interesting-hellman.217-160-36-3.plesk.page Open in urlscan Pro
217.160.36.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://redirect.viglink.com/?u=https://s.free.fr/9NKhmePk&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=RAL&cuid=ignorelooku...
Effective URL:
https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7
Submission: On April 28 via manual (April 28th 2023, 8:00:45 am UTC) from IN — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 217.160.36.3, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is interesting-hellman.217-160-36-3.plesk.page.
TLS certificate: Issued by R3 on April 24th 2023. Valid for: 3 months.

This is the only time interesting-hellman.217-160-36-3.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lufthansa (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.214.253.232 52.214.253.232	16509 (AMAZON-02) (AMAZON-02)
1 1	2a01:e0c:1:15... 2a01:e0c:1:1599::29	12322 (PROXAD) (PROXAD)
1 13	217.160.36.3 217.160.36.3	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
12	2

1 52.214.253.232 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-253-232.eu-west-1.compute.amazonaws.com

redirect.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:e0c:1:1599::29 (France) 1 redirects

ASN12322 (PROXAD, FR)

s.free.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 217.160.36.3 (Germany) 1 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

interesting-hellman.217-160-36-3.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	plesk.page 1 redirects interesting-hellman.217-160-36-3.plesk.page	133 KB
1	free.fr 1 redirects s.free.fr	248 B
1	viglink.com 1 redirects redirect.viglink.com — Cisco Umbrella Rank: 31403	243 B
12	3

	Domain	Requested by
13	interesting-hellman.217-160-36-3.plesk.page	1 redirects interesting-hellman.217-160-36-3.plesk.page
1	s.free.fr	1 redirects
1	redirect.viglink.com	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
interesting-hellman.217-160-36-3.plesk.page R3	`2023-04-24` - `2023-07-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7
Frame ID: 03592ACE76CF415A7F0B193679A9D540
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anmelden

Page URL History Show full URLs

https://redirect.viglink.com/?u=https://s.free.fr/9NKhmePk&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=... HTTP 302
https://s.free.fr/9NKhmePk HTTP 301
https://interesting-hellman.217-160-36-3.plesk.page/?dispa=57954942 HTTP 302
https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

