![](/screenshots/b169de69-c6f3-4451-be23-b5d098a5ce87.png)
herunterladen-rechnung-iono.chronik-roesler-kerzen.de
Open in
urlscan Pro
2a01:4f8:d0a:2777::2
Malicious Activity!
Public Scan
Effective URL: https://herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/
Submission: On June 27 via manual from CH — Scanned from CH
Summary
TLS certificate: Issued by R10 on June 27th 2024. Valid for: 3 months.
This is the only time herunterladen-rechnung-iono.chronik-roesler-kerzen.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 1&1 Ionos (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.77.244.81 54.77.244.81 | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 2a01:4f8:d0a:... 2a01:4f8:d0a:2777::2 | 24940 (HETZNER-AS) (HETZNER-AS) | |
4 | 213.165.66.58 213.165.66.58 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
14 | 2 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-244-81.eu-west-1.compute.amazonaws.com
394632.seu2.cleverreach.com |
ASN24940 (HETZNER-AS, DE)
herunterladen-rechnung-iono.chronik-roesler-kerzen.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
chronik-roesler-kerzen.de
herunterladen-rechnung-iono.chronik-roesler-kerzen.de |
574 KB |
4 |
uicdn.net
ce1.uicdn.net — Cisco Umbrella Rank: 245107 |
222 KB |
1 |
cleverreach.com
1 redirects
394632.seu2.cleverreach.com |
560 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
10 | herunterladen-rechnung-iono.chronik-roesler-kerzen.de |
herunterladen-rechnung-iono.chronik-roesler-kerzen.de
|
4 | ce1.uicdn.net |
herunterladen-rechnung-iono.chronik-roesler-kerzen.de
|
1 | 394632.seu2.cleverreach.com | 1 redirects |
14 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
herunterladen-rechnung-iono.chronik-roesler-kerzen.de R10 |
2024-06-27 - 2024-09-25 |
3 months | crt.sh |
ce1.uicdn.net GeoTrust RSA CA 2018 |
2024-03-20 - 2025-03-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/
Frame ID: A78D335FBFA63B3012004BE7C92496FE
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/b169de69-c6f3-4451-be23-b5d098a5ce87.png)
Page URL History Show full URLs
-
https://394632.seu2.cleverreach.com/c/96434108/89ee06291138-sfqgzg
HTTP 302
https://herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://394632.seu2.cleverreach.com/c/96434108/89ee06291138-sfqgzg
HTTP 302
https://herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/ Redirect Chain
|
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ionos.min.css
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/css/ |
547 KB 547 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.min.css
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/css/ |
237 B 320 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
starter-main.min.css
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
my-account.svg
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/images/ |
845 B 929 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
password.svg
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/images/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
product-email.svg
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cloud-dcd.svg
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
product-hidrive.svg
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/images/ |
920 B 967 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 63 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
exos-icon-font.woff
ce1.uicdn.net/exos/icons/ |
50 KB 50 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-semibold.woff
ce1.uicdn.net/exos/fonts/overpass/ |
40 KB 40 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-semibold.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
68 KB 69 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
herunterladen-rechnung-iono.chronik-roesler-kerzen.de/app/2024A810183/images/ |
7 KB 7 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 1&1 Ionos (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
394632.seu2.cleverreach.com/ | Name: PHPSESSID Value: EoMm9JOQ3pudkam2fW8B9V55%2Cfr7ZRhBwrRnSg1GbIRwksvo |
|
394632.seu2.cleverreach.com/ | Name: cr_user Value: 4408 |
|
394632.seu2.cleverreach.com/ | Name: cr_client Value: 394632 |
|
394632.seu2.cleverreach.com/ | Name: cr_mailing Value: 15426952 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
394632.seu2.cleverreach.com
ce1.uicdn.net
herunterladen-rechnung-iono.chronik-roesler-kerzen.de
213.165.66.58
2a01:4f8:d0a:2777::2
54.77.244.81
0f1f89f3de13481ab3a2f24d0840323c36e1673bb3d0283d7ec0c63e9560bd71
192483228ae6cdab87abbbde507440bffbdc1d90e7fd565f915c19b820cff3b0
209df082d94354998063d5e5613588a07a7652cda292949b05060de1fac6a6a2
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
48a64dde35632cdb0ccbd266681384f8943a0e7c17c08cc7364d694afcd3e7dc
5377c59be86ec8cf1be5182f36a62cfffa1a44f0dd1d55972bdc91a884cdc0f7
5ef6834dac6f7776e6e30377716395f46dfd88dc757daf6c51176dfb6a996761
7043d536f588b8ccb2d6fba13113af4b69fe0c517c7bd885081e62b90d6c1e1f
78957d2db50f27985e0c73c0236d2b4377f53f8c2681c2d00be836b6eb967a4d
82a3b507d88d0bf1ae099818e5e4754081e05a915408c22ec6db3cda9b96afd4
84d5f3a01a9722aa522385eb670861168d4013fdbd376a5296557de13619bf58
9af17510119a237ffa67e5d970da4c5d7afe328ae64eff4fc6d7931d79e21036
b0390aa3e137e3e49d7d6ed5d86c208fec1dd45ff8a56836c3f86c2e32cd2d7a
cf83744b09d163a6ad15e07ec454265536810c336a647c7a1aaaadfa8abb36a8