urlscan.io logo urlscan.io
SecurityTrails logo

lookandfind.me Open in urlscan Pro
157.90.169.168  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://capitaplone.com/
Effective URL: https://lookandfind.me/s/r?u=https%3A%2F%2Futkv6nyu.de%2Fredir%2FclickGate.php%3Fu%3DJRhaDii6%26p%3DECZMhxN0n7%26m%3D12...
Submission: On September 13 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 6 domains to perform 5 HTTP transactions. The main IP is 157.90.169.168, located in Germany and belongs to HETZNER-AS, DE. The main domain is lookandfind.me.
TLS certificate: Issued by R3 on September 4th 2021. Valid for: 3 months.
This is the only time lookandfind.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 185.107.56.205 43350 (NFORCE)
1 2 198.54.112.216 22612 (NAMECHEAP...)
1 1 49.12.0.235 24940 (HETZNER-AS)
1 1 78.46.197.88 24940 (HETZNER-AS)
2 157.90.169.168 24940 (HETZNER-AS)
5 4
2    185.107.56.205 (Stourbridge, United Kingdom)

ASN43350 (NFORCE, NL)
capitaplone.com
2    198.54.112.216 (United States)

ASN22612 (NAMECHEAP-NET, US)
4773.rebiraert.com
1    49.12.0.235 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.235.0.12.49.clients.your-server.de
rtpnt.xyz
1    78.46.197.88 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88.197.46.78.clients.your-server.de
clever-redirect.com
2    157.90.169.168 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.168.169.90.157.clients.your-server.de
lookandfind.me
Apex Domain
Subdomains		 Transfer
2 lookandfind.me
lookandfind.me
989 B
2 rebiraert.com
4773.rebiraert.com
703 B
2 capitaplone.com
capitaplone.com
1 KB
1 clever-redirect.com
clever-redirect.com
238 B
1 rtpnt.xyz
rtpnt.xyz
195 B
0 helden.de Failed
helden.de Failed
5 6
Domain Requested by
2 lookandfind.me 4773.rebiraert.com
2 4773.rebiraert.com 1 redirects capitaplone.com
2 capitaplone.com 1 redirects
1 clever-redirect.com 1 redirects
1 rtpnt.xyz 1 redirects
0 helden.de Failed lookandfind.me
5 6

This site contains no links.

Subject Issuer Validity Valid
lookandfind.me
R3		 2021-09-04 -
2021-12-03		 3 months crt.sh

This page contains 1 frames:

Frame: https://helden.de/?utm_source=affilinet&src=affnet&awc=14361_1631510689_d2c1fc3e6171c17aeff07603e2ad84e9
Frame ID: C269A99B0EF9A557F0684BC6F139CEC1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://capitaplone.com/ Page URL
  2. http://capitaplone.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTU... HTTP 302
    http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec354... Page URL
  3. http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec354... HTTP 302
    https://rtpnt.xyz/v6/r?s=r8d&s3=apix07-capitaplone.com HTTP 302
    https://clever-redirect.com/s/r6?s=r8d&s2=&s3=apix07capitaplonecom HTTP 302
    https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d... Page URL
  4. https://lookandfind.me/s/r?u=https%3A%2F%2Futkv6nyu.de%2Fredir%2FclickGate.php%3Fu%3DJRhaDii6%26p%3... Page URL

