kunden-contact-1187939747.icu Open in urlscan Pro
194.204.25.137 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://stnr.me/Abeiu2
Effective URL:
http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911
Submission: On April 15 via manual (April 15th 2019, 7:45:53 am UTC) from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 5 countries across 3 domains to perform 9 HTTP transactions. The main IP is 194.204.25.137, located in Tallinn, Estonia and belongs to UNINET-AS Sopruse pst 145, FI. The main domain is kunden-contact-1187939747.icu.

This is the only time kunden-contact-1187939747.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon DE (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 2	206.189.139.187 206.189.139.187	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1 1	2606:4700:30:... 2606:4700:30::681f:460d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	2606:4700:30:... 2606:4700:30::681f:470d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 5	84.54.187.24 84.54.187.24	29084 (COMNET-AS) (COMNET-AS)
1	194.204.25.137 194.204.25.137	2586 (UNINET-AS...) (UNINET-AS Sopruse pst 145)
1	31.5.167.149 31.5.167.149	6830 (LGI-UPC f...) (LGI-UPC formerly known as UPC Broadband Holding B.V.)
3	217.12.199.168 217.12.199.168	15626 (ITLAS) (ITLAS)
9	4

2 206.189.139.187 (San Francisco, United States) 2 redirects

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

stnr.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.stnr.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681f:460d (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

gimmyton.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681f:470d (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

gimmyton.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 84.54.187.24 (Sofia, Bulgaria) 1 redirects

ASN29084 (COMNET-AS, BG)
PTR: vlan-187-static-24.comnet.bg

kunden-contact-1187939747.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.204.25.137 (Tallinn, Estonia)

ASN2586 (UNINET-AS Sopruse pst 145, FI)

kunden-contact-1187939747.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.5.167.149 (Romania)

ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT)

kunden-contact-1187939747.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 217.12.199.168 (Ukraine)

ASN15626 (ITLAS, UA)
PTR: vds-238634.hosted-by-itldc.com

kunden-contact-1187939747.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	kunden-contact-1187939747.icu 1 redirects kunden-contact-1187939747.icu	76 KB
2	gimmyton.pw 2 redirects gimmyton.pw	601 B
2	stnr.me 2 redirects stnr.me www.stnr.me	546 B
9	3

	Domain	Requested by
10	kunden-contact-1187939747.icu	1 redirects kunden-contact-1187939747.icu
2	gimmyton.pw	2 redirects
1	www.stnr.me	1 redirects
1	stnr.me	1 redirects
9	4

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911
Frame ID: 114CAA7FC59E8B4556E590A45EFCD622
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://stnr.me/Abeiu2 HTTP 301
https://www.stnr.me/Abeiu2/ HTTP 302
http://gimmyton.pw/?l=7JZcpT HTTP 301
https://gimmyton.pw/?l=7JZcpT HTTP 302
http://kunden-contact-1187939747.icu/ HTTP 302
http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

