urlscan.io logo urlscan.io
SecurityTrails logo

www9.newcomercode.net Open in urlscan Pro
85.13.157.212  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://capiital1.com/
Effective URL: https://www9.newcomercode.net/
Submission: On September 09 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 15 HTTP transactions. The main IP is 85.13.157.212, located in Germany and belongs to NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE. The main domain is www9.newcomercode.net.
TLS certificate: Issued by R3 on August 21st 2021. Valid for: 3 months.
This is the only time www9.newcomercode.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 23.82.12.30 30633 (LEASEWEB-...)
2 2 173.192.101.24 36351 (SOFTLAYER)
1 1 13.248.219.100 16509 (AMAZON-02)
13 85.13.157.212 34788 (NMM-AS D)
1 2606:4700::68... 13335 (CLOUDFLAR...)
15 3
2    23.82.12.30 (Laurel, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
capiital1.com
2    173.192.101.24 (Dallas, United States)

ASN36351 (SOFTLAYER, US)
PTR: 18.65.c0ad.ip4.static.sl-reverse.com
mybetterdl.com
p185689.mybetterdl.com
1    13.248.219.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: abaa834e320054d4d.awsglobalaccelerator.com
rb.gy
13    85.13.157.212 (Germany)

ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd40608.kasserver.com
www9.newcomercode.net
1    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
netdna.bootstrapcdn.com
Apex Domain
Subdomains		 Transfer
13 newcomercode.net
www9.newcomercode.net
629 KB
2 mybetterdl.com
mybetterdl.com
p185689.mybetterdl.com
1 KB
2 capiital1.com
capiital1.com
3 KB
1 bootstrapcdn.com
netdna.bootstrapcdn.com
7 KB
1 rb.gy
rb.gy
221 B
15 5
Domain Requested by
13 www9.newcomercode.net capiital1.com
www9.newcomercode.net
2 capiital1.com 1 redirects
1 netdna.bootstrapcdn.com www9.newcomercode.net
1 rb.gy 1 redirects
1 p185689.mybetterdl.com 1 redirects
1 mybetterdl.com 1 redirects
15 6

This site contains links to these domains. Also see Links.

Domain
wofo-offers.com
Subject Issuer Validity Valid
www9.newcomercode.net
R3		 2021-08-21 -
2021-11-19		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-01 -
2022-02-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www9.newcomercode.net/
Frame ID: F1A184F36338CFE9A8F2ADE2D8C54D17
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

TAZ

Page URL History Show full URLs

  1. http://capiital1.com/ Page URL
  2. http://capiital1.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTE... HTTP 302
    https://mybetterdl.com/aS/feedclick?s=EUEFNSLDhHsKg2DaWTq2KI8uDhK_8R6jZHDKZGtRZ0awNFsuYEBhHYLUfaDR_... HTTP 302
    https://p185689.mybetterdl.com/adServe/domainClick?ai=IMh5EoW_2OoytLAg21JEdJn5Txe1nqW5yzPKUfQncVy407H84asSw... HTTP 302
    https://rb.gy/rkj4uy HTTP 301
    https://www9.newcomercode.net/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

