servertm.itrust.host Open in urlscan Pro
66.94.110.80  Malicious Activity! Public Scan

Submitted URL: https://ecommall.lemondeceramica.com/zxciop/DE/60714995830/995445818281/
Effective URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f1...
Submission: On October 13 via api from IE — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 66.94.110.80, located in United States and belongs to CONTABO, US. The main domain is servertm.itrust.host.
TLS certificate: Issued by R3 on August 15th 2022. Valid for: 3 months.
This is the only time servertm.itrust.host was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 103.21.59.201 394695 (PUBLIC-DO...)
7 16 66.94.110.80 40021 (CONTABO)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
10 3
Apex Domain
Subdomains
Transfer
16 itrust.host
servertm.itrust.host
200 KB
1 ipapi.co
ipapi.co — Cisco Umbrella Rank: 18429
538 B
1 lemondeceramica.com
ecommall.lemondeceramica.com
143 B
10 3
Domain Requested by
16 servertm.itrust.host 7 redirects servertm.itrust.host
1 ipapi.co servertm.itrust.host
1 ecommall.lemondeceramica.com 1 redirects
10 3

This site contains no links.

Subject Issuer Validity Valid
servertm.itrust.host
R3
2022-08-15 -
2022-11-13
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-05-16 -
2023-05-16
a year crt.sh

This page contains 1 frames:

Primary Page: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Frame ID: E5ADBA08687953DE1832BACFD057BA2D
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

| Welcome |

Page URL History Show full URLs

  1. https://ecommall.lemondeceramica.com/zxciop/DE/60714995830/995445818281/ HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/ HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/?VfatYBjS=kUPiyAYu HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c... Page URL
  2. https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c... HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b... HTTP 301
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b... HTTP 301
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b... HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b... HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

216 kB
Transfer

427 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ecommall.lemondeceramica.com/zxciop/DE/60714995830/995445818281/ HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/ HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/?VfatYBjS=kUPiyAYu HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php Page URL
  2. https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php?VfatYBjS21711421819=VfatYBjS21711421819-88bd4e5e32ac24968e6d7c4b77d763ceff7fba57 HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/index.php?kUPiyAYu21711421819=o31m4FZbB7o HTTP 301
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0 HTTP 301
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/ HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/index.php?valid=true&id=11048380 HTTP 302
    https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://ecommall.lemondeceramica.com/zxciop/DE/60714995830/995445818281/ HTTP 302
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/ HTTP 302
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/?VfatYBjS=kUPiyAYu HTTP 302
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
832004156c96f0575ceee44c5cdf73b9.php
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/
Redirect Chain
  • https://ecommall.lemondeceramica.com/zxciop/DE/60714995830/995445818281/
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/?VfatYBjS=kUPiyAYu
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php
9 KB
2 KB
Document
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
1c5be1d791ed3ed1dd4cecf2223f253436269e31da1fa60708e5ece433b2fa9c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Thu, 13 Oct 2022 21:05:24 GMT
location
832004156c96f0575ceee44c5cdf73b9.php
server
nginx
strict-transport-security
max-age=31536000
x-cache
HIT from Backend
x-content-type-options
nosniff
x-xss-protection
1; mode=block
/
ipapi.co/org/
9 B
538 B
XHR
General
Full URL
https://ipapi.co/org/
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::681a:82c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:25 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Host, Origin
allow
HEAD, OPTIONS, OPTIONS, GET, POST
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://servertm.itrust.host
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4kR%2FB2Wwtv3GgERRo7448QAgkedGOcCJ3DCHVzyco2Uqlij0shAgOIiZNB7D0BfRTm5Kn4mE5t99TBUkp0rRb7uqFns7lYIguD8FFeC88xULogoPG%2BW2COjbd5ocF1Lf9mUA7FYT"}],"group":"cf-nel","max_age":604800}
x-frame-options
DENY
cf-ray
759b08844a3d9bf2-FRA
content-length
9
Primary Request 00951124a.php
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/
Redirect Chain
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php?VfatYBjS21711421819=VfatYBjS21711421819-88bd4e5e32ac24968e6d7c4b77d763ceff7fba57
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/index.php?kUPiyAYu21711421819=o31m4FZbB7o
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/index.php?valid=true&id=11048380
  • https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
3 KB
3 KB
Document
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
0a1005d2517dfefab96b3e1dbd8f76a2605f1f7a3a8c3cc918372ac315615c63

Request headers

Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/832004156c96f0575ceee44c5cdf73b9.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset-UTF-8;charset=UTF-8
date
Thu, 13 Oct 2022 21:05:26 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset-UTF-8;charset=UTF-8
date
Thu, 13 Oct 2022 21:05:26 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
./00951124a.php?web=succes&local=_&id=71641764
pragma
no-cache
server
nginx
style.css
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/css/
209 KB
70 KB
Stylesheet
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/css/style.css
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
993198ae94d90e3ea850f7d6b70443b64cf5f817098c778821edf924c297eea3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:26 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"34299-5eaf0de45adc3"
vary
Accept-Encoding
content-type
text/css
style.js
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/js/
96 KB
34 KB
Script
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/js/style.js
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
b56dd0f5e443608e46b42696f86fe376190c1688f2586cf5345b0b43f2973a5c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:26 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"17f6f-5eaf0de45a5f3"
vary
Accept-Encoding
content-type
application/javascript
lg.svg
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/
2 KB
893 B
Image
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/lg.svg
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:27 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"7f8-5eaf0de45b97b"
vary
Accept-Encoding
content-type
image/svg+xml
pak.png
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/
878 B
1 KB
Image
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/pak.png
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
4057023fcfa4360934b1a1409a74a40ffbc2bb7dacd2bcc6f69d66a9673f09e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:27 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"36e-5eaf0de45b97b"
vary
Accept-Encoding
content-type
image/png
ta3.svg
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/
2 KB
1 KB
Image
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/ta3.svg
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
42794908246997d603888b2c2098941e0c3f9b7b0f719134365789189c7edac0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:27 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"77d-5eaf0de45bd63"
vary
Accept-Encoding
content-type
image/svg+xml
pub.jpg
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/
80 KB
79 KB
Image
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/pub.jpg
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:27 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"140d5-5eaf0de45b593"
vary
Accept-Encoding
content-type
image/jpeg
pubr.gif
servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/
8 KB
8 KB
Image
General
Full URL
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/layout/img/pubr.gif
Requested by
Host: servertm.itrust.host
URL: https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.94.110.80 , United States, ASN40021 (CONTABO, US),
Reverse DNS
servertm.itrust.host
Software
nginx /
Resource Hash
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://servertm.itrust.host/~egytech/wp-content/upgrade/DE-03548/217.114.218.19/aa495e18c7e3a21a4e48923b92048a61/3nz0/F004f19441/00951124a.php?web=succes&local=_&id=71641764
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 21:05:27 GMT
content-encoding
gzip
last-modified
Thu, 13 Oct 2022 21:05:25 GMT
server
nginx
etag
W/"2098-5eaf0de45b1ab"
vary
Accept-Encoding
content-type
image/gif
truncated
/
17 KB
17 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171

Request headers

Referer
Origin
https://servertm.itrust.host
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
application/font-woff2;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| preventBack object| Modernizr function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
servertm.itrust.host/ Name: PHPSESSID
Value: b1cv5273p13q9bvc80r6k5rc47