9
Requests

0 %
HTTPS

29 %
IPv6

3
Domains

4
Subdomains

4
IPs

5
Countries

76 kB
Transfer

153 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://stnr.me/Abeiu2 HTTP 301
https://www.stnr.me/Abeiu2/ HTTP 302
http://gimmyton.pw/?l=7JZcpT HTTP 301
https://gimmyton.pw/?l=7JZcpT HTTP 302
http://kunden-contact-1187939747.icu/ HTTP 302
http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/ Redirect Chain https://stnr.me/Abeiu2 https://www.stnr.me/Abeiu2/ http://gimmyton.pw/?l=7JZcpT https://gimmyton.pw/?l=7JZcpT http://kunden-contact-1187939747.icu/ http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911	3 KB 2 KB	845ms 439ms	Document text/html	194.204.25.137 UNINET-AS Sopruse...
General Check archive.org Show headers Download Go to Full URL http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 194.204.25.137 Tallinn, Estonia, ASN2586 (UNINET-AS Sopruse pst 145, FI), Reverse DNS Software nginx / Resource Hash `50490a5660103b660b16a79280d6cd29f26a5c097c1fd65d1b715f7eb83c7c20` Request headers Host kunden-contact-1187939747.icu Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie PHPSESSID=ic1k1p02boa27gfhgq3j8koc80 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx Date Mon, 15 Apr 2019 07:45:30 GMT Content-Type text/html; charset=UTF-8 Content-Length 1361 Connection close Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Redirect headers Server nginx Date Mon, 15 Apr 2019 07:45:29 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection close Set-Cookie PHPSESSID=ic1k1p02boa27gfhgq3j8koc80; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Location http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911
GET H/1.1	200 OK	duajMpjUAwu7vm83BmeCNA8z.php kunden-contact-1187939747.icu/content/css/	4 KB 1 KB	855ms 504ms	Stylesheet text/css	84.54.187.24 COMNET-AS
General Check archive.org Show headers Download Go to Full URL http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 84.54.187.24 Sofia, Bulgaria, ASN29084 (COMNET-AS, BG), Reverse DNS vlan-187-static-24.comnet.bg Software nginx / Resource Hash `f02aeead9319ad4850484b3d28fc9d164fef3ef846b2c8e467e16b65e35173d4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Cookie PHPSESSID=ic1k1p02boa27gfhgq3j8koc80 Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Pragma no-cache Date Mon, 15 Apr 2019 07:45:31 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding Content-Type text/css;charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 1151 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	jquery.min.js Show response kunden-contact-1187939747.icu/content/js/	95 KB 33 KB	890ms 538ms	Script application/javascript	84.54.187.24 COMNET-AS
General Check archive.org Show headers Download Go to Full URL http://kunden-contact-1187939747.icu/content/js/jquery.min.js Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 84.54.187.24 Sofia, Bulgaria, ASN29084 (COMNET-AS, BG), Reverse DNS vlan-187-static-24.comnet.bg Software nginx / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Cookie PHPSESSID=ic1k1p02boa27gfhgq3j8koc80 Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Apr 2019 07:45:31 GMT Content-Encoding gzip Last-Modified Thu, 09 Jun 2016 23:43:52 GMT Server nginx ETag "17b8b-534e0fe943e00-gzip" Vary Accept-Encoding Content-Type application/javascript Connection close Accept-Ranges bytes Content-Length 33760
GET H/1.1	200 OK	logo.png kunden-contact-1187939747.icu/content/img/	5 KB 5 KB	4095ms 265ms	Image image/png	31.5.167.149 LGI-UPC formerly ...
General Check archive.org Show headers Download Go to Show image Full URL http://kunden-contact-1187939747.icu/content/img/logo.png Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 31.5.167.149 , Romania, ASN6830 (LGI-UPC formerly known as UPC Broadband Holding B.V., AT), Reverse DNS Software nginx / Resource Hash `75a3f6f2ba7fb644bf1b0e53b9451e73495ea37ef8bd45932e5115f88af20228` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Cookie PHPSESSID=ic1k1p02boa27gfhgq3j8koc80 Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Apr 2019 07:45:34 GMT Last-Modified Sun, 09 Jul 2017 19:58:54 GMT Server nginx ETag "146c-553e7e55a3b80" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 5228
GET H/1.1	200 OK	warning.png kunden-contact-1187939747.icu/content/img/	3 KB 3 KB	4466ms 255ms	Image image/png	217.12.199.168 ITLAS
General Check archive.org Show headers Download Go to Show image Full URL http://kunden-contact-1187939747.icu/content/img/warning.png Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 217.12.199.168 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS vds-238634.hosted-by-itldc.com Software nginx / Resource Hash `47db8119e1126e41c0cc98930273b4e1d303eef2b3e6b39ef019b68f0497cf64` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Cookie PHPSESSID=ic1k1p02boa27gfhgq3j8koc80 Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Apr 2019 07:45:35 GMT Last-Modified Fri, 21 Jul 2017 23:56:58 GMT Server nginx ETag "c96-554dc9ed74680" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 3222
GET H/1.1	200 OK	Cookie set jsfunctions.php Show response kunden-contact-1187939747.icu/content/js/	16 KB 3 KB	2683ms 474ms	Script application/javascript	84.54.187.24 COMNET-AS
General Check archive.org Show headers Download Go to Full URL http://kunden-contact-1187939747.icu/content/js/jsfunctions.php?s=true Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 84.54.187.24 Sofia, Bulgaria, ASN29084 (COMNET-AS, BG), Reverse DNS vlan-187-static-24.comnet.bg Software nginx / Resource Hash `35c54785d2e39672ee7ace3502718ee589abf68e687688fe207ad14e4a8d2b9a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Pragma no-cache Date Mon, 15 Apr 2019 07:45:34 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding Content-Type application/javascript Set-Cookie PHPSESSID=julfj53fjkuunjd4lll01knvh5; path=/ Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 2587 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	cell1.png kunden-contact-1187939747.icu/content/img/	3 KB 3 KB	3324ms 265ms	Image image/png	217.12.199.168 ITLAS
General Check archive.org Show headers Download Go to Show image Full URL http://kunden-contact-1187939747.icu/content/img/cell1.png Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 217.12.199.168 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS vds-238634.hosted-by-itldc.com Software nginx / Resource Hash `7ffa9f937365e72b45a56e2f4570b6d7c5215c6489e63e8bf963671c27384594` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Apr 2019 07:45:35 GMT Last-Modified Mon, 10 Jul 2017 04:54:07 GMT Server nginx ETag "b00-553ef5f6fb9c0" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 2816
GET H/1.1	200 OK	cell2.png kunden-contact-1187939747.icu/content/img/	3 KB 3 KB	6427ms 251ms	Image image/png	84.54.187.24 COMNET-AS
General Check archive.org Show headers Download Go to Show image Full URL http://kunden-contact-1187939747.icu/content/img/cell2.png Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 84.54.187.24 Sofia, Bulgaria, ASN29084 (COMNET-AS, BG), Reverse DNS vlan-187-static-24.comnet.bg Software nginx / Resource Hash `417cf1581787c84d590e479623aad7efb4fb44c9b90fa98bc6878dae2980342b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Connection keep-alive Cache-Control no-cache Referer http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 15 Apr 2019 07:45:38 GMT Last-Modified Sat, 15 Jul 2017 07:52:09 GMT Server nginx ETag "b01-554567156fc40" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 2817
GET H/1.1	200 OK	ember.woff kunden-contact-1187939747.icu/content/fonts/	22 KB 22 KB	389ms 334ms	Font application/font-woff	217.12.199.168 ITLAS
General Check archive.org Show headers Download Go to Full URL http://kunden-contact-1187939747.icu/content/fonts/ember.woff Requested by Host: kunden-contact-1187939747.icu URL: http://kunden-contact-1187939747.icu/602100/142/2365124/505510812206/465352643/7Pg3c/?465352643?operator=protect&s=true&userID=5911 Protocol HTTP/1.1 Server 217.12.199.168 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS vds-238634.hosted-by-itldc.com Software nginx / Resource Hash `781a806fe93972194da13561a137e0d322a46074fda7dd7cd39856e26451ab9e` Request headers Pragma no-cache Origin http://kunden-contact-1187939747.icu Accept-Encoding gzip, deflate Host kunden-contact-1187939747.icu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://kunden-contact-1187939747.icu/content/css/duajMpjUAwu7vm83BmeCNA8z.php?s=true Origin http://kunden-contact-1187939747.icu Response headers Date Mon, 15 Apr 2019 07:45:32 GMT Last-Modified Sat, 15 Jul 2017 05:49:40 GMT Server nginx ETag "5684-55454bb4e2500" Content-Type application/font-woff Connection close Accept-Ranges bytes Content-Length 22148

