naturheilpraxis-regitz.de

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 144.76.75.26, located in Germany and belongs to HETZNER-AS, DE. The main domain is naturheilpraxis-regitz.de.

This is the only time naturheilpraxis-regitz.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	144.76.75.26 144.76.75.26	24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2a00:1450:400... 2a00:1450:4001:81f::2003	15169 (GOOGLE) (GOOGLE - Google Inc.)
5	3

3 144.76.75.26 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: web03.site-bank.de

naturheilpraxis-regitz.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	naturheilpraxis-regitz.de naturheilpraxis-regitz.de	95 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	googleapis.com fonts.googleapis.com	232 B
5	3

	Domain	Requested by
3	naturheilpraxis-regitz.de	naturheilpraxis-regitz.de
1	fonts.gstatic.com
1	fonts.googleapis.com	naturheilpraxis-regitz.de
5	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://naturheilpraxis-regitz.de/img/apps/
Frame ID: 24728.1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

5
Requests

0 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

111 kB
Transfer

125 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
naturheilpraxis-regitz.de/img/apps/
Redirect Chain

http://naturheilpraxis-regitz.de/img/apps
http://naturheilpraxis-regitz.de/img/apps/

1 KB
579 B

7ms
7ms

Document
text/html

144.76.75.26
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://naturheilpraxis-regitz.de/img/apps/
Protocol: HTTP/1.1
Server: 144.76.75.26 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: web03.site-bank.de
Software: Apache / PleskLin
Resource Hash: 4092376a37a56c755dcf39ba0257ffbd81e7ecfed61a19a382ddba4f7becc294

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Thu, 07 Sep 2017 02:27:16 GMT
Content-Encoding: gzip
Server: Apache
X-Powered-By: PleskLin
Vary: Accept-Encoding
Content-Type: text/html
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 579

Redirect headers

Date: Thu, 07 Sep 2017 02:27:16 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Location: http://naturheilpraxis-regitz.de/img/apps/
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 242

GET
H/1.1 200
OK style.css
naturheilpraxis-regitz.de/img/apps/ 2 KB
650 B 3ms
3ms Stylesheet
text/css 144.76.75.26
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://naturheilpraxis-regitz.de/img/apps/style.css
Requested by: Host: naturheilpraxis-regitz.de
URL: http://naturheilpraxis-regitz.de/img/apps/
Protocol: HTTP/1.1
Server: 144.76.75.26 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: web03.site-bank.de
Software: Apache / PleskLin
Resource Hash: d79c162546f1b3d7e79c5d4557e619f9d990b2b044806ff058193e142e6c7f2c

Request headers

Referer: http://naturheilpraxis-regitz.de/img/apps/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Thu, 07 Sep 2017 02:27:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 31 Aug 2017 03:15:36 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "224e2ac-678-558040edc8600"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 650

GET
H/1.1 200
OK css
fonts.googleapis.com/ 259 B
232 B 21ms
15ms Stylesheet
text/css 2a00:1450:4001:81f::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oleo+Script

Requested by

Host: naturheilpraxis-regitz.de
URL: http://naturheilpraxis-regitz.de/img/apps/

Protocol

HTTP/1.1

Server

2a00:1450:4001:81f::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

ESF /

Resource Hash

acb819867a8b55861a8923fa5c79972b37306c7873c069e531f2cd40b92771ed

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://naturheilpraxis-regitz.de/img/apps/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Thu, 07 Sep 2017 02:27:16 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Thu, 07 Sep 2017 02:27:16 GMT

GET
H/1.1 200
OK bg.png
naturheilpraxis-regitz.de/img/apps/ 94 KB
94 KB 3ms
3ms Image
image/png 144.76.75.26
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://naturheilpraxis-regitz.de/img/apps/bg.png
Protocol: HTTP/1.1
Server: 144.76.75.26 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: web03.site-bank.de
Software: Apache / PleskLin
Resource Hash: 34aa021f8933baefa64cd07e049433d1052e6618713dfd7e5a77eefb4883ab90

Request headers

Referer: http://naturheilpraxis-regitz.de/img/apps/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date: Thu, 07 Sep 2017 02:27:16 GMT
Last-Modified: Thu, 31 Aug 2017 03:15:36 GMT
Server: Apache
X-Powered-By: PleskLin
ETag: "224e2a8-17736-558040edc8600"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 96054

GET
H/1.1 200
OK _weQNDK6Uf40CiGFKBBUjp0EAVxt0G0biEntp43Qt6E.ttf
fonts.gstatic.com/s/oleoscript/v5/ 28 KB
16 KB 12ms
6ms Font
font/ttf 2a00:1450:4001:81f::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/oleoscript/v5/_weQNDK6Uf40CiGFKBBUjp0EAVxt0G0biEntp43Qt6E.ttf

Protocol

HTTP/1.1

Server

2a00:1450:4001:81f::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

6328fe53f3ff8b0192cbca522508f742927b857fb500b4fb7aaefee88a14075f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Oleo+Script
Origin: http://naturheilpraxis-regitz.de

Response headers

Date: Tue, 29 Aug 2017 06:13:27 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 27 Aug 2014 14:58:12 GMT
Server: sffe
Age: 764029
Vary: Accept-Encoding
Content-Type: font/ttf
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 16096
X-XSS-Protection: 1; mode=block
Expires: Wed, 29 Aug 2018 06:13:27 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
naturheilpraxis-regitz.de
144.76.75.26
2a00:1450:4001:81f::2003
2a00:1450:4001:81f::200a
34aa021f8933baefa64cd07e049433d1052e6618713dfd7e5a77eefb4883ab90
4092376a37a56c755dcf39ba0257ffbd81e7ecfed61a19a382ddba4f7becc294
6328fe53f3ff8b0192cbca522508f742927b857fb500b4fb7aaefee88a14075f
acb819867a8b55861a8923fa5c79972b37306c7873c069e531f2cd40b92771ed
d79c162546f1b3d7e79c5d4557e619f9d990b2b044806ff058193e142e6c7f2c

naturheilpraxis-regitz.de Open in urlscan Pro 144.76.75.26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

111 kBTransfer

125 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

naturheilpraxis-regitz.de Open in urlscan Pro
144.76.75.26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

111 kB
Transfer

125 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!