Submitted URL: http://thewellnessplus.com/en/
Effective URL: https://wirliefernihr-paket.com/login/
Submission: On February 12 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3031::6815:5317, located in United States and belongs to CLOUDFLARENET, US. The main domain is wirliefernihr-paket.com.
TLS certificate: Issued by E1 on February 12th 2024. Valid for: 3 months.
This is the only time wirliefernihr-paket.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 192.254.233.145 46606 (UNIFIEDLA...)
2 9 2606:4700:303... 13335 (CLOUDFLAR...)
7 1
Apex Domain
Subdomains
Transfer
9 wirliefernihr-paket.com
wirliefernihr-paket.com
20 KB
1 thewellnessplus.com
thewellnessplus.com
277 B
7 2
Domain Requested by
9 wirliefernihr-paket.com 2 redirects wirliefernihr-paket.com
1 thewellnessplus.com 1 redirects
7 2

This site contains no links.

Subject Issuer Validity Valid
wirliefernihr-paket.com
E1
2024-02-12 -
2024-05-12
3 months crt.sh

This page contains 3 frames:

Primary Page: https://wirliefernihr-paket.com/login/
Frame ID: E4A2B7C888B5203AE9FECE9A4FA173CF
Requests: 3 HTTP requests in this frame

Frame: https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
Frame ID: 49D09932AF4444AE262D1E161902AA16
Requests: 2 HTTP requests in this frame

Frame: https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
Frame ID: 7C72588CD6A2F2616F54D6C66E8D9E78
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

403 Forbidden

Page URL History Show full URLs

  1. http://thewellnessplus.com/en/ HTTP 302
    https://wirliefernihr-paket.com/login/ Page URL
  2. https://wirliefernihr-paket.com/login/ Page URL

Page Statistics

7
Requests

71 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

19 kB
Transfer

23 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://thewellnessplus.com/en/ HTTP 302
    https://wirliefernihr-paket.com/login/ Page URL
  2. https://wirliefernihr-paket.com/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://thewellnessplus.com/en/ HTTP 302
  • https://wirliefernihr-paket.com/login/
Request Chain 2
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
Request Chain 4
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
wirliefernihr-paket.com/login/
Redirect Chain
  • http://thewellnessplus.com/en/
  • https://wirliefernihr-paket.com/login/
7 KB
8 KB
Document
General
Full URL
https://wirliefernihr-paket.com/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d422411803ef8e78f7401a7ccde10902a84e96a1ccbc53e30f445b641394dd7
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
8544819fc91b9046-FRA
content-type
text/html; charset=utf-8
date
Mon, 12 Feb 2024 11:31:37 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F615eLwYSLnw2MMb3Q95b1O7r6Ib0gjVGhSdI8EcI26xOAuOeXFu0Cs7by9PhBSrOxhytNTyJ13avhwLX6m8YBn%2FnXj5LeaIQyW8tDhm3tDStZbgX7osyBS1shmJOOS2mBEkK3QaOJ11cbQ3elYHQYy9vr22Rg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block 1; mode=block

Redirect headers

Connection
Upgrade, Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 12 Feb 2024 11:31:37 GMT
Keep-Alive
timeout=5, max=75
Location
https://wirliefernihr-paket.com/login/
Server
Apache
Upgrade
h2,h2c
/
wirliefernihr-paket.com/login/
0
713 B
XHR
General
Full URL
https://wirliefernihr-paket.com/login/
Requested by
Host: wirliefernihr-paket.com
URL: https://wirliefernihr-paket.com/login/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

Fx77ZNJKq4NOdVuOfdNc7paDTU0
B0LXUFYXbGEtC15tlDnn5bNlWs
X-Requested-TimeStamp-Expire
accept-language
de-DE,de;q=0.9
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination
GET
Content-type
application/x-www-form-urlencoded
X-Requested-Type
GET
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Referer
https://wirliefernihr-paket.com/login/
X-Requested-with
XMLHttpRequest
X-Requested-TimeStamp
9Ki-7SRNWkWLVQ7nr7OKI6t-ugg
31262235