20 %
IPv6

5
Domains

6
Subdomains

3
IPs

2
Countries

637 kB
Transfer

734 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://capiital1.com/ Page URL
  2. http://capiital1.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTE3OTIyMiwiaWF0IjoxNjMxMTcyMDIyLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycWhoY2p2dGlkaDZsbGJjZGcwbmp0cWMiLCJuYmYiOjE2MzExNzIwMjIsInRzIjoxNjMxMTcyMDIyODUwNjg5fQ.V1tcRWrkX9sZwyQsylHPai7KqHdOew-n5PUe1Lh_g60&sid=6564927a-113e-11ec-8064-3cfcc4420837 HTTP 302
    https://mybetterdl.com/aS/feedclick?s=EUEFNSLDhHsKg2DaWTq2KI8uDhK_8R6jZHDKZGtRZ0awNFsuYEBhHYLUfaDR__NeVVH-ImtJpPaG_Nh80WMmwqfTqqBykvhwGVatJqgR1xMoDKoyvP4nOVIrIFFzO-PqxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7NFT_4ZRcycYiJeYpos6ipJ3M0y_hfsYme0ZaIuuvkueubp7kZArPGd-bIlRKPSvCQLUfCj9pxNtstF2JDRcB1fjYpVUBW9mUtnYgY0I_ShN62OJGiFDF-sGkYYsTD3QDzNi0zWTGf8VK8t3zSjl0UZNw9lGFN_r1k6Fb4wZvu6iwIVyJ0-oWh2ndFBZo9DU-NYGUVl1leqHDKmzZmkr9IBWjZ6tueqBTzHrxx3Bep3oL8lC34NRufEELJegJa_gpw-0J4lNgVq1BPccQvSZm0LcoNiPGfqtIBZ2TRmTCi_mAW19wyd3SAtUJt0vhnMaXTA5K5_EoxPMPVYw48wKlH1h7CrCfs1qPBgMc_nAoPrAD3-ul--FLfBhnC7cKdTbftHruV-WEfYuFeov7d-qmJTfgeM01-v8HtdMZkNrgMluE3Vl4HTuCI9GQeSwVTGwIV4iwL27DO9Wdq-FZnrKzy1TE6uUoxiJe3jbeIrNUUOSxhMOmsEVTsuJ6_gkRj1RUs_3pNwAjiqQO6tvyghvQht4En9goylcgQx6HwKz_ljpb55LV80fysUtCtzdlG7ZSZ1jx094CmnBLjPTYmfWjoVE4i9cTfdbkqR1f9Fpb41ZHGc3tDj8iL6ocSjfmQDhPcDYXCEHYRbcS51j8av-n5jhcbaZ7tUsbrHQ95V39nMoQ6j6_bITQ8Ow2WrtUJcj2Eex-TaETWqwUyJtRlOJ4LSy23qIF2mxGpu3yT36a6bn5Ksyw5VI6sUh6LB51TyPTJkY_vvHDi4uCv2i922LN2oPrDIQavpWNPZ4xwCrW3wekbO7pWllwGdVGZXxgmhR3INz-QU0tQexjS1sjTSDdvxjTnBG6KLohwyqV7tETR7cP-o1a3gHjZa1GVWyseWWwK6c7oiDTpxDaQOdy-Ktbcd--YqskXimRCL7oeqEmQLKbq9IaY6LYxIZWMdLhVZ-b57MywwUPf5i78p2MqbkZWZerxMcIMxGZ8Dd6khgw1xizWMeetFs7qVMcs-YHfoW8vHIJ5SbpGXDuzV43JffXLd2OozLLYQrKtqiDFTLoVLz5YlXd2pUmbquaUtUUC10IQf2-HFh5IolVHUVgE-cuaYByljerSDS5-QwaQOvadgw6aCoXbwbleoAVM9bqSn6ZQoyEOp_uQSuZDrOLfQ0JDqPiWyyEnr6j57lePxzD8FZrHLPmB36FvLxoe69ovvZ0w42_V6lH_sVR52jM6-Hyv0gap56scovdyCYToM-EFzmI HTTP 302
    https://p185689.mybetterdl.com/adServe/domainClick?ai=IMh5EoW_2OoytLAg21JEdJn5Txe1nqW5yzPKUfQncVy407H84asSwVRWFCqhBHPYfbTIcJq106M_RFaBcwr6-p1LGVWYVlTz_tvSyZhB3Zme2-kMvWtZh0n96h-moH0m1Q8x4Kyer7Xr2iPLc49PEXpJ7WBPyAKhJnDLTJ0ijWesFnB-eWnMmXaz2tUGY1MywXkLx8HD-sP08czw3vFiJWtdnt_Lrhn8xIM-F2T9IJsA6I4B8spzdfq1VQcFG0q_7cxV8pdl6qeNnUqwZB1wttfL2tY4RhRiPI3aj7cR-FAiUOPEN66SyzZXxnX9w3KH1wgeoYy4_2BwF5GYn3cQm7mTKB2lpsLjbWnaHeEFBufsfIEQ6j_a0nnaMzr4fK_SBqnnqxyi93Klu56Ibtjf36CO8S7VjsMM&ui=EUEFNSLDhHsKg2DaWTq2KPbWwvziNp_1xLgNeF8Zj-jpyO_wc6B2L2HjccrCSYlSJc-XiS9sMo_WkUvZm2TfYITilp6hf-zayLePPL6cj2eT5YcmVJB6vw&si=1&oref=08effb99e3ac96c097ca6bd7d3bb97df&optunit=Sf3qH6agfSYa0M9BYWejQw&rb=QTWv0rczs9k&rr=1&abtg=0 HTTP 302
    https://rb.gy/rkj4uy HTTP 301
    https://www9.newcomercode.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
capiital1.com/ 		469 B
826 B 		Document
General
Check archive.org
Download Go to
Full URL
http://capiital1.com/
Protocol
HTTP/1.1
Server
23.82.12.30 Laurel, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Host
capiital1.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, private, must-revalidate
connection
close
content-length
469
content-type
text/html; charset=utf-8
date
Thu, 09 Sep 2021 07:20:22 GMT
server
nginx
set-cookie
sid=6564927a-113e-11ec-8064-3cfcc4420837; path=/; domain=.capiital1.com; expires=Tue, 27 Sep 2089 10:34:29 GMT; max-age=2147483647; HttpOnly
Primary Request /
www9.newcomercode.net/
Redirect Chain
  • http://capiital1.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTYzMTE3OTIyMiwiaWF0IjoxNjMxMTcyMDIyLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycWhoY2p2dGlkaDZsbGJjZGcwbmp0cWM...
  • https://mybetterdl.com/aS/feedclick?s=EUEFNSLDhHsKg2DaWTq2KI8uDhK_8R6jZHDKZGtRZ0awNFsuYEBhHYLUfaDR__NeVVH-ImtJpPaG_Nh80WMmwqfTqqBykvhwGVatJqgR1xMoDKoyvP4nOVIrIFFzO-PqxlOmzgR5fh3nQoQZVtH1UcHY6z5T2K7...
  • https://p185689.mybetterdl.com/adServe/domainClick?ai=IMh5EoW_2OoytLAg21JEdJn5Txe1nqW5yzPKUfQncVy407H84asSwVRWFCqhBHPYfbTIcJq106M_RFaBcwr6-p1LGVWYVlTz_tvSyZhB3Zme2-kMvWtZh0n96h-moH0m1Q8x4Kyer7Xr2iP...
  • https://rb.gy/rkj4uy
  • https://www9.newcomercode.net/
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www9.newcomercode.net/
Requested by
Host: capiital1.com
URL: http://capiital1.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
a472856f502af25298eed6a7387693fe3e21bc93ae0b8ab98b7a717d94a6df65

