urlscan.io logo urlscan.io
SecurityTrails logo

b12adsy.myraidbox.de Open in urlscan Pro
116.203.202.54  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.kwconnect.com/redirect?url=https%3A%2F%2Fipb.link%2Funtrerpen#DSF344#google.com
Effective URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Submission: On July 14 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 116.203.202.54, located in Germany and belongs to HETZNER-AS, DE. The main domain is b12adsy.myraidbox.de.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 13th 2023. Valid for: a year.
This is the only time b12adsy.myraidbox.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 34.148.73.213 396982 (GOOGLE-CL...)
1 1 3.0.167.208 16509 (AMAZON-02)
3 9 116.203.202.54 24940 (HETZNER-AS)
1 2a00:1450:400... 15169 (GOOGLE)
7 3
Apex Domain
Subdomains		 Transfer
9 myraidbox.de
b12adsy.myraidbox.de
262 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 433
31 KB
1 ipb.link
ipb.link
187 B
1 kwconnect.com
www.kwconnect.com
548 B
7 4
Domain Requested by
9 b12adsy.myraidbox.de 3 redirects b12adsy.myraidbox.de
1 ajax.googleapis.com b12adsy.myraidbox.de
1 ipb.link 1 redirects
1 www.kwconnect.com 1 redirects
7 4

This site contains no links.

Subject Issuer Validity Valid
*.myraidbox.de
Sectigo RSA Domain Validation Secure Server CA		 2023-04-13 -
2024-05-13		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-06-19 -
2023-09-11		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://b12adsy.myraidbox.de/pop/main/cgi/
Frame ID: BC172506BD1E78C6C1B6B0C2D133661A
Requests: 6 HTTP requests in this frame

Frame: https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings/
Frame ID: 74348A96D2ACA2C88E7A4D4602BACBBC
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: 9B90D4CBF0E5BE944E104EC642E5B576
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.kwconnect.com/redirect?url=https%3A%2F%2Fipb.link%2Funtrerpen HTTP 302
    https://ipb.link/untrerpen HTTP 302
    https://b12adsy.myraidbox.de/utrecht/href/ HTTP 301
    https://b12adsy.myraidbox.de/pop/main/cgi/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

507 kB
Transfer

688 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.kwconnect.com/redirect?url=https%3A%2F%2Fipb.link%2Funtrerpen HTTP 302
    https://ipb.link/untrerpen HTTP 302
    https://b12adsy.myraidbox.de/utrecht/href/ HTTP 301
    https://b12adsy.myraidbox.de/pop/main/cgi/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://b12adsy.myraidbox.de/ZAB/Spotify/ HTTP 302
  • https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings HTTP 301
  • https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings/

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
b12adsy.myraidbox.de/pop/main/cgi/
Redirect Chain
  • https://www.kwconnect.com/redirect?url=https%3A%2F%2Fipb.link%2Funtrerpen
  • https://ipb.link/untrerpen
  • https://b12adsy.myraidbox.de/utrecht/href/
  • https://b12adsy.myraidbox.de/pop/main/cgi/
1 KB
675 B 		Document
General
Check archive.org
Download Go to
Full URL
https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.202.54 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
b12adsy.myraidbox.de
Software
nginx /
Resource Hash
6f7c3adcac5d90d5fec69abbff5f94e320267d73f4d26e4ba6f979f4cf7017ed
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html
date
Fri, 14 Jul 2023 15:57:35 GMT
etag
W/"64b097fd-414"
last-modified
Fri, 14 Jul 2023 00:34:05 GMT
server
nginx
strict-transport-security
max-age=63072000
vary
Accept-Encoding
x-cache-device-type
responsive
x-cache-type
NGINX
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