Response headers

pragma
no-cache
date
Mon, 12 Feb 2024 11:31:37 GMT
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E8F3cvnEU6L1b6mPg40ATUCwYEEUoRtDpeBYJ0hUpHwcwATrxMRfn%2BGM2qRsjcjq3Zp6jGJa4AVpYu3Zx8llQ8NIcRrAbliB%2FYd6%2FZQmDEm1UnuHkiMDY25jUY%2BZALF9WHSpzryHgq6VTqW1%2B2h8NtaR94yQ1g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
854481a0ca0e9046-FRA
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
expires
0
main.js
wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/ Frame 49D0
Redirect Chain
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
7 KB
4 KB
Script
General
Full URL
https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
Protocol
H3
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2525d471a5bbd051c0243849ad13b5882b00953291f5319bc50c7d6eb772f837
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 11:31:37 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2TvXhtJaen2k6hRxTwqV2ibl%2FpJML034HBC6PHix3Ql8uVuD%2FnuBK65rd8CeP9vTfoWOZizz0XmLsvABtFRav6vNS55H%2B7P5JLeMoRfpWT4axisSEv4nt%2Bf9h68C%2FEDjQN2YK3gKiXwoXDyjp7Cgy2zZ%2FYtv1g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
854481a0ee181d9c-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Mon, 12 Feb 2024 11:31:37 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZwpNLfWL2Rqbe8rZa9RUwQhZyKmPfsYIMuQKrFKAZ7NMoWSYYv2EP7dwGTMqiUDF4eIvDgCo8t8VJ6iMsPXoy6bBeMmxKzTV9ss0eppQEXLz%2B7djX25mwKJDb6OFuXHN6RP9qHwKGwj6i%2Fx0ePLZHYCfsQnjgA%3D%3D"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
854481a0da1c9046-FRA
alt-svc
h3=":443"; ma=86400
8544819fc91b9046
wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 49D0
0
621 B
XHR
General
Full URL
https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/jsd/r/8544819fc91b9046
Requested by
Host: wirliefernihr-paket.com
URL: https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 12 Feb 2024 11:31:37 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V8gDpBkYj0lEw920OYpyrn5q%2B9BlVTa5DNfdFzoZyrcDmbbyeLeiTCpomJYxJpuuAkODAS8NQkxOKQHAD2qyFYDEO%2BYHwhIkX%2BlNAY2YiF%2BfuHPfc9mVmL3HeMEMVD01%2Fj5%2BzrmYLEilnsRhkJXoZvneuln1AA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
854481a16e9d1d9c-FRA
alt-svc
h3=":443"; ma=86400
Primary Request /
wirliefernihr-paket.com/login/
2 KB
1021 B
Document
General
Full URL
https://wirliefernihr-paket.com/login/
Requested by
Host: wirliefernihr-paket.com
URL: https://wirliefernihr-paket.com/login/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
78a92ddbb37c7caf6695656bf93f8fa59fa1551b2106dab6d83e6d9dd4b7c334
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://wirliefernihr-paket.com/login/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
854481a16ea11d9c-FRA
content-encoding
br
content-type
text/html
date
Mon, 12 Feb 2024 11:31:37 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WBxt5v6s5gLLwF6BcWsa%2FiXrlCvy%2B3pHCWDnkztSZjtgyvi9zI2kSuZ%2BQwz8ATGq9a8i7ARSm%2B4N3dYqxNFmzmqvjO0W5EYfagfKB1kLZA%2FNBEZeiIVl0WNjeHxi515OLqWpyWoomuhzAby3IF3S8IK18fCKCg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block 1; mode=block
main.js
wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/ Frame 7C72
Redirect Chain
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
7 KB
4 KB
Script
General
Full URL
https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
Protocol
H3
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6c209627f48ea1487bc73ae0ea159704ecbe31ca4b27aed1274b6cde117a12f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Mon, 12 Feb 2024 11:31:37 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2FLKgUvn5DxSTgFaqg2vuW%2B1qQ%2BnF5nEi8Ki9flHs8luO3fzKW3SAt1sSiZLApL%2BzbhfmS%2BQPm0%2FE742pUxx%2FgLrMH5XEmG6FxIm4Xt8Bvkp%2FjgCMkusiXtYKItD3WsoVs76DEVWCv6Nbdb1jJ4v79h%2FN2QNEA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
854481a26fb81d9c-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Mon, 12 Feb 2024 11:31:37 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R9YwmRLO6tzI%2Bfz2U3rb2fp6nMfY%2B7c7c1hKVzH%2FBkY7IgaSCuWkoIvNJzQEZEGmqjhmc17ZlkE6lRWPznM1W%2Bvg%2FtH3JFek50jep%2FO1sWLXIQxgXayIIBp3yYrzaPT7f2BB3KL2%2FC2tsLlSp13TeFEvmchnew%3D%3D"}],"group":"cf-nel","max_age":604800}
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/a990e557/main.js
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
854481a24f9b1d9c-FRA
alt-svc
h3=":443"; ma=86400
854481a16ea11d9c
wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 7C72
0
618 B
XHR
General
Full URL
https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/h/b/jsd/r/854481a16ea11d9c
Requested by
Host: wirliefernihr-paket.com
URL: https://wirliefernihr-paket.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:5317 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 12 Feb 2024 11:31:38 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T%2FICgaaIF%2BOiNiY0nvjMLPstO5RCYxL1FeuVz%2Fo5TkcN8P5bevEPQUbUcCjTop8wAswa%2BWIBtyTAxr148fYvk2C%2FhNHvxRYpLspl0ontlpfAHAf2H2GCVfunWAAPRqOJIaj2FXrHFvZlYJABiFFR46OfP1tYUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
854481a2e8621d9c-FRA
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

