optikerselnes.x9.eu Open in urlscan Pro
144.76.162.245 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://optikerselnes.x9.eu/
Submission: On September 24 via manual (September 24th 2021, 9:12:14 am UTC) from NO — Scanned from DE

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 144.76.162.245, located in Tettnang Castle, Germany and belongs to HETZNER-AS, DE. The main domain is optikerselnes.x9.eu.

This is the only time optikerselnes.x9.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	144.76.162.245 144.76.162.245	24940 (HETZNER-AS) (HETZNER-AS)
1	142.250.186.46 142.250.186.46	15169 (GOOGLE) (GOOGLE)
2	31.24.129.56 31.24.129.56	29486 (WEBHUSET-AS) (WEBHUSET-AS)
1	52.105.157.27 52.105.157.27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	5

1 144.76.162.245 (Tettnang Castle, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: master2.subdomain.com

optikerselnes.x9.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.46 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.24.129.56 (Germany)

ASN29486 (WEBHUSET-AS, DE)

handfiles.no.datasenter.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.105.157.27 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

vikinggenetics-my.sharepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	datasenter.no handfiles.no.datasenter.no	26 KB
1	sharepoint.com vikinggenetics-my.sharepoint.com	8 KB
1	google-analytics.com www.google-analytics.com	17 KB
1	x9.eu optikerselnes.x9.eu	9 KB
5	4

	Domain	Requested by
2	handfiles.no.datasenter.no	optikerselnes.x9.eu handfiles.no.datasenter.no
1	vikinggenetics-my.sharepoint.com	optikerselnes.x9.eu
1	www.google-analytics.com	optikerselnes.x9.eu
1	optikerselnes.x9.eu
5	4

This site contains no links.

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.sharepoint.com DigiCert Cloud Services CA-1	`2021-02-05` - `2022-02-04`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://optikerselnes.x9.eu/
Frame ID: EE3C0C677146B9F9FF7475DCA58016F0
Requests: 7 HTTP requests in this frame

Frame: http://handfiles.no.datasenter.no/file/
Frame ID: 2A3A24DC743FC4D68B4802371469916A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

5
Requests

40 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

62 kB
Transfer

125 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

5 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.0 200
OK Primary Request / Show response
optikerselnes.x9.eu/ 31 KB
9 KB 86ms
32ms Document
text/html 144.76.162.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://optikerselnes.x9.eu/
Protocol: HTTP/1.0
Server: 144.76.162.245 Tettnang Castle, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: master2.subdomain.com
Software: Apache/2.4.10 (Debian) /
Resource Hash: 4e10458acb2f39eed4ccf3d7fd658258248b8ff5a944aba60a6679ea3ce4d89e

Request headers

Host: optikerselnes.x9.eu
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 24 Sep 2021 09:12:09 GMT
Server: Apache/2.4.10 (Debian)
Content-Encoding: gzip
Content-Length: 9173
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

29ms
7ms

Script
text/javascript

142.250.186.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: optikerselnes.x9.eu
URL: http://optikerselnes.x9.eu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 5951
date: Fri, 24 Sep 2021 07:32:58 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Fri, 24 Sep 2021 09:32:58 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 487134547939d7e4874909f045b67b8232cb0a445ebce71aa85aaa5db4744f0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e05fce5f98ca525ed88502ec94c43763661ea74e0f84e5625a7ed161c28447f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d92fb73d4422ab97f4c170639dde5d2f11a3ebdb601a44ce2ab9de104b2da103

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717cc576a1098d7bc9cfc06b4f908024e6f07009879a6e1f55ccc04f4a833437

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 889 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f9b1f894802acbe8d4916a787d0c221e8826ddb9db42ec09380b2f3489092c8f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
handfiles.no.datasenter.no/file/ Frame 2A3A 22 KB
22 KB 537ms
484ms Document
text/html 31.24.129.56
WEBHUSET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://handfiles.no.datasenter.no/file/
Requested by: Host: optikerselnes.x9.eu
URL: http://optikerselnes.x9.eu/
Protocol: HTTP/1.1
Server: 31.24.129.56 , Germany, ASN29486 (WEBHUSET-AS, DE),
Reverse DNS
Software: Apache/2.4.6 () OpenSSL/1.0.2k-fips / PHP/7.2.32
Resource Hash: 392f16dd6f78a4276aacfda6d4cb03e4e0f1974506f329cc7c22eb450665e087

