251202250.website Open in urlscan Pro
68.65.122.50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.jgbhf-bank.comnt.y5restaurant.com/aHR0cDovL2hhbnMtcmFpbmVyLmJ1cmdhcmQuY29udGV4dG9lbmVyZ2V0aWNvLmNvbS8/MDg5ODk5OTg4NTI3MDA5JmhmbD1o...
Effective URL:
https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2...
Submission: On June 09 via manual (June 9th 2020, 11:30:12 am UTC) from FR

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 68.65.122.50, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is 251202250.website.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 14th 2019. Valid for: a year.

This is the only time 251202250.website was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.213.253.13 162.213.253.13	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 1	198.54.114.143 198.54.114.143	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2 15	68.65.122.50 68.65.122.50	22612 (NAMECHEAP...) (NAMECHEAP-NET)
13	1

1 162.213.253.13 (Los Angeles, United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: business15-3.web-hosting.com

www.jgbhf-bank.comnt.y5restaurant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.54.114.143 (Los Angeles, United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server202-1.web-hosting.com

hans-rainer.burgard.contextoenergetico.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 68.65.122.50 (Los Angeles, United States) 2 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server165-2.web-hosting.com

251202250.website	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	251202250.website 2 redirects 251202250.website	315 KB
1	contextoenergetico.com 1 redirects hans-rainer.burgard.contextoenergetico.com	453 B
1	y5restaurant.com 1 redirects www.jgbhf-bank.comnt.y5restaurant.com	275 B
13	3

	Domain	Requested by
15	251202250.website	2 redirects 251202250.website
1	hans-rainer.burgard.contextoenergetico.com	1 redirects
1	www.jgbhf-bank.comnt.y5restaurant.com	1 redirects
13	3

This site contains no links.

Subject Issuer	Validity	Valid
251202250.website Sectigo RSA Domain Validation Secure Server CA	`2019-11-14` - `2020-11-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20=
Frame ID: 82689ADBCA8A2BFD3A256A0F5C6F234E
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.jgbhf-bank.comnt.y5restaurant.com/aHR0cDovL2hhbnMtcmFpbmVyLmJ1cmdhcmQuY29udGV4dG9lbmVyZ2V0aWNvLmNvbS8/MDg5ODk5... HTTP 302
http://hans-rainer.burgard.contextoenergetico.com/?089899988527009&hfl=hans-rainer.burgard@bhf-bank.com HTTP 302
https://251202250.website/.well-known/pki-validation/.sc?email=hans-rainer.burgard@bhf-bank.com HTTP 301
https://251202250.website/.well-known/pki-validation/.sc/?email=hans-rainer.burgard@bhf-bank.com HTTP 302
https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r... Page URL

