AG, DE),
Reverse DNS
h2916694.stratoserver.net
Software
Apache / PleskLin
Resource Hash
52662b26c92fe84babf58925f433fc700d615fac6e8c303231912c66a6f0dd5e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/log1/i/flow/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 06 Jul 2022 20:25:05 GMT
Last-Modified
Fri, 10 Dec 2021 04:05:52 GMT
Server
Apache
X-Powered-By
PleskLin
ETag
"1138-5d2c2d6c0c800"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4408
1g76ik1r1
embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/ 		2 KB
1020 B 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Requested by
Host: www.cargokoehler.de
URL: https://www.cargokoehler.de/log1/i/flow/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a64beb2b04d49987241b23aa3130a829871eece47ae45837221e0580346eaeb8
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
server
cloudflare
etag
W/"stable-v4-62835fee0eb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, s-maxage=3600
strict-transport-security
max-age=0; includeSubDomains; preload
cf-ray
726b1150bb369bd4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
twk-main.js
embed.tawk.to/_s/v4/app/62835fee0eb/js/ 		121 B
275 B 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-main.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
14095
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:36 GMT
server
cloudflare
etag
W/"da5bb1dc647470204df0e49f5afac2de"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b1151cd369bd4-FRA
twk-vendor.js
embed.tawk.to/_s/v4/app/62835fee0eb/js/ 		76 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-vendor.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5958b8f2069b0a3292ed7a9db46b8109adac7e81591238557125893ee7e87bb7
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
14095
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:36 GMT
server
cloudflare
etag
W/"7dcb496e4882926f93f2e73fa87062c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b1151cd3a9bd4-FRA
twk-chunk-vendors.js
embed.tawk.to/_s/v4/app/62835fee0eb/js/ 		206 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-chunk-vendors.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5b1592fa8ab8256ceae1cf00cbe53ad23b82f85964514f421492df2a8735d2f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
14095
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:36 GMT
server
cloudflare
etag
W/"0022ca6ee8862a21867d497826b1d4ab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b1151cd3e9bd4-FRA
twk-chunk-common.js
embed.tawk.to/_s/v4/app/62835fee0eb/js/ 		157 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-chunk-common.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f0aef9670e1b3f32b79f61f847d0f470c062a9d17ff4c0a8ce2517710ff3411
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
14095
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:36 GMT
server
cloudflare
etag
W/"a971da9828a19bc856261914c19bc242"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b1151cd3f9bd4-FRA
twk-runtime.js
embed.tawk.to/_s/v4/app/62835fee0eb/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-runtime.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
161f78f0d9ea5a5025a082c14b694df6ca43e2d48db62ee35f3368ff3da02cc1
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
14095
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:36 GMT
server
cloudflare
etag
W/"a15483b174cf94cb489a53ce9789161d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b1151cd409bd4-FRA
twk-app.js
embed.tawk.to/_s/v4/app/62835fee0eb/js/ 		151 B
208 B 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-app.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/62c3e1ccb0d10b6f3e7ad4ab/1g76ik1r1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
Origin
https://www.cargokoehler.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
14095
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:36 GMT
server
cloudflare
etag
W/"e736e189edb5d0d9d5b8e7f23dd9114a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b1151cd439bd4-FRA
widget-settings
va.tawk.to/v1/ 		3 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://va.tawk.to/v1/widget-settings?propertyId=62c3e1ccb0d10b6f3e7ad4ab&widgetId=1g76ik1r1&sv=undefined
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-chunk-common.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f21e99abe3dd3d1cca56b3523085e7026314de044474edcdc933f31754240fd2
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
visitor-application-preemptive-k4gq
server
cloudflare
etag
W/"2-2-0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
access-control-allow-methods
GET,OPTIONS
content-type
application/json
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=7200, s-maxage=1800
cf-ray
726b1152cef79bd4-FRA
access-control-allow-headers
content-type,x-tawk-token
start
va.tawk.to/v1/session/ 		60 B
438 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://va.tawk.to/v1/session/start
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-chunk-common.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:1983 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
138180bb51412a7b5c7d22ac7aeff4b8450080a6588984807afa9618dafff7fb
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.cargokoehler.de/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type
application/json; charset=utf-8

