21981-4426.s3.webspace.re Open in urlscan Pro
91.218.65.6 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qr.de/ySVDbB
Effective URL:
https://21981-4426.s3.webspace.re/
Submission: On November 10 via manual (November 10th 2022, 11:00:21 am UTC) from NL — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 91.218.65.6, located in Frankfurt am Main, Germany and belongs to SYNLINQ synlinq.de, DE. The main domain is 21981-4426.s3.webspace.re.
TLS certificate: Issued by R3 on November 9th 2022. Valid for: 3 months.

This is the only time 21981-4426.s3.webspace.re was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NL Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 1	188.40.28.36 188.40.28.36	24940 (HETZNER-AS) (HETZNER-AS)
1 1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	23.21.31.78 23.21.31.78	14618 (AMAZON-AES) (AMAZON-AES)
12	91.218.65.6 91.218.65.6	44486 (SYNLINQ s...) (SYNLINQ synlinq.de)
12	1

1 188.40.28.36 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: www256.your-server.de

qr.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

lnkd.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.21.31.78 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-31-78.compute-1.amazonaws.com

bit.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 91.218.65.6 (Frankfurt am Main, Germany)

ASN44486 (SYNLINQ synlinq.de, DE)
PTR: plesk3.living-bots.net

21981-4426.s3.webspace.re	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	webspace.re 21981-4426.s3.webspace.re	53 KB
1	bit.do 1 redirects bit.do — Cisco Umbrella Rank: 246363	271 B
1	lnkd.in 1 redirects lnkd.in — Cisco Umbrella Rank: 42631	267 B
1	qr.de 1 redirects qr.de	285 B
12	4

	Domain	Requested by
12	21981-4426.s3.webspace.re	21981-4426.s3.webspace.re
1	bit.do	1 redirects
1	lnkd.in	1 redirects
1	qr.de	1 redirects
12	4

This site contains no links.

Subject Issuer	Validity	Valid
21981-4426.s3.webspace.re R3	`2022-11-09` - `2023-02-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://21981-4426.s3.webspace.re/
Frame ID: FAFE3621EDAAFDF2461A23C197E0048C
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

InloggenKVKKVK Werkt voor ondernemers

Page URL History Show full URLs

https://qr.de/ySVDbB HTTP 302
https://lnkd.in/dqiBJCcD HTTP 301
http://bit.do/0214nl85479651 HTTP 301
https://21981-4426.s3.webspace.re/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