12 Cookies

Domain/Path Name / Value
wirliefernihr-paket.com/ Name: O9IF5WK1hhfOaH-p6eZEwxzNFRA
Value: xGvcNAUiktZj2YWAIWEVXrdZ9fc
wirliefernihr-paket.com/ Name: QEVkBIbqvUXMcudO8hdN_lXmL1Q
Value: 1707737416
wirliefernihr-paket.com/ Name: J-L-rSV-Ecopmb4-dI9KvqAGTdA
Value: 1707823816
wirliefernihr-paket.com/ Name: usHiUU-2JpxDohj6V41JiV_u-Ok
Value: ajRBsOXmcSsFCsRqBt042nn98U8
wirliefernihr-paket.com/ Name: NR8-f0g0JfrlSyp9DTLIrncFyH0
Value: Npzys9TWwh_INJIs_5y9FokDUOY
wirliefernihr-paket.com/ Name: k-ihRO3cbEdEdjyQMAlHk-OXUco
Value: j-ViJyw92GYh38jGZquiIoJZtTA
wirliefernihr-paket.com/ Name: 3JoeXQYqj38SWNEw3xG3kpXDb6k
Value: wK7-6NPWomvVY31N8F_4YhzrIBo
wirliefernihr-paket.com/ Name: P3sJh5J7H8qxIUcd__091AK4rhY
Value: 1707737497
wirliefernihr-paket.com/ Name: nf1AGuYa2NBABiO6oNtyW8xfcRI
Value: 1707823897
wirliefernihr-paket.com/ Name: OG7dnubhiK0y8HgCKMcSLIGbBvE
Value: sZXCasxGiMYgwngdIld2uSqk4lI
wirliefernihr-paket.com/ Name: MKSRohG6KXAdJ_S5YBh7O_jPvv8
Value: mzda5enPsCDv1VodENQDyNYGciY
.wirliefernihr-paket.com/ Name: cf_clearance
Value: qq7cUejmLSzebeHbFQlNv5jiYktmZnWM2lTql4TW10E-1707737498-1-AcSlbJHniynHnTvXtFB/I3v+VUWIS283KLCbivXV/hoICNb1iYo0JogISoZDADxyCRtbVa6Q5cAPcywSQmnQhwg=

2 Console Messages

Source Level URL
Text
network error URL: https://wirliefernihr-paket.com/login/
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://wirliefernihr-paket.com/login/
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block