133 kB
Transfer

501 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://redirect.viglink.com/?u=https://s.free.fr/9NKhmePk&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=RAL&cuid=ignorelookup_de-DE HTTP 302
https://s.free.fr/9NKhmePk HTTP 301
https://interesting-hellman.217-160-36-3.plesk.page/?dispa=57954942 HTTP 302
https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cliandzbi.php Show response interesting-hellman.217-160-36-3.plesk.page/ Redirect Chain https://redirect.viglink.com/?u=https://s.free.fr/9NKhmePk&key=912c7d186f7614c22e9b994eb37ee0f1&prodOvrd=RAL&cuid=ignorelookup_de-DE https://s.free.fr/9NKhmePk https://interesting-hellman.217-160-36-3.plesk.page/?dispa=57954942 https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7	12 KB 3 KB	397ms 397ms	Document text/html	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PHP/8.0.28 PleskLin Resource Hash `cf164a5ef75fb35be50f354125154034795cbcedd65719247735f30737b0e787` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 2589 content-type text/html; charset=UTF-8 date Fri, 28 Apr 2023 08:00:40 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding x-powered-by PHP/8.0.28 PleskLin Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Fri, 28 Apr 2023 08:00:40 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location ./cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 pragma no-cache server nginx x-powered-by PHP/8.0.28 PleskLin
GET H2	200	fonts-min.css interesting-hellman.217-160-36-3.plesk.page/assets/css/	2 KB 360 B	85ms 83ms	Stylesheet text/css	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/css/fonts-min.css?etag=3ae22352 Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `6dc2683a46a5f8550bdfaa2f99ba60e32f76d8b2db02d69b4f247ca2889c78d9` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT content-encoding br last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx etag W/"63f24236-631" x-powered-by PleskLin content-type text/css
GET H2	200	jquery-ui-min.css interesting-hellman.217-160-36-3.plesk.page/assets/css/	25 KB 4 KB	84ms 83ms	Stylesheet text/css	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/css/jquery-ui-min.css?etag=11402cb9 Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `6e56487cfeb01ef1239f03312dc11dff35c239bbb233463aaef8a3f83122cb63` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT content-encoding br last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx etag W/"63f24236-6436" x-powered-by PleskLin content-type text/css
GET H2	200	jquery.keypad.css interesting-hellman.217-160-36-3.plesk.page/assets/css/	2 KB 666 B	20ms 19ms	Stylesheet text/css	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/css/jquery.keypad.css?etag=c6e40bf4 Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `3622e69dca28b1fb99c2da018ab31e63c2c5acc86ff082436e6bff653e171c83` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT content-encoding br last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx etag W/"63f24236-793" x-powered-by PleskLin content-type text/css
GET H2	200	brand-min.css interesting-hellman.217-160-36-3.plesk.page/assets/css/	375 KB 58 KB	72ms 71ms	Stylesheet text/css	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/css/brand-min.css?etag=a34ce59c Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `ecddcd0fdc79d6400414f873dee1a68814fcfddadc9a2a0e93d318a1437c7f5f` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT content-encoding br last-modified Sun, 19 Feb 2023 20:48:36 GMT server nginx etag W/"63f28b24-5dad9" x-powered-by PleskLin content-type text/css
GET H2	200	swiper-min.css interesting-hellman.217-160-36-3.plesk.page/assets/css/	17 KB 3 KB	84ms 83ms	Stylesheet text/css	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/css/swiper-min.css?etag=847aa07 Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `aa6093ae92ef933fc67b115b3f5e22f69f2fca61db60e1101197e5bc429a5c75` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT content-encoding br last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx etag W/"63f24236-4561" x-powered-by PleskLin content-type text/css
GET H2	200	brandIe10plus-min.css interesting-hellman.217-160-36-3.plesk.page/assets/css/	720 B 502 B	84ms 83ms	Stylesheet text/css	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/css/brandIe10plus-min.css?etag=311517bb Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `cba81b2b8dff7eb0cb3aab73c252a6317f4453fc4c8e451e5e9171bd29c63522` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT content-encoding gzip last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx x-accel-version 0.01 etag "2d0-5f50f52cc7980-gzip" x-powered-by PleskLin vary Accept-Encoding content-type text/css accept-ranges bytes content-length 295
GET H2	200	logo.png interesting-hellman.217-160-36-3.plesk.page/assets/imgs/	3 KB 3 KB	66ms 65ms	Image image/png	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/imgs/logo.png Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx etag "63f24236-c6b" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 3179
GET H2	200	calc.png interesting-hellman.217-160-36-3.plesk.page/assets/imgs/	474 B 643 B	68ms 67ms	Image image/png	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/imgs/calc.png Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `55925c9223edddf35f6b3c8037045a31999b4d9589ffd808183d287c27c6f452` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT last-modified Sun, 19 Feb 2023 15:37:26 GMT server nginx x-accel-version 0.01 etag "1da-5f50f52cc7980" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 474
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	Login_Teaser_1.jpg interesting-hellman.217-160-36-3.plesk.page/assets/imgs/	19 KB 19 KB	18ms 17ms	Image image/jpeg	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/imgs/Login_Teaser_1.jpg Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT last-modified Sun, 19 Feb 2023 15:46:32 GMT server nginx etag "63f24458-4ba8" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 19368
GET H2	200	Login_Teaser_2.jpg interesting-hellman.217-160-36-3.plesk.page/assets/imgs/	18 KB 18 KB	20ms 20ms	Image image/jpeg	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/imgs/Login_Teaser_2.jpg Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT last-modified Sun, 19 Feb 2023 15:47:10 GMT server nginx etag "63f2447e-46b2" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 18098
GET H2	200	Login_Teaser_3.jpg interesting-hellman.217-160-36-3.plesk.page/assets/imgs/	23 KB 23 KB	28ms 27ms	Image image/jpeg	217.160.36.3 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Show image Full URL https://interesting-hellman.217-160-36-3.plesk.page/assets/imgs/Login_Teaser_3.jpg Requested by Host: interesting-hellman.217-160-36-3.plesk.page URL: https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 217.160.36.3 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PleskLin Resource Hash `d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9` Request headers accept-language de-DE,de;q=0.9 Referer https://interesting-hellman.217-160-36-3.plesk.page/cliandzbi.php?dispatch=264e480e6bcd0b8cc14787255f70adc7 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 08:00:40 GMT last-modified Sun, 19 Feb 2023 15:50:26 GMT server nginx etag "63f24542-5ad8" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 23256

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lufthansa (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			interesting-hellman.217-160-36-3.plesk.page/	1969-12-31 23:59:59	Name: PHPSESSID Value: appnhl2e7uhl4b0in73vmuk1ov

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

interesting-hellman.217-160-36-3.plesk.page
redirect.viglink.com
s.free.fr
217.160.36.3
2a01:e0c:1:1599::29
52.214.253.232
24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c
3622e69dca28b1fb99c2da018ab31e63c2c5acc86ff082436e6bff653e171c83
55925c9223edddf35f6b3c8037045a31999b4d9589ffd808183d287c27c6f452
5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439
6dc2683a46a5f8550bdfaa2f99ba60e32f76d8b2db02d69b4f247ca2889c78d9
6e56487cfeb01ef1239f03312dc11dff35c239bbb233463aaef8a3f83122cb63
876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b
9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80
aa6093ae92ef933fc67b115b3f5e22f69f2fca61db60e1101197e5bc429a5c75
cba81b2b8dff7eb0cb3aab73c252a6317f4453fc4c8e451e5e9171bd29c63522
cf164a5ef75fb35be50f354125154034795cbcedd65719247735f30737b0e787
d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9
ecddcd0fdc79d6400414f873dee1a68814fcfddadc9a2a0e93d318a1437c7f5f

interesting-hellman.217-160-36-3.plesk.page Open in urlscan Pro 217.160.36.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

133 kBTransfer

501 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

interesting-hellman.217-160-36-3.plesk.page Open in urlscan Pro
217.160.36.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

133 kB
Transfer

501 kB
Size

1
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!