1
IPs

2
Countries

53 kB
Transfer

334 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://qr.de/ySVDbB HTTP 302
https://lnkd.in/dqiBJCcD HTTP 301
http://bit.do/0214nl85479651 HTTP 301
https://21981-4426.s3.webspace.re/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 21981-4426.s3.webspace.re/ Redirect Chain https://qr.de/ySVDbB https://lnkd.in/dqiBJCcD http://bit.do/0214nl85479651 https://21981-4426.s3.webspace.re/	26 KB 5 KB	68ms 13ms	Document text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / PleskLin Resource Hash `f074ee50049aece8405b7c7d4a3bc5d51f5c15d29f22ee1e14b184d322dfac5a` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-type text/html date Thu, 10 Nov 2022 11:00:17 GMT etag W/"62eb1432-6628" last-modified Thu, 04 Aug 2022 00:34:58 GMT server nginx x-powered-by PleskLin Redirect headers Connection Keep-Alive Content-Length 314 Content-Type text/html; charset=iso-8859-1 Date Thu, 10 Nov 2022 11:00:16 GMT Keep-Alive timeout=5, max=100 Location https://21981-4426.s3.webspace.re/ Server Apache/2.4.52 (Ubuntu)
GET H2	200	main.css 21981-4426.s3.webspace.re/Inloggen_files/	213 KB 15 KB	19ms 19ms	Stylesheet text/css	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/Inloggen_files/main.css Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / PleskLin Resource Hash `7a4b921b2cbe79e46447628543b813097b8e29735d05f3f3daba94a23249ca7e` Request headers accept-language de-DE,de;q=0.9 Referer https://21981-4426.s3.webspace.re/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Fri, 22 Jul 2022 03:14:06 GMT server nginx etag W/"62da15fe-3540b" x-powered-by PleskLin content-type text/css
GET H2	200	jquery.js.downloaden Show response 21981-4426.s3.webspace.re/Inloggen_files/	87 KB 30 KB	23ms 22ms	Script application/javascript	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/Inloggen_files/jquery.js.downloaden Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / PleskLin Resource Hash `ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b` Request headers accept-language de-DE,de;q=0.9 Referer https://21981-4426.s3.webspace.re/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Fri, 22 Jul 2022 03:14:06 GMT server nginx etag W/"62da15fe-15d9f" x-powered-by PleskLin content-type application/javascript
GET H2	200	misc.js.downloaden Show response 21981-4426.s3.webspace.re/Inloggen_files/	8 KB 3 KB	13ms 12ms	Script application/javascript	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/Inloggen_files/misc.js.downloaden Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / PleskLin Resource Hash `d76519645ff1cb534fb5bacf5f1554d4e39c38d27ac639965ae5ae31568fad9e` Request headers accept-language de-DE,de;q=0.9 Referer https://21981-4426.s3.webspace.re/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Fri, 22 Jul 2022 03:14:06 GMT server nginx etag W/"62da15fe-209a" x-powered-by PleskLin content-type application/javascript
GET H2	404	CiutadellaRounded-SmBd.woff2 21981-4426.s3.webspace.re/fonts/	0 0	13ms 12ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/fonts/CiutadellaRounded-SmBd.woff2 Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	roboto-v18-latin-regular.woff2 21981-4426.s3.webspace.re/fonts/	0 0	20ms 19ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/fonts/roboto-v18-latin-regular.woff2 Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	roboto-v18-latin-500.woff2 21981-4426.s3.webspace.re/fonts/	0 0	16ms 16ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/fonts/roboto-v18-latin-500.woff2 Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	roboto-v18-latin-300.woff2 21981-4426.s3.webspace.re/fonts/	0 0	22ms 21ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/fonts/roboto-v18-latin-300.woff2 Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	CiutadellaRounded-SmBd.woff 21981-4426.s3.webspace.re/assets/fonts/Ciutadella/	0 0	13ms 12ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/assets/fonts/Ciutadella/CiutadellaRounded-SmBd.woff Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	roboto-v18-latin-500.woff 21981-4426.s3.webspace.re/assets/fonts/Roboto/	0 0	17ms 14ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/assets/fonts/Roboto/roboto-v18-latin-500.woff Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	roboto-v18-latin-regular.woff 21981-4426.s3.webspace.re/assets/fonts/Roboto/	0 0	13ms 12ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/assets/fonts/Roboto/roboto-v18-latin-regular.woff Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html
GET H2	404	roboto-v18-latin-300.woff 21981-4426.s3.webspace.re/assets/fonts/Roboto/	0 0	15ms 15ms	Font text/html	91.218.65.6 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://21981-4426.s3.webspace.re/assets/fonts/Roboto/roboto-v18-latin-300.woff Requested by Host: 21981-4426.s3.webspace.re URL: https://21981-4426.s3.webspace.re/Inloggen_files/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 91.218.65.6 Frankfurt am Main, Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk3.living-bots.net Software nginx / Resource Hash Request headers Referer https://21981-4426.s3.webspace.re/Inloggen_files/main.css Origin https://21981-4426.s3.webspace.re accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Thu, 10 Nov 2022 11:00:17 GMT content-encoding br last-modified Wed, 09 Nov 2022 00:34:33 GMT server nginx etag W/"328-5ecfed210d68f" content-type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NL Government (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| $jscomp

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			qr.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4dbc0c555fc69f39437b89a94c567ffe
			qr.de/	1970-01-20 07:21:25	Name: qr_test Value: 1668078015

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://21981-4426.s3.webspace.re/fonts/CiutadellaRounded-SmBd.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/fonts/roboto-v18-latin-500.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/fonts/roboto-v18-latin-regular.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/fonts/roboto-v18-latin-300.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/assets/fonts/Ciutadella/CiutadellaRounded-SmBd.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/assets/fonts/Roboto/roboto-v18-latin-500.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/assets/fonts/Roboto/roboto-v18-latin-regular.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://21981-4426.s3.webspace.re/assets/fonts/Roboto/roboto-v18-latin-300.woff Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

21981-4426.s3.webspace.re
bit.do
lnkd.in
qr.de
13.107.42.14
188.40.28.36
23.21.31.78
91.218.65.6
7a4b921b2cbe79e46447628543b813097b8e29735d05f3f3daba94a23249ca7e
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
d76519645ff1cb534fb5bacf5f1554d4e39c38d27ac639965ae5ae31568fad9e
f074ee50049aece8405b7c7d4a3bc5d51f5c15d29f22ee1e14b184d322dfac5a

21981-4426.s3.webspace.re Open in urlscan Pro 91.218.65.6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

1 IPs

2 Countries

53 kBTransfer

334 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

2 Cookies

8 Console Messages

Indicators

21981-4426.s3.webspace.re Open in urlscan Pro
91.218.65.6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

1
IPs

2
Countries

53 kB
Transfer

334 kB
Size

2
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!