services.connect.jetzt

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 188.40.30.115, located in Germany and belongs to HETZNER-AS, DE. The main domain is services.connect.jetzt.

This is the only time services.connect.jetzt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Societe Generale (Banking)

Domain & IP information

	IP Address		AS Autonomous System
5	188.40.30.115 188.40.30.115		24940 (HETZNER-AS) (HETZNER-AS)
5	1

5 188.40.30.115 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: www104.your-server.de

services.connect.jetzt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	connect.jetzt services.connect.jetzt	108 KB
5	1

	Domain	Requested by
5	services.connect.jetzt	services.connect.jetzt
5	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php
Frame ID: 8FC517F0939CB6EB9B26EF2F20987730
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

108 kB
Transfer

107 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set 2.php Show response services.connect.jetzt/wp-admin/dd/gs/461f3/	3 KB 3 KB	14ms 14ms	Document text/html	188.40.30.115 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Protocol HTTP/1.1 Server 188.40.30.115 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS www104.your-server.de Software Apache / Resource Hash `a27438c70ea2683ea8eb7dc743a1da07902ae621cd591c756eccfac99da167dc` Request headers Host services.connect.jetzt Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 12 Apr 2019 16:17:01 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie PHPSESSID=ea2c167fde1ab4d3bcd9df74f93f1131; path=/ Keep-Alive timeout=15, max=97 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	rules.js.download Show response services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/	535 B 817 B	15ms 14ms	Script application/javascript	188.40.30.115 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/rules.js.download Requested by Host: services.connect.jetzt URL: http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Protocol HTTP/1.1 Server 188.40.30.115 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS www104.your-server.de Software Apache / Resource Hash `18aa4091ca18ebd466350485711571061c7c3fda4dbe9b941554c0d02c9f25a6` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host services.connect.jetzt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Cookie PHPSESSID=ea2c167fde1ab4d3bcd9df74f93f1131 Connection keep-alive Cache-Control no-cache Referer http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 12 Apr 2019 16:17:01 GMT Last-Modified Fri, 12 Apr 2019 15:27:18 GMT Server Apache ETag "217-58656f02f1d66" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=96 Content-Length 535
GET H/1.1	200 OK	styles.css services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/	1 KB 2 KB	14ms 13ms	Stylesheet text/css	188.40.30.115 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/styles.css Requested by Host: services.connect.jetzt URL: http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Protocol HTTP/1.1 Server 188.40.30.115 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS www104.your-server.de Software Apache / Resource Hash `f86ac51a62a0e900591705acdead6b4da96870ff4b2ae58687d470b73eb5d380` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host services.connect.jetzt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Cookie PHPSESSID=ea2c167fde1ab4d3bcd9df74f93f1131 Connection keep-alive Cache-Control no-cache Referer http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 12 Apr 2019 16:17:01 GMT Last-Modified Fri, 12 Apr 2019 15:27:18 GMT Server Apache ETag "53c-58656f02f1d66" Upgrade h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type text/css Keep-Alive timeout=15, max=100 Content-Length 1340
GET H/1.1	200 OK	Calque0.png services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/	98 KB 98 KB	28ms 14ms	Image image/png	188.40.30.115 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/Calque0.png Requested by Host: services.connect.jetzt URL: http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Protocol HTTP/1.1 Server 188.40.30.115 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS www104.your-server.de Software Apache / Resource Hash `f9ccedbe98175083f861e8b2185bbf5f55bdbbfa1f7ed8b80577664b9dec299d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host services.connect.jetzt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Cookie PHPSESSID=ea2c167fde1ab4d3bcd9df74f93f1131 Connection keep-alive Cache-Control no-cache Referer http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 12 Apr 2019 16:17:01 GMT Last-Modified Fri, 12 Apr 2019 15:27:18 GMT Server Apache ETag "1860b-58656f02f1d66" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=99 Content-Length 99851
GET H/1.1	404 Not Found	index_Button1_bkgrnd.png services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/images/	5 KB 5 KB	247ms 247ms	Image text/html	188.40.30.115 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL http://services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/images/index_Button1_bkgrnd.png Requested by Host: services.connect.jetzt URL: http://services.connect.jetzt/wp-admin/dd/gs/461f3/2.php Protocol HTTP/1.1 Server 188.40.30.115 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS www104.your-server.de Software Apache / Resource Hash `d9737f25574b91117b5da5fd875a0b5d633ec675606dd61ffacad458e5685682` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host services.connect.jetzt User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/styles.css Cookie PHPSESSID=ea2c167fde1ab4d3bcd9df74f93f1131 Connection keep-alive Cache-Control no-cache Referer http://services.connect.jetzt/wp-admin/dd/gs/461f3/2_files/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 12 Apr 2019 16:17:01 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://services.connect.jetzt/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=15, max=95 Expires Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Societe Generale (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			services.connect.jetzt/	1969-12-31 23:59:59	Name: PHPSESSID Value: ea2c167fde1ab4d3bcd9df74f93f1131

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

services.connect.jetzt
188.40.30.115
18aa4091ca18ebd466350485711571061c7c3fda4dbe9b941554c0d02c9f25a6
a27438c70ea2683ea8eb7dc743a1da07902ae621cd591c756eccfac99da167dc
d9737f25574b91117b5da5fd875a0b5d633ec675606dd61ffacad458e5685682
f86ac51a62a0e900591705acdead6b4da96870ff4b2ae58687d470b73eb5d380
f9ccedbe98175083f861e8b2185bbf5f55bdbbfa1f7ed8b80577664b9dec299d

services.connect.jetzt Open in urlscan Pro 188.40.30.115 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

108 kBTransfer

107 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

services.connect.jetzt Open in urlscan Pro
188.40.30.115 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

108 kB
Transfer

107 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!