urlscan.io logo urlscan.io
SecurityTrails logo

hoesteronline.dk Open in urlscan Pro
213.184.85.10  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Submission Tags: falconsandbox
Submission: On February 23 via api from US — Scanned from DK
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 213.184.85.10, located in Netherlands and belongs to WORLDSTREAM, NL. The main domain is hoesteronline.dk.
TLS certificate: Issued by R3 on February 15th 2023. Valid for: 3 months.
This is the only time hoesteronline.dk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 10 213.184.85.10 49981 (WORLDSTREAM)
7 2
Apex Domain
Subdomains		 Transfer
10 hoesteronline.dk
hoesteronline.dk
www.hoesteronline.dk
207 KB
7 1
Domain Requested by
7 hoesteronline.dk 3 redirects hoesteronline.dk
3 www.hoesteronline.dk hoesteronline.dk
7 2

This site contains no links.

Subject Issuer Validity Valid
*.hoesteronline.dk
R3		 2023-02-15 -
2023-05-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Frame ID: A78C965BE45C0BDCDF9C658D5F0C63E7
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Client Portal Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

57 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

206 kB
Transfer

594 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://hoesteronline.dk/zm/1/wiz_files/logger-1.js HTTP 301
  • https://www.hoesteronline.dk/zm/1/wiz_files/logger-1.js
Request Chain 4
  • https://hoesteronline.dk/zm/1/wiz_files/2.js HTTP 301
  • https://www.hoesteronline.dk/zm/1/wiz_files/2.js
Request Chain 5
  • https://hoesteronline.dk/zm/1/wiz_files/main.js HTTP 301
  • https://www.hoesteronline.dk/zm/1/wiz_files/main.js

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request prod.php
hoesteronline.dk/zm/1/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
LiteSpeed /
Resource Hash
14b270d308460ac21c4de9bdb620b2fbf930e8639d00f42500644d54f179bede

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
da-DK,da;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
1666
content-type
text/html; charset=UTF-8
date
Thu, 23 Feb 2023 21:56:12 GMT
server
LiteSpeed
vary
Accept-Encoding
2.css
hoesteronline.dk/zm/1/wiz_files/ 		157 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hoesteronline.dk/zm/1/wiz_files/2.css
Requested by
Host: hoesteronline.dk
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
LiteSpeed /
Resource Hash
0bebdda0ca447eb1a4a995ebbcc25b753ecc40d3c8ecf0628beab00d98e0bf9d

Request headers

accept-language
da-DK,da;q=0.9
Referer
https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 21:56:12 GMT
content-encoding
br
last-modified
Wed, 01 Feb 2023 07:35:07 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
21624
expires
Thu, 02 Mar 2023 21:56:12 GMT
main.css
hoesteronline.dk/zm/1/wiz_files/ 		247 KB
182 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hoesteronline.dk/zm/1/wiz_files/main.css
Requested by
Host: hoesteronline.dk
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
LiteSpeed /
Resource Hash
fef07e8b576d7181dce8ac608f81a75f616b5f984b72ed7395b97848789d4ac8

Request headers

accept-language
da-DK,da;q=0.9
Referer
https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 21:56:12 GMT
content-encoding
br
last-modified
Wed, 01 Feb 2023 07:35:07 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
186049
expires
Thu, 02 Mar 2023 21:56:12 GMT
logger-1.js
www.hoesteronline.dk/zm/1/wiz_files/
Redirect Chain
  • https://hoesteronline.dk/zm/1/wiz_files/logger-1.js
  • https://www.hoesteronline.dk/zm/1/wiz_files/logger-1.js
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hoesteronline.dk/zm/1/wiz_files/logger-1.js
Requested by
Host: hoesteronline.dk
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
/
Resource Hash

Request headers

accept-language
da-DK,da;q=0.9
Referer
https://hoesteronline.dk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Redirect headers

date
Thu, 23 Feb 2023 21:56:13 GMT
server
LiteSpeed
x-redirect-by
WordPress
content-type
text/html; charset=UTF-8
location
https://www.hoesteronline.dk/zm/1/wiz_files/logger-1.js
cache-control
no-cache, must-revalidate, max-age=0
content-length
0
expires
Wed, 11 Jan 1984 05:00:00 GMT
loki.svg
hoesteronline.dk/zm/1/wiz_files/ 		4 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hoesteronline.dk/zm/1/wiz_files/loki.svg
Requested by
Host: hoesteronline.dk
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
LiteSpeed /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
da-DK,da;q=0.9
Referer
https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Thu, 23 Feb 2023 21:56:12 GMT
content-encoding
br
last-modified
Wed, 01 Feb 2023 07:35:07 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1369
expires
Thu, 02 Mar 2023 21:56:12 GMT
2.js
www.hoesteronline.dk/zm/1/wiz_files/
Redirect Chain
  • https://hoesteronline.dk/zm/1/wiz_files/2.js
  • https://www.hoesteronline.dk/zm/1/wiz_files/2.js
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hoesteronline.dk/zm/1/wiz_files/2.js
Requested by
Host: hoesteronline.dk
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
/
Resource Hash

Request headers

accept-language
da-DK,da;q=0.9
Referer
https://hoesteronline.dk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Redirect headers

date
Thu, 23 Feb 2023 21:56:13 GMT
server
LiteSpeed
x-redirect-by
WordPress
content-type
text/html; charset=UTF-8
location
https://www.hoesteronline.dk/zm/1/wiz_files/2.js
cache-control
no-cache, must-revalidate, max-age=0
content-length
0
expires
Wed, 11 Jan 1984 05:00:00 GMT
main.js
www.hoesteronline.dk/zm/1/wiz_files/
Redirect Chain
  • https://hoesteronline.dk/zm/1/wiz_files/main.js
  • https://www.hoesteronline.dk/zm/1/wiz_files/main.js
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.hoesteronline.dk/zm/1/wiz_files/main.js
Requested by
Host: hoesteronline.dk
URL: https://hoesteronline.dk/zm/1/prod.php?cm9ib2NvcA=mod
Protocol
H2
Server
213.184.85.10 , Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS
nlcp01.hosting4real.net
Software
/
Resource Hash

Request headers

accept-language
da-DK,da;q=0.9
Referer
https://hoesteronline.dk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Redirect headers

date
Thu, 23 Feb 2023 21:56:13 GMT
server
LiteSpeed
x-redirect-by
WordPress
content-type
text/html; charset=UTF-8
location
https://www.hoesteronline.dk/zm/1/wiz_files/main.js
cache-control
no-cache, must-revalidate, max-age=0
content-length
0
expires
Wed, 11 Jan 1984 05:00:00 GMT
truncated
/ 		183 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
724ef167b4989fc25f7abaf0de662208eb55159eb7bb33d67c3121fe23dee830

Request headers

accept-language
da-DK,da;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackJsonpweb.client-portal

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://www.hoesteronline.dk/zm/1/wiz_files/main.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.hoesteronline.dk/zm/1/wiz_files/logger-1.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.hoesteronline.dk/zm/1/wiz_files/2.js
Message:
Failed to load resource: the server responded with a status of 404 ()