Page Statistics

5
Requests

40 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

2 kB
Transfer

2 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://capitaplone.com/ Page URL
  2. http://capitaplone.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTUxNzg1NywiaWF0IjoxNjMxNTEwNjU3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycWk0a2ozc2xvbGw4M2Q0a3M0MWJsNGEiLCJuYmYiOjE2MzE1MTA2NTcsInRzIjoxNjMxNTEwNjU3Mzg0NjQyfQ.iQ40e7tPAsAT9XiDsJjSvVnMhSrk7ArlYFtAdJCg-Ls&sid=d74c9164-1452-11ec-837d-a4b40f819bbb HTTP 302
    http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed Page URL
  3. http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ== HTTP 302
    https://rtpnt.xyz/v6/r?s=r8d&s3=apix07-capitaplone.com HTTP 302
    https://clever-redirect.com/s/r6?s=r8d&s2=&s3=apix07capitaplonecom HTTP 302
    https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom Page URL
  4. https://lookandfind.me/s/r?u=https%3A%2F%2Futkv6nyu.de%2Fredir%2FclickGate.php%3Fu%3DJRhaDii6%26p%3DECZMhxN0n7%26m%3D12%26s%3D080c98ced88feb1fc139a9aeedb57835%26url%3Dhttps%253A%252F%252Fwww.haftpflichthelden.de%252F&h=1ecf212312fd1cae14b016c67e99125b Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://capitaplone.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTUxNzg1NywiaWF0IjoxNjMxNTEwNjU3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycWk0a2ozc2xvbGw4M2Q0a3M0MWJsNGEiLCJuYmYiOjE2MzE1MTA2NTcsInRzIjoxNjMxNTEwNjU3Mzg0NjQyfQ.iQ40e7tPAsAT9XiDsJjSvVnMhSrk7ArlYFtAdJCg-Ls&sid=d74c9164-1452-11ec-837d-a4b40f819bbb HTTP 302
  • http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed
Request Chain 2
  • http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ== HTTP 302
  • https://rtpnt.xyz/v6/r?s=r8d&s3=apix07-capitaplone.com HTTP 302
  • https://clever-redirect.com/s/r6?s=r8d&s2=&s3=apix07capitaplonecom HTTP 302
  • https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom
Request Chain 3
  • https://utkv6nyu.de/redir/clickGate.php?u=JRhaDii6&p=ECZMhxN0n7&m=12&s=080c98ced88feb1fc139a9aeedb57835&url=https%3A%2F%2Fwww.haftpflichthelden.de%2F HTTP 302
  • https://www.awin1.com/cread.php?awinmid=14361&awinaffid=101248&clickref=at107999_a156113_m12_p134708_cDE_s080c98ced88feb1fc139a9aeedb57835 HTTP 302
  • https://haftpflichthelden.de/?utm_source=affilinet&src=affnet&awc=14361_1631510689_d2c1fc3e6171c17aeff07603e2ad84e9 HTTP 301
  • https://helden.de/?utm_source=affilinet&src=affnet&awc=14361_1631510689_d2c1fc3e6171c17aeff07603e2ad84e9

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
capitaplone.com/ 		471 B
830 B 		Document
General
Check archive.org
Download Go to
Full URL
http://capitaplone.com/
Protocol
HTTP/1.1
Server
185.107.56.205 Stourbridge, United Kingdom, ASN43350 (NFORCE, NL),
Reverse DNS
Software
nginx /
Resource Hash
372fcf98ed095924ee8638c51ca7c7d45ca1ba729e9916d76d515f481115ede9

Request headers

Host
capitaplone.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, private, must-revalidate
connection
close
content-length
471
content-type
text/html; charset=utf-8
date
Mon, 13 Sep 2021 05:24:17 GMT
server
nginx
set-cookie
sid=d74c9164-1452-11ec-837d-a4b40f819bbb; path=/; domain=.capitaplone.com; expires=Sat, 01 Oct 2089 08:38:24 GMT; max-age=2147483647; HttpOnly
feed
4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/
Redirect Chain
  • http://capitaplone.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTUxNzg1NywiaWF0IjoxNjMxNTEwNjU3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycWk0a2ozc2xvbGw4M2Q0a3M0MWJsN...
  • http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed
426 B
509 B 		Document
General
Check archive.org
Download Go to
Full URL
http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed
Requested by
Host: capitaplone.com
URL: http://capitaplone.com/
Protocol
HTTP/1.1
Server
198.54.112.216 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software
nginx/1.14.2 /
Resource Hash

Request headers

Host
4773.rebiraert.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://capitaplone.com/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://capitaplone.com/

Response headers

Server
nginx/1.14.2
Date
Mon, 13 Sep 2021 05:24:23 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
close
Content-Encoding
gzip

Redirect headers

cache-control
max-age=0, private, must-revalidate
connection
close
content-length
11
date
Mon, 13 Sep 2021 05:24:17 GMT
location
http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed
server
nginx
set-cookie
sid=d74c9164-1452-11ec-837d-a4b40f819bbb; path=/; domain=.capitaplone.com; expires=Sat, 01 Oct 2089 08:38:24 GMT; max-age=2147483647; HttpOnly
a
lookandfind.me/s/
Redirect Chain
  • http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==
  • https://rtpnt.xyz/v6/r?s=r8d&s3=apix07-capitaplone.com
  • https://clever-redirect.com/s/r6?s=r8d&s2=&s3=apix07capitaplonecom
  • https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom
438 B
605 B 		Document
General
Check archive.org
Download Go to
Full URL
https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom
Requested by
Host: 4773.rebiraert.com
URL: http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.90.169.168 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.168.169.90.157.clients.your-server.de
Software
Apache/2.4.46 (codeit) OpenSSL/1.1.1j PHP/7.4.19 / PHP/7.4.19
Resource Hash

