ip-160-153-249-63.ip.secureserver.net Open in urlscan Pro
160.153.249.63 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/
Effective URL:
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php
Submission Tags: 7665503
Submission: On August 19 via api (August 19th 2022, 5:01:17 am UTC) from NL — Scanned from NL

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 160.153.249.63, located in Amsterdam, Netherlands and belongs to GODADDY, DE. The main domain is ip-160-153-249-63.ip.secureserver.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 2nd 2022. Valid for: 3 months.

This is the only time ip-160-153-249-63.ip.secureserver.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
3 16	160.153.249.63 160.153.249.63		20773 (GODADDY) (GODADDY)
13	1

16 160.153.249.63 (Amsterdam, Netherlands) 3 redirects

ASN20773 (GODADDY, DE)
PTR: ip-160-153-249-63.ip.secureserver.net

ip-160-153-249-63.ip.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	secureserver.net 3 redirects ip-160-153-249-63.ip.secureserver.net	638 KB
13	1

	Domain	Requested by
16	ip-160-153-249-63.ip.secureserver.net	3 redirects ip-160-153-249-63.ip.secureserver.net
13	1

This site contains no links.

Subject Issuer	Validity	Valid
ip-160-153-249-63.ip.secureserver.net cPanel, Inc. Certification Authority	`2022-08-02` - `2022-10-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php
Frame ID: D16913C411CDFD41C1B07F82EECE1312
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Schweizer Post

Page URL History Show full URLs

https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/ HTTP 302
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976 HTTP 301
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/ HTTP 302
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

637 kB
Transfer

1661 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/ HTTP 302
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976 HTTP 301
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/ HTTP 302
https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request cc.php Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/ Redirect Chain https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/ https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976 https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/ https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php	5 KB 2 KB	76ms 76ms	Document text/html	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `591c42db4310fef210dcfb958d4d0d7d23684f536e9b3b8e02a37e424260d1db` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 1128 Content-Type text/html; charset=UTF-8 Date Fri, 19 Aug 2022 05:01:12 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=97 Pragma no-cache Server Apache Vary Accept-Encoding,User-Agent Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Fri, 19 Aug 2022 05:01:11 GMT Keep-Alive timeout=5, max=98 Location z0n51/cc.php Server Apache Vary User-Agent
GET H/1.1	200 OK	bootstrap.min.css ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/	152 KB 23 KB	20ms 19ms	Stylesheet text/css	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/bootstrap.min.css Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 23238
GET H/1.1	200 OK	helpers.css ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/	41 KB 5 KB	48ms 17ms	Stylesheet text/css	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/helpers.css Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 4669
GET H/1.1	200 OK	fonts.css ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/	4 KB 731 B	49ms 17ms	Stylesheet text/css	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/fonts.css Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `213e1c07e15eea7f20b56e8dab08ce45429188b20c55cd91d45c84cdda5c0635` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 432
GET H/1.1	200 OK	main.css ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/	6 KB 2 KB	48ms 14ms	Stylesheet text/css	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/css/main.css Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `71bfb5ed11bf84da5e21d7997d31ded591a6eb0f43a2478074e63b37c094d7be` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 1580
GET H/1.1	200 OK	img2.jpg ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/images/	151 KB 152 KB	14ms 14ms	Image image/jpeg	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Show image Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/images/img2.jpg Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `c0fd87cbe1718e7a2140b62a61aab06780d561b17113e32d8d4e9bf434da3d30` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 155122
GET H/1.1	200 OK	logo.png ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/images/	7 KB 7 KB	14ms 14ms	Image image/png	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Show image Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/images/logo.png Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `6c29076d08b81084605997ae36ffe8df41fcef907b33c77e9b7626efd3724910` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 7393
GET H/1.1	200 OK	jquery.min.js Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/	86 KB 30 KB	36ms 20ms	Script application/javascript	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/jquery.min.js Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30679
GET H/1.1	200 OK	popper.min.js Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/	20 KB 7 KB	47ms 16ms	Script application/javascript	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/popper.min.js Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7243
GET H/1.1	200 OK	bootstrap.min.js Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/	133 KB 25 KB	35ms 19ms	Script application/javascript	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/bootstrap.min.js Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=94 Content-Length 25283
GET H/1.1	200 OK	fontawesome.min.js Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/	1 MB 379 KB	46ms 45ms	Script application/javascript	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/fontawesome.min.js Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	jquery.payment.js Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/	18 KB 4 KB	15ms 15ms	Script application/javascript	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/jquery.payment.js Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `d7399d77beb8b8da046b06a4e106e28ac095ec09882a6cf6e04d52735396a1b6` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3730
GET H/1.1	200 OK	main.js Show response ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/	2 KB 990 B	14ms 13ms	Script application/javascript	160.153.249.63 GODADDY
General Check archive.org Show headers Download Go to Full URL https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/assets/js/main.js Requested by Host: ip-160-153-249-63.ip.secureserver.net URL: https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 160.153.249.63 Amsterdam, Netherlands, ASN20773 (GODADDY, DE), Reverse DNS ip-160-153-249-63.ip.secureserver.net Software Apache / Resource Hash `8de47e339b24ca8b2e847918578e2051b2e6b94f0c9956b056a48481ace3cafe` Request headers accept-language nl-NL,nl;q=0.9 Referer https://ip-160-153-249-63.ip.secureserver.net/~bedandbreakfast/9406f10976/z0n51/cc.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36 Response headers Date Fri, 19 Aug 2022 05:01:12 GMT Content-Encoding gzip Last-Modified Fri, 19 Aug 2022 05:01:11 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 677

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ip-160-153-249-63.ip.secureserver.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 36fc0daf54c3b316fac9becc9adbd482

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ip-160-153-249-63.ip.secureserver.net
160.153.249.63
213e1c07e15eea7f20b56e8dab08ce45429188b20c55cd91d45c84cdda5c0635
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
591c42db4310fef210dcfb958d4d0d7d23684f536e9b3b8e02a37e424260d1db
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6c29076d08b81084605997ae36ffe8df41fcef907b33c77e9b7626efd3724910
71bfb5ed11bf84da5e21d7997d31ded591a6eb0f43a2478074e63b37c094d7be
8de47e339b24ca8b2e847918578e2051b2e6b94f0c9956b056a48481ace3cafe
c0fd87cbe1718e7a2140b62a61aab06780d561b17113e32d8d4e9bf434da3d30
d7399d77beb8b8da046b06a4e106e28ac095ec09882a6cf6e04d52735396a1b6
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765

ip-160-153-249-63.ip.secureserver.net Open in urlscan Pro 160.153.249.63 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

637 kBTransfer

1661 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

1 Cookies

Indicators

ip-160-153-249-63.ip.secureserver.net Open in urlscan Pro
160.153.249.63 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

637 kB
Transfer

1661 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!