urlscan.io logo urlscan.io
SecurityTrails logo

confident-hawking.149-57-210-143.plesk.page Open in urlscan Pro
149.57.210.143  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://carr-ser-ob.cmail19.com/t/y-l-bhjpty-iuokidyky-r/
Effective URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Submission: On June 01 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 149.57.210.143, located in Hanover, United States and belongs to DEDIPATH-LLC, US. The main domain is confident-hawking.149-57-210-143.plesk.page.
TLS certificate: Issued by R3 on May 24th 2022. Valid for: 3 months.
This is the only time confident-hawking.149-57-210-143.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 18.196.132.139 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
9 149.57.210.143 35913 (DEDIPATH-LLC)
2 2a00:1450:400... 15169 (GOOGLE)
13 4
Apex Domain
Subdomains		 Transfer
9 plesk.page
confident-hawking.149-57-210-143.plesk.page
266 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 277
60 KB
1 blogspot.com
apps-secure2022.blogspot.com
gribacr.blogspot.com Failed
16 KB
1 cmail19.com
carr-ser-ob.cmail19.com
484 B
13 4
Domain Requested by
9 confident-hawking.149-57-210-143.plesk.page apps-secure2022.blogspot.com
confident-hawking.149-57-210-143.plesk.page
2 ajax.googleapis.com confident-hawking.149-57-210-143.plesk.page
1 apps-secure2022.blogspot.com
1 carr-ser-ob.cmail19.com 1 redirects
0 gribacr.blogspot.com Failed apps-secure2022.blogspot.com
13 5

This site contains no links.

Subject Issuer Validity Valid
misc-sni.blogspot.com
GTS CA 1C3		 2022-05-09 -
2022-08-01		 3 months crt.sh
confident-hawking.149-57-210-143.plesk.page
R3		 2022-05-24 -
2022-08-22		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Frame ID: 7F2319C8201A625B0A76CD2705A9C90D
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Authentification - Orange Bank

Page URL History Show full URLs

  1. https://carr-ser-ob.cmail19.com/t/y-l-bhjpty-iuokidyky-r/ HTTP 302
    https://apps-secure2022.blogspot.com/ Page URL
  2. https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

92 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

342 kB
Transfer

601 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://carr-ser-ob.cmail19.com/t/y-l-bhjpty-iuokidyky-r/ HTTP 302
    https://apps-secure2022.blogspot.com/ Page URL
  2. https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://carr-ser-ob.cmail19.com/t/y-l-bhjpty-iuokidyky-r/ HTTP 302
  • https://apps-secure2022.blogspot.com/