Request headers

:method
GET
:authority
www9.newcomercode.net
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://capiital1.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://capiital1.com/

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
server
Apache
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
etag
"424b-5cb00b2c30498-br"
accept-ranges
bytes
vary
Accept-Encoding,User-Agent
content-encoding
br
content-length
5156
content-type
text/html

Redirect headers

Date
Thu, 09 Sep 2021 07:20:24 GMT
Content-Length
0
Cache-Control
no-cache, no-store
Expires
-1
Location
https://www9.newcomercode.net/
Engine
Rebrandly.redirect, version 2.1
jquery.js
www9.newcomercode.net/files/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www9.newcomercode.net/files/jquery.js
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

:path
/files/jquery.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
etag
"15851-5cb00b2ce7e07-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
accept-ranges
bytes
content-length
30089
styles.css
www9.newcomercode.net/files/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www9.newcomercode.net/files/styles.css
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
ac82b39e64db16df0c9d59832a78d60ca919fb39f39e22c1dd63e70d960cffb2

Request headers

:path
/files/styles.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
content-encoding
br
last-modified
Thu, 02 Sep 2021 10:32:24 GMT
server
Apache
etag
"34c8-5cb00b2d67cdb-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
accept-ranges
bytes
content-length
2558
hd-hero1.jpg
www9.newcomercode.net/files/ 		118 KB
119 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/hd-hero1.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
44d22dd34c6e3f0c9253be6aa002e79f353981ba21ec8b5f92c1a82923d65908

Request headers

:path
/files/hd-hero1.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
accept-ranges
bytes
etag
"1d6fe-5cb00b2cbde2b"
content-length
120574
content-type
image/jpeg
2018-03-28_12.jpg
www9.newcomercode.net/files/ 		188 KB
190 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/2018-03-28_12.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
6ef18c874e412f0827a0830ddf7f9f6ace52e3ba01e85dfb0de890601d085b30

