condescending-almeida.138-201-35-194.plesk.page Open in urlscan Pro
138.201.35.194 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://redirect.viglink.com/?u=https://s.free.fr/5L3FxFFr&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=RAL&cuid=ignorelooku...
Effective URL:
https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678
Submission: On April 17 via manual (April 17th 2023, 10:09:43 am UTC) from DE — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 138.201.35.194, located in Esslingen am Neckar, Germany and belongs to HETZNER-AS, DE. The main domain is condescending-almeida.138-201-35-194.plesk.page.
TLS certificate: Issued by R3 on April 8th 2023. Valid for: 3 months.

This is the only time condescending-almeida.138-201-35-194.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lufthansa (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.214.253.232 52.214.253.232	16509 (AMAZON-02) (AMAZON-02)
1 1	2a01:e0c:1:15... 2a01:e0c:1:1599::29	12322 (PROXAD) (PROXAD)
1 13	138.201.35.194 138.201.35.194	24940 (HETZNER-AS) (HETZNER-AS)
12	2

1 52.214.253.232 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-253-232.eu-west-1.compute.amazonaws.com

redirect.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:e0c:1:1599::29 (France) 1 redirects

ASN12322 (PROXAD, FR)

s.free.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 138.201.35.194 (Esslingen am Neckar, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: lieser.bitpalast.net

condescending-almeida.138-201-35-194.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	plesk.page 1 redirects condescending-almeida.138-201-35-194.plesk.page	133 KB
1	free.fr 1 redirects s.free.fr	252 B
1	viglink.com 1 redirects redirect.viglink.com — Cisco Umbrella Rank: 32480	243 B
12	3

	Domain	Requested by
13	condescending-almeida.138-201-35-194.plesk.page	1 redirects condescending-almeida.138-201-35-194.plesk.page
1	s.free.fr	1 redirects
1	redirect.viglink.com	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
condescending-almeida.138-201-35-194.plesk.page R3	`2023-04-08` - `2023-07-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678
Frame ID: C73D771FC7EF428D887AA6B3B7FE6D1E
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anmelden

Page URL History Show full URLs

https://redirect.viglink.com/?u=https://s.free.fr/5L3FxFFr&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=... HTTP 302
https://s.free.fr/5L3FxFFr HTTP 301
https://condescending-almeida.138-201-35-194.plesk.page/?dispa=89397769 HTTP 302
https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