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
apps-secure2022.blogspot.com/
Redirect Chain
  • https://carr-ser-ob.cmail19.com/t/y-l-bhjpty-iuokidyky-r/
  • https://apps-secure2022.blogspot.com/
71 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://apps-secure2022.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
15510
content-type
text/html; charset=UTF-8
date
Wed, 01 Jun 2022 17:11:49 GMT
etag
W/"1ebae48198bef277f78a24534bfca8c0c095c5f5257ce813f7a23bf3f7a07a22"
expires
Wed, 01 Jun 2022 17:11:49 GMT
last-modified
Mon, 30 May 2022 01:07:05 GMT
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
154
Content-Type
text/html; charset=utf-8
Date
Wed, 01 Jun 2022 17:11:49 GMT
Location
https://apps-secure2022.blogspot.com/
P3P
CP="OTI DSP COR CUR IVD CONi OTPi OUR IND UNI STA PRE"
Referrer-Policy
no-referrer-when-downgrade
Server
_waflopenresty/1.11.2.2
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Robots-Tag
noindex, nofollow
X-XSS-Protection
1; mode=block
&
gribacr.blogspot.com/ 		0
0
Primary Request Authentication
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Requested by
Host: apps-secure2022.blogspot.com
URL: https://apps-secure2022.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PHP/7.4.29 PleskLin
Resource Hash
b616277acbf3ac97af2e3b83f97efbaabea609bdb3b80ef7b357edc571c3f2fb
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://apps-secure2022.blogspot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
2163
content-type
text/html; charset=UTF-8
date
Wed, 01 Jun 2022 17:11:49 GMT
server
nginx
strict-transport-security
max-age=15768000; includeSubDomains
vary
Accept-Encoding
x-powered-by
PHP/7.4.29 PleskLin
fontawesome.min.css
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/css/ 		57 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/css/fontawesome.min.css
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
1a0f0322dfe91f9af8ddcfb7e3253822bab9b946d28051078877bdb2a0e0378a
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
content-encoding
br
last-modified
Sat, 09 Oct 2021 22:55:20 GMT
server
nginx
x-powered-by
PleskLin
etag
W/"61621dd8-e238"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
text/css
all.min.css
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/css/ 		58 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/css/all.min.css
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
d1fb8d8337cd22568295b0ed998c85c58f0b4cd083af0b0db21cb0af80002f2d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
content-encoding
br
last-modified
Sat, 09 Oct 2021 22:55:20 GMT
server
nginx
x-powered-by
PleskLin
etag
W/"61621dd8-e7d0"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
text/css
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 10:38:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
542019
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29671
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 May 2023 10:38:11 GMT
style.css
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/ 		4 KB
819 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/style.css
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
cb88b79791c96e6d9254846d54058c31af474a4ae24014452ac1852db7d3ae25
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
content-encoding
br
last-modified
Sun, 10 Oct 2021 16:28:20 GMT
server
nginx
x-powered-by
PleskLin
etag
W/"616314a4-e2b"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
text/css
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ 		86 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 30 May 2022 09:24:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
200822
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30774
x-xss-protection
0
last-modified
Mon, 13 May 2019 14:37:17 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 30 May 2023 09:24:48 GMT
function.js
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/ 		262 B
413 B 		Script
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/function.js
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
6533b94552f33ed7cad1845e4af062ce194d44e9086ee147577a61d335b83b55
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
content-encoding
gzip
etag
"106-5cdf363e12600-gzip"
last-modified
Sat, 09 Oct 2021 22:55:20 GMT
server
nginx
x-powered-by
PleskLin
vary
Accept-Encoding
content-type
application/javascript
x-accel-version
0.01
strict-transport-security
max-age=15768000; includeSubDomains
accept-ranges
bytes
content-length
151
oblogo.png
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/oblogo.png
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
a1dc90b5ad5eb491a9f80280cdb2dbab4305a2cfd244df8fe014d70a5bb46cdb
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
last-modified
Sat, 09 Oct 2021 22:55:20 GMT
server
nginx
x-powered-by
PleskLin
etag
"61621dd8-8a4"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
2212
8chi.png
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/8chi.png
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
1aea0576dc59fde2a1e9bcab7b554c9ca6d57e0e4b600392cd8962d1440c9f85
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/Authentication
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
last-modified
Sun, 10 Oct 2021 08:57:06 GMT
server
nginx
x-powered-by
PleskLin
etag
"6162aae2-8b9"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
image/png
accept-ranges
bytes
content-length
2233
Roboto-Regular.ttf
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/ 		155 KB
155 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/Roboto-Regular.ttf
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
16466ef65064e6f3885a6d2806b8949ac1ac38b524dd0cf8fc96565eb4cc28e8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/files/style.css
Origin
https://confident-hawking.149-57-210-143.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
last-modified
Sat, 09 Oct 2021 22:55:20 GMT
server
nginx
x-powered-by
PleskLin
etag
"61621dd8-26b8c"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
application/font-sfnt
accept-ranges
bytes
content-length
158604
fa-solid-900.woff2
confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/webfonts/ 		78 KB
79 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/webfonts/fa-solid-900.woff2
Requested by
Host: confident-hawking.149-57-210-143.plesk.page
URL: https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
149.57.210.143 Hanover, United States, ASN35913 (DEDIPATH-LLC, US),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
6c916669cf923b4f1b2db5c5107c83b6ca205e7ad0dcd840b251e63f0c8d28a2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://confident-hawking.149-57-210-143.plesk.page/Appareil%20de%20confiance/protection/triangle/css/all.min.css
Origin
https://confident-hawking.149-57-210-143.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 17:11:50 GMT
last-modified
Sat, 09 Oct 2021 22:55:22 GMT
server
nginx
x-powered-by
PleskLin
etag
"61621dda-1397c"
strict-transport-security
max-age=15768000; includeSubDomains
content-type
font/woff2
accept-ranges
bytes
content-length
80252

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
gribacr.blogspot.com
URL
https://gribacr.blogspot.com/&

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery function| isNumber

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block