chinacottagecarehome.xn--bertreibt-p9a.de Open in urlscan Pro Puny
chinacottagecarehome.übertreibt.de IDN
144.76.162.245 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://chinacottagecarehome.xn--bertreibt-p9a.de/
Effective URL:
http://chinacottagecarehome.xn--bertreibt-p9a.de/
Submission: On September 28 via manual (September 28th 2021, 11:23:34 am UTC) from GB — Scanned from DE

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 5 HTTP transactions. The main IP is 144.76.162.245, located in Tettnang Castle, Germany and belongs to HETZNER-AS, DE. The main domain is chinacottagecarehome.xn--bertreibt-p9a.de.

This is the only time chinacottagecarehome.xn--bertreibt-p9a.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	144.76.162.245 144.76.162.245	24940 (HETZNER-AS) (HETZNER-AS)
1	142.250.186.78 142.250.186.78	15169 (GOOGLE) (GOOGLE)
2	15.207.45.93 15.207.45.93	16509 (AMAZON-02) (AMAZON-02)
1	52.105.157.27 52.105.157.27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	5

1 144.76.162.245 (Tettnang Castle, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: master2.subdomain.com

chinacottagecarehome.xn--bertreibt-p9a.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.78 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.207.45.93 (Mumbai, India)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-207-45-93.ap-south-1.compute.amazonaws.com

indha.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.105.157.27 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

vikinggenetics-my.sharepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	indha.in indha.in	13 KB
1	sharepoint.com vikinggenetics-my.sharepoint.com	8 KB
1	google-analytics.com www.google-analytics.com	17 KB
1	xn--bertreibt-p9a.de chinacottagecarehome.xn--bertreibt-p9a.de	9 KB
5	4

	Domain	Requested by
2	indha.in	chinacottagecarehome.xn--bertreibt-p9a.de indha.in
1	vikinggenetics-my.sharepoint.com	chinacottagecarehome.xn--bertreibt-p9a.de
1	www.google-analytics.com	chinacottagecarehome.xn--bertreibt-p9a.de
1	chinacottagecarehome.xn--bertreibt-p9a.de
5	4

This site contains no links.

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
indha.in cPanel, Inc. Certification Authority	`2021-08-14` - `2021-11-12`	3 months	crt.sh
*.sharepoint.com DigiCert Cloud Services CA-1	`2021-02-05` - `2022-02-04`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://chinacottagecarehome.xn--bertreibt-p9a.de/
Frame ID: BD4C4C8C16A43840C3CA02B06B2B3153
Requests: 7 HTTP requests in this frame

Frame: https://indha.in/wp-admin/maint/index.php/
Frame ID: 33ABC97157AD409D2A46EB296D70D40A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

50 kB
Transfer

125 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

5 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.0 200
OK Primary Request / Show response
chinacottagecarehome.xn--bertreibt-p9a.de/ 31 KB
9 KB 51ms
20ms Document
text/html 144.76.162.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://chinacottagecarehome.xn--bertreibt-p9a.de/
Protocol: HTTP/1.0
Server: 144.76.162.245 Tettnang Castle, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: master2.subdomain.com
Software: Apache/2.4.10 (Debian) /
Resource Hash: 4ddc4d8a3ad8a6213bf21b860205e60c7c2a72f9086dd1c55e56e98fbf80da38

Request headers

Host: chinacottagecarehome.xn--bertreibt-p9a.de
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Tue, 28 Sep 2021 11:23:29 GMT
Server: Apache/2.4.10 (Debian)
Content-Encoding: gzip
Content-Length: 9200
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

52ms
15ms

Script
text/javascript

142.250.186.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: chinacottagecarehome.xn--bertreibt-p9a.de
URL: http://chinacottagecarehome.xn--bertreibt-p9a.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 6631
date: Tue, 28 Sep 2021 09:32:58 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Tue, 28 Sep 2021 11:32:58 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 487134547939d7e4874909f045b67b8232cb0a445ebce71aa85aaa5db4744f0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e05fce5f98ca525ed88502ec94c43763661ea74e0f84e5625a7ed161c28447f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d92fb73d4422ab97f4c170639dde5d2f11a3ebdb601a44ce2ab9de104b2da103

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717cc576a1098d7bc9cfc06b4f908024e6f07009879a6e1f55ccc04f4a833437