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon DE (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			kunden-contact-1187939747.icu/	1969-12-31 23:59:59	Name: PHPSESSID Value: julfj53fjkuunjd4lll01knvh5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gimmyton.pw
kunden-contact-1187939747.icu
stnr.me
www.stnr.me
194.204.25.137
206.189.139.187
217.12.199.168
2606:4700:30::681f:460d
2606:4700:30::681f:470d
31.5.167.149
84.54.187.24
35c54785d2e39672ee7ace3502718ee589abf68e687688fe207ad14e4a8d2b9a
417cf1581787c84d590e479623aad7efb4fb44c9b90fa98bc6878dae2980342b
47db8119e1126e41c0cc98930273b4e1d303eef2b3e6b39ef019b68f0497cf64
50490a5660103b660b16a79280d6cd29f26a5c097c1fd65d1b715f7eb83c7c20
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
75a3f6f2ba7fb644bf1b0e53b9451e73495ea37ef8bd45932e5115f88af20228
781a806fe93972194da13561a137e0d322a46074fda7dd7cd39856e26451ab9e
7ffa9f937365e72b45a56e2f4570b6d7c5215c6489e63e8bf963671c27384594
f02aeead9319ad4850484b3d28fc9d164fef3ef846b2c8e467e16b65e35173d4

kunden-contact-1187939747.icu Open in urlscan Pro 194.204.25.137 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

29 %IPv6

3 Domains

4 Subdomains

4 IPs

5 Countries

76 kBTransfer

153 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

1 Cookies

Indicators

kunden-contact-1187939747.icu Open in urlscan Pro
194.204.25.137 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

29 %
IPv6

3
Domains

4
Subdomains

4
IPs

5
Countries

76 kB
Transfer

153 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!