Request headers

:method
GET
:authority
lookandfind.me
:scheme
https
:path
/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://4773.rebiraert.com/match-4773/67091/117980789/1631510657/mf_b7d7c408-568b-4bb7-b210-b1b0d0ec3540/YXBpeDA3LWNhcGl0YXBsb25lLmNvbQ==/feed

Response headers

date
Mon, 13 Sep 2021 05:24:39 GMT
server
Apache/2.4.46 (codeit) OpenSSL/1.1.1j PHP/7.4.19
referrer-policy
strict-origin-when-cross-origin
x-powered-by
PHP/7.4.19
content-length
438
content-type
text/html; charset=UTF-8

Redirect headers

date
Mon, 13 Sep 2021 05:24:34 GMT
server
Apache/2.4.46 (codeit) OpenSSL/1.1.1i PHP/7.4.15
referrer-policy
no-referrer
x-powered-by
PHP/7.4.15
location
https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom
content-length
0
content-type
text/html; charset=UTF-8
Primary Request r
lookandfind.me/s/ 		354 B
384 B 		Document
General
Check archive.org
Download Go to
Full URL
https://lookandfind.me/s/r?u=https%3A%2F%2Futkv6nyu.de%2Fredir%2FclickGate.php%3Fu%3DJRhaDii6%26p%3DECZMhxN0n7%26m%3D12%26s%3D080c98ced88feb1fc139a9aeedb57835%26url%3Dhttps%253A%252F%252Fwww.haftpflichthelden.de%252F&h=1ecf212312fd1cae14b016c67e99125b
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.90.169.168 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.168.169.90.157.clients.your-server.de
Software
Apache/2.4.46 (codeit) OpenSSL/1.1.1j PHP/7.4.19 / PHP/7.4.19
Resource Hash

Request headers

:method
GET
:authority
lookandfind.me
:scheme
https
:path
/s/r?u=https%3A%2F%2Futkv6nyu.de%2Fredir%2FclickGate.php%3Fu%3DJRhaDii6%26p%3DECZMhxN0n7%26m%3D12%26s%3D080c98ced88feb1fc139a9aeedb57835%26url%3Dhttps%253A%252F%252Fwww.haftpflichthelden.de%252F&h=1ecf212312fd1cae14b016c67e99125b
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://lookandfind.me/s/a?t=1&f=1&u=41ecaa9ae33de01f1e1a4b6551068474&m=haftpflichthelden.de&s1=r8d&s2=&s3=apix07capitaplonecom

Response headers

date
Mon, 13 Sep 2021 05:24:39 GMT
server
Apache/2.4.46 (codeit) OpenSSL/1.1.1j PHP/7.4.19
referrer-policy
strict-origin-when-cross-origin
x-powered-by
PHP/7.4.19
content-length
354
content-type
text/html; charset=UTF-8
/
helden.de/
Redirect Chain
  • https://utkv6nyu.de/redir/clickGate.php?u=JRhaDii6&p=ECZMhxN0n7&m=12&s=080c98ced88feb1fc139a9aeedb57835&url=https%3A%2F%2Fwww.haftpflichthelden.de%2F
  • https://www.awin1.com/cread.php?awinmid=14361&awinaffid=101248&clickref=at107999_a156113_m12_p134708_cDE_s080c98ced88feb1fc139a9aeedb57835
  • https://haftpflichthelden.de/?utm_source=affilinet&src=affnet&awc=14361_1631510689_d2c1fc3e6171c17aeff07603e2ad84e9
  • https://helden.de/?utm_source=affilinet&src=affnet&awc=14361_1631510689_d2c1fc3e6171c17aeff07603e2ad84e9
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
helden.de
URL
https://helden.de/?utm_source=affilinet&src=affnet&awc=14361_1631510689_d2c1fc3e6171c17aeff07603e2ad84e9

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
.capitaplone.com/ Name: sid
Value: d74c9164-1452-11ec-837d-a4b40f819bbb
utkv6nyu.de/ Name: PHPSESSID
Value: ukv2r6t8l5rjp54kt6937uclk4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4773.rebiraert.com
capitaplone.com
clever-redirect.com
helden.de
lookandfind.me
rtpnt.xyz
helden.de
157.90.169.168
185.107.56.205
198.54.112.216
49.12.0.235
78.46.197.88
372fcf98ed095924ee8638c51ca7c7d45ca1ba729e9916d76d515f481115ede9