Request headers

Host: handfiles.no.datasenter.no
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://optikerselnes.x9.eu/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://optikerselnes.x9.eu/

Response headers

Date: Fri, 24 Sep 2021 09:12:06 GMT
Server: Apache/2.4.6 () OpenSSL/1.0.2k-fips
X-Powered-By: PHP/7.2.32
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK microsoft_logo.svg
handfiles.no.datasenter.no/file/naf/inf/ Frame 2A3A 4 KB
4 KB 37ms
36ms Image
image/svg+xml 31.24.129.56
WEBHUSET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://handfiles.no.datasenter.no/file/naf/inf/microsoft_logo.svg
Requested by: Host: handfiles.no.datasenter.no
URL: http://handfiles.no.datasenter.no/file/
Protocol: HTTP/1.1
Server: 31.24.129.56 , Germany, ASN29486 (WEBHUSET-AS, DE),
Reverse DNS
Software: Apache/2.4.6 () OpenSSL/1.0.2k-fips /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://handfiles.no.datasenter.no/file/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 24 Sep 2021 09:12:06 GMT
Last-Modified: Sat, 19 May 2018 00:47:00 GMT
Server: Apache/2.4.6 () OpenSSL/1.0.2k-fips
ETag: "e43-56c8468020900"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3651

GET
DATA 200
OK truncated
/ Frame 2A3A 2 KB
2 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5

Request headers

Referer: http://handfiles.no.datasenter.no/
Origin: http://handfiles.no.datasenter.no
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H/1.1 200
OK pdf.png
vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/ Frame 2A3A 7 KB
8 KB 481ms
60ms Image
image/png 52.105.157.27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png

Requested by

Host: optikerselnes.x9.eu
URL: http://optikerselnes.x9.eu/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.105.157.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://handfiles.no.datasenter.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}
X-Powered-By: ASP.NET
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-SharePointHealthScore: 3
MS-CV: n/KUBqBAADAYAc5iuSIyrg.0
Content-Length: 6830
MicrosoftSharePointTeamServices: 16.0.0.21708
X-MS-InvokeApp: 1; RequireReadOnly
SPRequestDuration: 14
Last-Modified: Fri, 17 Sep 2021 02:55:48 GMT
Server: Microsoft-IIS/10.0
SPRequestGuid: 0694f29f-40a0-3000-1801-ce62b92232ae
Date: Fri, 24 Sep 2021 09:12:11 GMT
X-FRAME-OPTIONS: SAMEORIGIN
Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=189041&frontEnd=FarmDirect"}]}
Content-Type: image/png
request-id: 0694f29f-40a0-3000-1801-ce62b92232ae
ETag: "0d24b846fabd71:0"
Accept-Ranges: bytes
SPIisLatency: 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

handfiles.no.datasenter.no
optikerselnes.x9.eu
vikinggenetics-my.sharepoint.com
www.google-analytics.com
142.250.186.46
144.76.162.245
31.24.129.56
52.105.157.27
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
392f16dd6f78a4276aacfda6d4cb03e4e0f1974506f329cc7c22eb450665e087
487134547939d7e4874909f045b67b8232cb0a445ebce71aa85aaa5db4744f0e
4e10458acb2f39eed4ccf3d7fd658258248b8ff5a944aba60a6679ea3ce4d89e
717cc576a1098d7bc9cfc06b4f908024e6f07009879a6e1f55ccc04f4a833437
8e05fce5f98ca525ed88502ec94c43763661ea74e0f84e5625a7ed161c28447f
d92fb73d4422ab97f4c170639dde5d2f11a3ebdb601a44ce2ab9de104b2da103
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545
f9b1f894802acbe8d4916a787d0c221e8826ddb9db42ec09380b2f3489092c8f

optikerselnes.x9.eu Open in urlscan Pro 144.76.162.245 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

5 Requests

40 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

62 kBTransfer

125 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

optikerselnes.x9.eu Open in urlscan Pro
144.76.162.245 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

40 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

62 kB
Transfer

125 kB
Size

0
Cookies

5 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!