132 kB
Transfer

501 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://redirect.viglink.com/?u=https://s.free.fr/5L3FxFFr&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=RAL&cuid=ignorelookup_es-es HTTP 302
https://s.free.fr/5L3FxFFr HTTP 301
https://condescending-almeida.138-201-35-194.plesk.page/?dispa=89397769 HTTP 302
https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cliantoz.php Show response condescending-almeida.138-201-35-194.plesk.page/ Redirect Chain https://redirect.viglink.com/?u=https://s.free.fr/5L3FxFFr&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=RAL&cuid=ignorelookup_es-es https://s.free.fr/5L3FxFFr https://condescending-almeida.138-201-35-194.plesk.page/?dispa=89397769 https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678	12 KB 2 KB	222ms 221ms	Document text/html	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PHP/8.0.28 PleskLin Resource Hash `cf164a5ef75fb35be50f354125154034795cbcedd65719247735f30737b0e787` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-type text/html; charset=UTF-8 date Mon, 17 Apr 2023 10:09:38 GMT server nginx vary Accept-Encoding x-powered-by PHP/8.0.28 PleskLin Redirect headers content-type text/html; charset=UTF-8 date Mon, 17 Apr 2023 10:09:38 GMT location ./cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 server nginx x-powered-by PHP/8.0.28 PleskLin
GET H2	200	fonts-min.css condescending-almeida.138-201-35-194.plesk.page/assets/css/	2 KB 373 B	19ms 15ms	Stylesheet text/css	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/css/fonts-min.css?etag=3ae22352 Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `6dc2683a46a5f8550bdfaa2f99ba60e32f76d8b2db02d69b4f247ca2889c78d9` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT content-encoding br last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx etag W/"63f25045-631" x-powered-by PleskLin vary Accept-Encoding content-type text/css
GET H2	200	jquery-ui-min.css condescending-almeida.138-201-35-194.plesk.page/assets/css/	25 KB 4 KB	22ms 17ms	Stylesheet text/css	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/css/jquery-ui-min.css?etag=11402cb9 Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `6e56487cfeb01ef1239f03312dc11dff35c239bbb233463aaef8a3f83122cb63` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT content-encoding br last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx etag W/"63f25045-6436" x-powered-by PleskLin vary Accept-Encoding content-type text/css
GET H2	200	jquery.keypad.css condescending-almeida.138-201-35-194.plesk.page/assets/css/	2 KB 679 B	61ms 56ms	Stylesheet text/css	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/css/jquery.keypad.css?etag=c6e40bf4 Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `3622e69dca28b1fb99c2da018ab31e63c2c5acc86ff082436e6bff653e171c83` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT content-encoding br last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx etag W/"63f25045-793" x-powered-by PleskLin vary Accept-Encoding content-type text/css
GET H2	200	brand-min.css condescending-almeida.138-201-35-194.plesk.page/assets/css/	375 KB 58 KB	49ms 45ms	Stylesheet text/css	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/css/brand-min.css?etag=a34ce59c Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `ecddcd0fdc79d6400414f873dee1a68814fcfddadc9a2a0e93d318a1437c7f5f` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT content-encoding br last-modified Sun, 19 Feb 2023 21:48:35 GMT server nginx etag W/"63f29933-5dad9" x-powered-by PleskLin vary Accept-Encoding content-type text/css
GET H2	200	swiper-min.css condescending-almeida.138-201-35-194.plesk.page/assets/css/	17 KB 3 KB	60ms 57ms	Stylesheet text/css	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/css/swiper-min.css?etag=847aa07 Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `aa6093ae92ef933fc67b115b3f5e22f69f2fca61db60e1101197e5bc429a5c75` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT content-encoding br last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx etag W/"63f25045-4561" x-powered-by PleskLin vary Accept-Encoding content-type text/css
GET H2	200	brandIe10plus-min.css condescending-almeida.138-201-35-194.plesk.page/assets/css/	720 B 411 B	59ms 57ms	Stylesheet text/css	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/css/brandIe10plus-min.css?etag=311517bb Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `cba81b2b8dff7eb0cb3aab73c252a6317f4453fc4c8e451e5e9171bd29c63522` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT content-encoding br last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx x-accel-version 0.01 etag W/"2d0-5f5102950db40" x-powered-by PleskLin vary Accept-Encoding content-type text/css
GET H2	200	logo.png condescending-almeida.138-201-35-194.plesk.page/assets/imgs/	3 KB 3 KB	16ms 16ms	Image image/png	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/imgs/logo.png Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx etag "63f25045-c6b" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 3179
GET H2	200	calc.png condescending-almeida.138-201-35-194.plesk.page/assets/imgs/	474 B 643 B	16ms 16ms	Image image/png	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/imgs/calc.png Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `55925c9223edddf35f6b3c8037045a31999b4d9589ffd808183d287c27c6f452` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT last-modified Sun, 19 Feb 2023 16:37:25 GMT server nginx x-accel-version 0.01 etag "1da-5f5102950db40" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 474
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Login_Teaser_1.jpg condescending-almeida.138-201-35-194.plesk.page/assets/imgs/	19 KB 19 KB	15ms 15ms	Image image/jpeg	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/imgs/Login_Teaser_1.jpg Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT last-modified Sun, 19 Feb 2023 16:46:31 GMT server nginx etag "63f25267-4ba8" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 19368
GET H2	200	Login_Teaser_2.jpg condescending-almeida.138-201-35-194.plesk.page/assets/imgs/	18 KB 18 KB	14ms 14ms	Image image/jpeg	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/imgs/Login_Teaser_2.jpg Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT last-modified Sun, 19 Feb 2023 16:47:09 GMT server nginx etag "63f2528d-46b2" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 18098
GET H2	200	Login_Teaser_3.jpg condescending-almeida.138-201-35-194.plesk.page/assets/imgs/	23 KB 23 KB	16ms 15ms	Image image/jpeg	138.201.35.194 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://condescending-almeida.138-201-35-194.plesk.page/assets/imgs/Login_Teaser_3.jpg Requested by Host: condescending-almeida.138-201-35-194.plesk.page URL: https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 138.201.35.194 Esslingen am Neckar, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lieser.bitpalast.net Software nginx / PleskLin Resource Hash `d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9` Request headers accept-language de-DE,de;q=0.9 Referer https://condescending-almeida.138-201-35-194.plesk.page/cliantoz.php?dispatch=5ae6fe0b2972337b942e469a2e1d5678 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Mon, 17 Apr 2023 10:09:38 GMT last-modified Sun, 19 Feb 2023 16:50:26 GMT server nginx etag "63f25352-5ad8" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 23256

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lufthansa (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

condescending-almeida.138-201-35-194.plesk.page
redirect.viglink.com
s.free.fr
138.201.35.194
2a01:e0c:1:1599::29
52.214.253.232
24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c
3622e69dca28b1fb99c2da018ab31e63c2c5acc86ff082436e6bff653e171c83
55925c9223edddf35f6b3c8037045a31999b4d9589ffd808183d287c27c6f452
5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439
6dc2683a46a5f8550bdfaa2f99ba60e32f76d8b2db02d69b4f247ca2889c78d9
6e56487cfeb01ef1239f03312dc11dff35c239bbb233463aaef8a3f83122cb63
876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b
9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80
aa6093ae92ef933fc67b115b3f5e22f69f2fca61db60e1101197e5bc429a5c75
cba81b2b8dff7eb0cb3aab73c252a6317f4453fc4c8e451e5e9171bd29c63522
cf164a5ef75fb35be50f354125154034795cbcedd65719247735f30737b0e787
d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9
ecddcd0fdc79d6400414f873dee1a68814fcfddadc9a2a0e93d318a1437c7f5f

condescending-almeida.138-201-35-194.plesk.page Open in urlscan Pro 138.201.35.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

132 kBTransfer

501 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

condescending-almeida.138-201-35-194.plesk.page Open in urlscan Pro
138.201.35.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

132 kB
Transfer

501 kB
Size

0
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!