content-type
text/html; charset=UTF-8
date
Fri, 14 Jul 2023 15:57:35 GMT
location
https://b12adsy.myraidbox.de/pop/main/cgi/
server
nginx
strict-transport-security
max-age=63072000
x-cache
HIT
x-cache-device-type
responsive
x-cache-type
NGINX
x-content-type-options
nosniff
x-xss-protection
1; mode=block
style.css
b12adsy.myraidbox.de/pop/main/cgi/ 		2 KB
945 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://b12adsy.myraidbox.de/pop/main/cgi/style.css
Requested by
Host: b12adsy.myraidbox.de
URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.202.54 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
b12adsy.myraidbox.de
Software
nginx /
Resource Hash
215eb83115d728748bef2db4217a8c7e12bbedb2825e146b678e85cc2ef88639
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://b12adsy.myraidbox.de/pop/main/cgi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
public
date
Fri, 14 Jul 2023 15:57:35 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Fri, 14 Jul 2023 00:33:11 GMT
server
nginx
content-encoding
br
etag
W/"64b097c7-6e0"
x-cache-type
STATIC
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
x-cache-device-type
responsive
x-xss-protection
1; mode=block
expires
Sat, 13 Jul 2024 15:57:35 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Requested by
Host: b12adsy.myraidbox.de
URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://b12adsy.myraidbox.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Fri, 14 Jul 2023 07:58:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
28721
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Jul 2024 07:58:54 GMT
logo.svg
b12adsy.myraidbox.de/pop/main/cgi/ 		378 B
508 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b12adsy.myraidbox.de/pop/main/cgi/logo.svg
Requested by
Host: b12adsy.myraidbox.de
URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.202.54 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
b12adsy.myraidbox.de
Software
nginx /
Resource Hash
ae9cd11b7615ded2ce4aa11d21b034b5f9707aa6cb27d46596947903ccb92247
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://b12adsy.myraidbox.de/pop/main/cgi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
public
date
Fri, 14 Jul 2023 15:57:35 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Fri, 14 Jul 2023 00:33:11 GMT
server
nginx
content-encoding
br
etag
W/"64b097c7-17a"
x-cache-type
STATIC
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=31536000, public
x-cache-device-type
responsive
x-xss-protection
1; mode=block
expires
Sat, 13 Jul 2024 15:57:35 GMT
ssl.svg
b12adsy.myraidbox.de/pop/main/cgi/ 		603 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b12adsy.myraidbox.de/pop/main/cgi/ssl.svg
Requested by
Host: b12adsy.myraidbox.de
URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.202.54 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
b12adsy.myraidbox.de
Software
nginx /
Resource Hash
3b439667b653b07d8eec20a02b2c7cb25e4eb2a91acdbdb61f28f9163237067d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://b12adsy.myraidbox.de/pop/main/cgi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
public
date
Fri, 14 Jul 2023 15:57:35 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Fri, 14 Jul 2023 00:33:11 GMT
server
nginx
content-encoding
br
etag
W/"64b097c7-25b"
x-cache-type
STATIC
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=31536000, public
x-cache-device-type
responsive
x-xss-protection
1; mode=block
expires
Sat, 13 Jul 2024 15:57:35 GMT
script.js
b12adsy.myraidbox.de/pop/main/cgi/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b12adsy.myraidbox.de/pop/main/cgi/script.js
Requested by
Host: b12adsy.myraidbox.de
URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.202.54 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
b12adsy.myraidbox.de
Software
nginx /
Resource Hash
d7676356c36848f656df2698a8a09b139bc50a7fafdc72202c854c1e440e22ea
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://b12adsy.myraidbox.de/pop/main/cgi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
public
date
Fri, 14 Jul 2023 15:57:35 GMT
strict-transport-security
max-age=63072000
x-content-type-options
nosniff
last-modified
Fri, 14 Jul 2023 00:33:11 GMT
server
nginx
content-encoding
br
etag
W/"64b097c7-ac4"
x-cache-type
STATIC
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000, public
x-cache-device-type
responsive
x-xss-protection
1; mode=block
expires
Sat, 13 Jul 2024 15:57:35 GMT
/
b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings/ Frame 7434
Redirect Chain
  • https://b12adsy.myraidbox.de/ZAB/Spotify/
  • https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings
  • https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings/
373 KB
258 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings/
Requested by
Host: b12adsy.myraidbox.de
URL: https://b12adsy.myraidbox.de/pop/main/cgi/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
116.203.202.54 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
b12adsy.myraidbox.de
Software
nginx /
Resource Hash
4affce2cbaf847a5ca93588c90b23e482118bb1314d0fdf11bb67f9ee7592cc7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://b12adsy.myraidbox.de/pop/main/cgi/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 14 Jul 2023 15:57:36 GMT
server
nginx
strict-transport-security
max-age=63072000
vary
Accept-Encoding
x-cache
HIT
x-cache-device-type
responsive
x-cache-type
NGINX
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

content-length
162
content-type
text/html
date
Fri, 14 Jul 2023 15:57:36 GMT
location
https://b12adsy.myraidbox.de/ZAB/Spotify/Issued/settings/
server
nginx
strict-transport-security
max-age=63072000
vary
Accept-Encoding
x-cache-device-type
responsive
x-cache-type
NGINX
x-content-type-options
nosniff
x-xss-protection
1; mode=block
truncated
/ Frame 7434 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame 7434 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

Referer
Origin
https://b12adsy.myraidbox.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ Frame 7434 		353 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
372cd0fe98167ffc57b624aed00ab6f53e89bd8cf5690867c1a786983ceec95b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame 7434 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2

Request headers

Referer
Origin
https://b12adsy.myraidbox.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ Frame 7434 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

Referer
Origin
https://b12adsy.myraidbox.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ Frame 9B90 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| minimize object| square object| exit object| titleBar object| draggable object| title function| enlarge

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block