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 889 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f9b1f894802acbe8d4916a787d0c221e8826ddb9db42ec09380b2f3489092c8f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
indha.in/wp-admin/maint/index.php/ Frame 33AB 22 KB
9 KB 1146ms
900ms Document
text/html 15.207.45.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://indha.in/wp-admin/maint/index.php/
Requested by: Host: chinacottagecarehome.xn--bertreibt-p9a.de
URL: http://chinacottagecarehome.xn--bertreibt-p9a.de/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 15.207.45.93 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-15-207-45-93.ap-south-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 392f16dd6f78a4276aacfda6d4cb03e4e0f1974506f329cc7c22eb450665e087

Request headers

Host: indha.in
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://chinacottagecarehome.xn--bertreibt-p9a.de/

Response headers

Date: Tue, 28 Sep 2021 11:23:30 GMT
Server: Apache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK microsoft_logo.svg
indha.in/wp-admin/maint/index.php/naf/inf/ Frame 33AB 4 KB
4 KB 122ms
122ms Image
image/svg+xml 15.207.45.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://indha.in/wp-admin/maint/index.php/naf/inf/microsoft_logo.svg
Requested by: Host: indha.in
URL: https://indha.in/wp-admin/maint/index.php/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 15.207.45.93 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-15-207-45-93.ap-south-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://indha.in/wp-admin/maint/index.php/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 28 Sep 2021 11:23:30 GMT
Last-Modified: Fri, 18 May 2018 19:17:00 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3651

GET
DATA 200
OK truncated
/ Frame 33AB 2 KB
2 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5

Request headers

Referer
Origin: https://indha.in
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H/1.1 200
OK pdf.png
vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/ Frame 33AB 7 KB
8 KB 501ms
63ms Image
image/png 52.105.157.27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png

Requested by

Host: chinacottagecarehome.xn--bertreibt-p9a.de
URL: http://chinacottagecarehome.xn--bertreibt-p9a.de/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.105.157.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://indha.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}
X-Powered-By: ASP.NET
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-SharePointHealthScore: 1
MS-CV: n/PlIZBgADA+qDTAvcUMMg.0
Content-Length: 6830
MicrosoftSharePointTeamServices: 16.0.0.21715
X-MS-InvokeApp: 1; RequireReadOnly
SPRequestDuration: 15
Last-Modified: Sat, 18 Sep 2021 00:48:27 GMT
Server: Microsoft-IIS/10.0
SPRequestGuid: 21e5f39f-6090-3000-3ea8-34c0bdc50c32
Date: Tue, 28 Sep 2021 11:23:31 GMT
X-FRAME-OPTIONS: SAMEORIGIN
Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=189041&frontEnd=FarmDirect"}]}
Content-Type: image/png
request-id: 21e5f39f-6090-3000-3ea8-34c0bdc50c32
ETag: "807f51e426acd71:0"
Accept-Ranges: bytes
SPIisLatency: 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chinacottagecarehome.xn--bertreibt-p9a.de
indha.in
vikinggenetics-my.sharepoint.com
www.google-analytics.com
142.250.186.78
144.76.162.245
15.207.45.93
52.105.157.27
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
392f16dd6f78a4276aacfda6d4cb03e4e0f1974506f329cc7c22eb450665e087
487134547939d7e4874909f045b67b8232cb0a445ebce71aa85aaa5db4744f0e
4ddc4d8a3ad8a6213bf21b860205e60c7c2a72f9086dd1c55e56e98fbf80da38
717cc576a1098d7bc9cfc06b4f908024e6f07009879a6e1f55ccc04f4a833437
8e05fce5f98ca525ed88502ec94c43763661ea74e0f84e5625a7ed161c28447f
d92fb73d4422ab97f4c170639dde5d2f11a3ebdb601a44ce2ab9de104b2da103
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545
f9b1f894802acbe8d4916a787d0c221e8826ddb9db42ec09380b2f3489092c8f

chinacottagecarehome.xn--bertreibt-p9a.de Open in urlscan Pro Puny chinacottagecarehome.übertreibt.de IDN 144.76.162.245 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

4 Countries

50 kBTransfer

125 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

chinacottagecarehome.xn--bertreibt-p9a.de Open in urlscan Pro Puny
chinacottagecarehome.übertreibt.de IDN
144.76.162.245 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

50 kB
Transfer

125 kB
Size

0
Cookies

5 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!