Request headers

:path
/files/2018-03-28_12.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
accept-ranges
bytes
etag
"2f1a2-5cb00b2c7e691"
content-length
192930
content-type
image/jpeg
carsten-maschmeyer-und-judith-williams.jpg
www9.newcomercode.net/files/ 		71 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/carsten-maschmeyer-und-judith-williams.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
c155aa91c885690a76b7980782929e024d0a9c1c0eb718467f1984b190e91e39

Request headers

:path
/files/carsten-maschmeyer-und-judith-williams.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
accept-ranges
bytes
etag
"11cc9-5cb00b2c69e73"
content-length
72905
content-type
image/jpeg
ccccc.jpg
www9.newcomercode.net/files/ 		138 KB
139 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/ccccc.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
4f51b53dba3c024c6ddb381aa17367a54be11c30b3a9411d9b0691aa3493882e

Request headers

:path
/files/ccccc.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
accept-ranges
bytes
etag
"2267d-5cb00b2ca960d"
content-length
140925
content-type
image/jpeg
prof1.jpg
www9.newcomercode.net/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/prof1.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
f6894acedc5915b51c9f1857f0da8ea062475edaff3b391b7cd7ffdf7115ad91

Request headers

:path
/files/prof1.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
accept-ranges
bytes
etag
"895-5cb00b2ce4f27"
content-length
2197
content-type
image/jpeg
prof2.jpg
www9.newcomercode.net/files/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/prof2.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
1707346b93ea4f91be70ba1d144c800813af2ef6d7bf2a9785665d2e9764b4c8

Request headers

:path
/files/prof2.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:24 GMT
server
Apache
accept-ranges
bytes
etag
"b11-5cb00b2d0fea3"
content-length
2833
content-type
image/jpeg
prof3.jpg
www9.newcomercode.net/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/prof3.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
df99f7229bbfb0bdf5ed771fca5acc2fcbe96e41429bc2b2451f238c42d3f948

Request headers

:path
/files/prof3.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:24 GMT
server
Apache
accept-ranges
bytes
etag
"7b9-5cb00b2d1e902"
content-length
1977
content-type
image/jpeg
prof4.jpg
www9.newcomercode.net/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/prof4.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
f5653349d4d9eade79c3484fc521672332ffba22afbf1022e80ecb56973814c4

Request headers

:path
/files/prof4.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:24 GMT
server
Apache
accept-ranges
bytes
etag
"8a0-5cb00b2d37f3f"
content-length
2208
content-type
image/jpeg
prof5.jpg
www9.newcomercode.net/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/prof5.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
5e4a39e9f9298e25b326bd92f08b9cca6b15f0d617677c8ef2a6a3c037a8a0a1

Request headers

:path
/files/prof5.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:24 GMT
server
Apache
accept-ranges
bytes
etag
"63d-5cb00b2d4699e"
content-length
1597
content-type
image/jpeg
184dc9ab-6565-4fbf-a6a5-27cb70a870e3.jpg
www9.newcomercode.net/files/ 		62 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www9.newcomercode.net/files/184dc9ab-6565-4fbf-a6a5-27cb70a870e3.jpg
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
85.13.157.212 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS
dd40608.kasserver.com
Software
Apache /
Resource Hash
70d81524ff46cf40ab5b8dafa8597489819bed792aeffde58837e55b99013464

Request headers

:path
/files/184dc9ab-6565-4fbf-a6a5-27cb70a870e3.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www9.newcomercode.net
referer
https://www9.newcomercode.net/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
last-modified
Thu, 02 Sep 2021 10:32:23 GMT
server
Apache
accept-ranges
bytes
etag
"f69b-5cb00b2c31438"
content-length
63131
content-type
image/jpeg
font-awesome.min.css
netdna.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www9.newcomercode.net
URL: https://www9.newcomercode.net/files/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www9.newcomercode.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 07:20:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
723, 617, 617
age
14723275
cdn-cachedat
2021-03-11 11:57:51
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
9298a31cd0a3cc5e6ffaa407ce3c7d54
cf-ray
68bea7633c904e4f-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| dayNames object| monthNames object| now

3 Cookies

Domain/Path Name / Value
.capiital1.com/ Name: sid
Value: 6564927a-113e-11ec-8064-3cfcc4420837
.mybetterdl.com/ Name: rhid
Value: 79585138890
.mybetterdl.com/ Name: loi
Value: ad_1120153_off_565021_aff_90058_cid_185689-CAPIITAL1.COM_ts_1631172024