my-migros.ddnss.eu Open in urlscan Pro
5.8.47.218  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response my-migros.ddnss.eu/	145 KB 62 KB	96ms 37ms	Document text/html	5.8.47.218 LLHOST-INC-SRL
General Check archive.org Show headers Download Go to Full URL https://my-migros.ddnss.eu/?utm_source=89456178945612789465132897465132&utm_medium=789865895623&utm_campaign=987465132485623 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.8.47.218 Meppel, Netherlands, ASN35277 (LLHOST-INC-SRL, RO), Reverse DNS vps.30150765.llhost-inc.eu Software nginx / Resource Hash b03d8880bb40b180f50d893c4e87fe6e8ca87e38fbf83788b09bf80664496c45 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 10 Sep 2024 06:55:24 GMT server nginx strict-transport-security max-age=31536000 vary Accept-Encoding
GET H2	200	styles.css my-migros.ddnss.eu/css/	10 KB 3 KB	20ms 19ms	Stylesheet text/css	5.8.47.218 LLHOST-INC-SRL
General Check archive.org Show headers Download Go to Full URL https://my-migros.ddnss.eu/css/styles.css Requested by Host: my-migros.ddnss.eu URL: https://my-migros.ddnss.eu/?utm_source=89456178945612789465132897465132&utm_medium=789865895623&utm_campaign=987465132485623 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.8.47.218 Meppel, Netherlands, ASN35277 (LLHOST-INC-SRL, RO), Reverse DNS vps.30150765.llhost-inc.eu Software nginx / Resource Hash 611b31533ed0b18fb8db946be707db68563175edfaf3263721473d5d3105dd81 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://my-migros.ddnss.eu/?utm_source=89456178945612789465132897465132&utm_medium=789865895623&utm_campaign=987465132485623 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 06:55:24 GMT strict-transport-security max-age=31536000 content-encoding gzip last-modified Fri, 30 Aug 2024 11:46:20 GMT server nginx etag W/"66d1b10c-29aa" vary Accept-Encoding content-type text/css cache-control max-age=43200 expires Tue, 10 Sep 2024 18:55:24 GMT
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 31 KB	69ms 17ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: my-migros.ddnss.eu URL: https://my-migros.ddnss.eu/?utm_source=89456178945612789465132897465132&utm_medium=789865895623&utm_campaign=987465132485623 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://my-migros.ddnss.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 06:55:24 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 2143430 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 30875 x-served-by cache-lga21931-LGA, cache-ams2100093-AMS last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1725951324.479709,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 222194, 310706
GET H2	200	ua-parser.min.js Show response cdn.jsdelivr.net/npm/ua-parser-js@0.7.31/dist/	19 KB 8 KB	62ms 17ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/ua-parser-js@0.7.31/dist/ua-parser.min.js Requested by Host: my-migros.ddnss.eu URL: https://my-migros.ddnss.eu/?utm_source=89456178945612789465132897465132&utm_medium=789865895623&utm_campaign=987465132485623 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d2880c3ec9ed4180826d6be7f1cded7559a0718c5d3cbd2f5eee3076e3a8699e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-migros.ddnss.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 10 Sep 2024 06:55:24 GMT x-content-type-options nosniff content-encoding br age 624174 x-jsd-version 0.7.31 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 8065 x-served-by cache-fra-etou8220158-FRA, cache-ams2100098-AMS x-jsd-version-type version etag W/"4cf5-2XA/fcodJaG2C0TaXKyKyTwphb8" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET DATA	200 OK	truncated /	5 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a6a627fb94f08fd4336a8cc7fd15785150ce7096aba55315367a762468ad7db8 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ecc047250aed883bd0038ba4cdf2b4b7f7105e28fae93712ad1a9090b014a9c9 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H2	404	favicon.ico my-migros.ddnss.eu/	57 KB 44 KB	22ms 22ms	Other text/html	5.8.47.218 LLHOST-INC-SRL
General Check archive.org Show headers Download Go to Full URL https://my-migros.ddnss.eu/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.8.47.218 Meppel, Netherlands, ASN35277 (LLHOST-INC-SRL, RO), Reverse DNS vps.30150765.llhost-inc.eu Software nginx / Resource Hash dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a Request headers Referer https://my-migros.ddnss.eu/?utm_source=89456178945612789465132897465132&utm_medium=789865895623&utm_campaign=987465132485623 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Tue, 10 Sep 2024 06:55:24 GMT content-encoding gzip server nginx etag W/"66dc3b00-e3b0" vary Accept-Encoding content-type text/html

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| UAParser function| _0x4466 function| _0x5d090b function| _0x4828d9 function| _0x50d4ac function| _0x3d3a function| _0x289d1a function| _0x31b693 function| _0x1aaae2 function| _0x2d2fe3

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://my-migros.ddnss.eu/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
my-migros.ddnss.eu
2a04:4e42:200::649
2a04:4e42:600::485
5.8.47.218
611b31533ed0b18fb8db946be707db68563175edfaf3263721473d5d3105dd81
a6a627fb94f08fd4336a8cc7fd15785150ce7096aba55315367a762468ad7db8
b03d8880bb40b180f50d893c4e87fe6e8ca87e38fbf83788b09bf80664496c45
d2880c3ec9ed4180826d6be7f1cded7559a0718c5d3cbd2f5eee3076e3a8699e
dc676cc52046a252ee86c463e49bce5b517c932ab100f21cb62e231cb3d7ed7a
ecc047250aed883bd0038ba4cdf2b4b7f7105e28fae93712ad1a9090b014a9c9
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e