Response headers

date
Wed, 06 Jul 2022 20:25:06 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
60
x-served-by
visitor-application-preemptive-9lvz
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
access-control-allow-methods
POST,OPTIONS
content-type
application/json
access-control-allow-origin
https://www.cargokoehler.de
vary
Accept-Encoding
access-control-allow-credentials
true
cf-ray
726b11541f6b9268-FRA
access-control-allow-headers
content-type,x-tawk-token
start
va.tawk.to/v1/session/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://va.tawk.to/v1/session/start
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:2642 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.cargokoehler.de
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-tawk-token
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://www.cargokoehler.de
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
726b1152df189bd4-FRA
date
Wed, 06 Jul 2022 20:25:05 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
strict-transport-security
max-age=0; includeSubDomains; preload
x-content-type-options
nosniff
x-served-by
visitor-application-preemptive-1fk0
en.js
embed.tawk.to/_s/v4/app/62835fee0eb/languages/ 		16 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://embed.tawk.to/_s/v4/app/62835fee0eb/languages/en.js
Requested by
Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/62835fee0eb/js/twk-chunk-common.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:1983 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2a37b3244a9a215cc8c90b8bc11388c4fd8b2dd23d415acfccf16e3224250d7
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.cargokoehler.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 20:25:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
1617544
x-cache-status
HIT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 17 May 2022 08:44:37 GMT
server
cloudflare
etag
W/"5a13c5b16c3caf8b986d6b915fd4b13e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=0; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000, immutable
cf-ray
726b115659e89268-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Twitter (Social Network)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| bootstrap object| Tawk_API object| Tawk_LoadStart string| $_Tawk_AccountKey string| $_Tawk_WidgetId boolean| $_Tawk_Unstable object| $_Tawk object| tawkJsonp object| regeneratorRuntime function| $__TawkEngine function| EventEmitter function| $__TawkSocket object| Tawk_Window

2 Cookies

Domain/Path Name / Value
www.cargokoehler.de/ Name: twk_idm_key
Value: bnSJctEjYl6aqSfnOJ7e-
www.cargokoehler.de/ Name: TawkConnectionTime
Value: 0

1 Console Messages

Source Level URL
Text
network error URL: https://va.tawk.to/v1/session/start
Message:
Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

embed.tawk.to
oracle-avant-testnet.blogspot.be
oracle-avant-testnet.blogspot.com
va.tawk.to
www.cargokoehler.de
2606:4700:10::6816:1983
2606:4700:10::ac43:2642
2a00:1450:4001:806::2001
81.169.236.145
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
0f0aef9670e1b3f32b79f61f847d0f470c062a9d17ff4c0a8ce2517710ff3411
138180bb51412a7b5c7d22ac7aeff4b8450080a6588984807afa9618dafff7fb
13cf82e6f9d48221cd55f8b3c3d206f7bdb83f291034b478e484ccfef7d500dd
161f78f0d9ea5a5025a082c14b694df6ca43e2d48db62ee35f3368ff3da02cc1
4b24eee82c2b7ce85ace76193e8a25570dabc6863b94a60a42fa9bb6a37ddc72
52662b26c92fe84babf58925f433fc700d615fac6e8c303231912c66a6f0dd5e
5958b8f2069b0a3292ed7a9db46b8109adac7e81591238557125893ee7e87bb7
6d69ae5c4892d35573385da52afebec92fb02feaf7670b0684c1b2aa6f2cfb98
705186becc9e0a306a6b4867ae2768aa9dd3b8c12393d9f9c52029e9a6fcf31c
a31468a8bcc6a38df3e647708976a861d3579155082a3dc8ec193a58b73f7d38
a64beb2b04d49987241b23aa3130a829871eece47ae45837221e0580346eaeb8
a6cdb2fe9d4f3c136d30f4e57f96a0aa063ddb093c1c6fefcf3943eee3e834b7
ae1e8d13b6bb654346aef617cb6990509c3587ec8f1922711a9d9e15bd849bb9
b126d9a214a72de525e4092536f8b196706433328d7bf122c295937d4ba99a10
b5b1592fa8ab8256ceae1cf00cbe53ad23b82f85964514f421492df2a8735d2f
d2a37b3244a9a215cc8c90b8bc11388c4fd8b2dd23d415acfccf16e3224250d7
f21e99abe3dd3d1cca56b3523085e7026314de044474edcdc933f31754240fd2
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e