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

1
IPs

1
Countries

314 kB
Transfer

404 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.jgbhf-bank.comnt.y5restaurant.com/aHR0cDovL2hhbnMtcmFpbmVyLmJ1cmdhcmQuY29udGV4dG9lbmVyZ2V0aWNvLmNvbS8/MDg5ODk5OTg4NTI3MDA5JmhmbD1oYW5zLXJhaW5lci5idXJnYXJkQGJoZi1iYW5rLmNvbQ== HTTP 302
http://hans-rainer.burgard.contextoenergetico.com/?089899988527009&hfl=hans-rainer.burgard@bhf-bank.com HTTP 302
https://251202250.website/.well-known/pki-validation/.sc?email=hans-rainer.burgard@bhf-bank.com HTTP 301
https://251202250.website/.well-known/pki-validation/.sc/?email=hans-rainer.burgard@bhf-bank.com HTTP 302
https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request go0fn3idt65z1uwq8mc2apsb.php Show response 251202250.website/.well-known/pki-validation/.sc/ Redirect Chain http://www.jgbhf-bank.comnt.y5restaurant.com/aHR0cDovL2hhbnMtcmFpbmVyLmJ1cmdhcmQuY29udGV4dG9lbmVyZ2V0aWNvLmNvbS8/MDg5ODk5OTg4NTI3MDA5JmhmbD1oYW5zLXJhaW5lci5idXJnYXJkQGJoZi1iYW5rLmNvbQ== http://hans-rainer.burgard.contextoenergetico.com/?089899988527009&hfl=hans-rainer.burgard@bhf-bank.com https://251202250.website/.well-known/pki-validation/.sc?email=hans-rainer.burgard@bhf-bank.com https://251202250.website/.well-known/pki-validation/.sc/?email=hans-rainer.burgard@bhf-bank.com https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&da...	16 KB 5 KB	651ms 651ms	Document text/html	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / PHP/7.2.31 Resource Hash `9efc0c0edb42643cf0273bf0d18d3d5108d60651befb5ebddd11a855fa65a258` Request headers :method GET :authority 251202250.website :scheme https :path /.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US cookie PHPSESSID=b4375e4fc987ef559e5610b5209aa8c4 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Tue, 09 Jun 2020 11:29:52 GMT server Apache x-powered-by PHP/7.2.31 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding content-encoding gzip referrer-policy no-referrer-when-downgrade content-length 4921 content-type text/html; charset=UTF-8 Redirect headers status 302 date Tue, 09 Jun 2020 11:29:51 GMT server Apache x-powered-by PHP/7.2.31 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie PHPSESSID=b4375e4fc987ef559e5610b5209aa8c4; path=/ location /.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= referrer-policy no-referrer-when-downgrade content-length 0 content-type text/html; charset=UTF-8
GET H2	200	conv.css 251202250.website/.well-known/pki-validation/.sc/css/	95 KB 17 KB	376ms 374ms	Stylesheet text/css	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://251202250.website/.well-known/pki-validation/.sc/css/conv.css Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `8d4af5ec8c33b5dc0cbc32ca17e405c2f596eb7864257e92280122a1278a1e57` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "17c87-58c4c68ba5b80-gzip" vary Accept-Encoding content-type text/css status 200 cache-control max-age=31536000 accept-ranges bytes content-length 17450 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	mcsft_logo.svg 251202250.website/.well-known/pki-validation/.sc/images/	4 KB 2 KB	199ms 197ms	Image image/svg+xml	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/mcsft_logo.svg Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade server Apache etag "e43-58c4c68ba5b80-gzip" vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=31536000 accept-ranges bytes content-length 1435 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	arrow_left.svg 251202250.website/.well-known/pki-validation/.sc/images/	513 B 533 B	198ms 196ms	Image image/svg+xml	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/arrow_left.svg Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade server Apache etag "201-58c4c68ba5b80-gzip" vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=31536000 accept-ranges bytes content-length 276 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	enterpass.png 251202250.website/.well-known/pki-validation/.sc/images/	1 KB 2 KB	200ms 198ms	Image image/png	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/enterpass.png Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `706de242e7c3cfc4b16ba8174723f26fb80566c3171e9e795f057476011a5de1` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "5a6-58c4c68ba5b80" content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 1446 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	firstmsg.png 251202250.website/.well-known/pki-validation/.sc/images/	3 KB 4 KB	204ms 202ms	Image image/png	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/firstmsg.png Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `7b6cf23ac2454b039ddf4f51b7074636ed5b08b6a1d254a47430c4ace2a3569d` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT referrer-policy no-referrer-when-downgrade last-modified Wed, 13 May 2020 17:20:03 GMT server Apache etag "d2c-5a58aca6156c0" content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 3372 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	forgetpass.png 251202250.website/.well-known/pki-validation/.sc/images/	713 B 947 B	200ms 199ms	Image image/png	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/forgetpass.png Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `e29db32031dc537aee9cb557b408395f3324f1e0f744349c0cdf943a3af39296` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "2c9-58c4c68ba5b80" content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 713 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	ellipsis_white.svg 251202250.website/.well-known/pki-validation/.sc/images/	915 B 520 B	200ms 199ms	Image image/svg+xml	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/ellipsis_white.svg Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade server Apache etag "393-58c4c68ba5b80-gzip" vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=31536000 accept-ranges bytes content-length 263 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	ellipsis_grey.svg 251202250.website/.well-known/pki-validation/.sc/images/	915 B 520 B	201ms 199ms	Image image/svg+xml	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/ellipsis_grey.svg Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:52 GMT content-encoding gzip referrer-policy no-referrer-when-downgrade server Apache etag "393-58c4c68ba5b80-gzip" vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=31536000 accept-ranges bytes content-length 263 expires Wed, 09 Jun 2021 11:29:52 GMT
GET H2	200	small-background.jpg 251202250.website/.well-known/pki-validation/.sc/images/	3 KB 3 KB	211ms 210ms	Image image/jpeg	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/small-background.jpg Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:53 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "bbe-58c4c68ba5b80" content-type image/jpeg status 200 cache-control max-age=31536000 accept-ranges bytes content-length 3006 expires Wed, 09 Jun 2021 11:29:53 GMT
GET H2	200	big-background.jpg 251202250.website/.well-known/pki-validation/.sc/images/	277 KB 277 KB	211ms 210ms	Image image/jpeg	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/big-background.jpg Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:53 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "452d7-58c4c68ba5b80" content-type image/jpeg status 200 cache-control max-age=31536000 accept-ranges bytes content-length 283351 expires Wed, 09 Jun 2021 11:29:53 GMT
GET H2	200	passwrd.png 251202250.website/.well-known/pki-validation/.sc/images/	902 B 1 KB	540ms 540ms	Image image/png	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/passwrd.png Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `105c03d3360cdb953585482374b2cc953d090741037502b0609629f5bb0135b7` Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:53 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "386-58c4c68ba5b80" content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 902 expires Wed, 09 Jun 2021 11:29:53 GMT
GET H2	200	sigin.png 251202250.website/.well-known/pki-validation/.sc/images/	736 B 970 B	540ms 540ms	Image image/png	68.65.122.50 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://251202250.website/.well-known/pki-validation/.sc/images/sigin.png Requested by Host: 251202250.website URL: https://251202250.website/.well-known/pki-validation/.sc/go0fn3idt65z1uwq8mc2apsb.php?b8avqhc0m3wnfz5r61gpiylk9ox4td7ujse2cqsjek7lo6xfyvr2gbwpiut0mn93dzh548a14m67okresg0hqzt5nvid3fj1pl829bxcuawy&data=aGFucy1yYWluZXIuYnVyZ2FyZEBiaGYtYmFuay5jb20= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.50 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server165-2.web-hosting.com Software Apache / Resource Hash `f32a760f15530284447282af5c7d0825babf8bc4739e073928f6128830819f7a` Request headers Referer https://251202250.website/.well-known/pki-validation/.sc/css/conv.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Jun 2020 11:29:53 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 27 Jun 2019 11:24:46 GMT server Apache etag "2e0-58c4c68ba5b80" content-type image/png status 200 cache-control max-age=31536000 accept-ranges bytes content-length 736 expires Wed, 09 Jun 2021 11:29:53 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

251202250.website
hans-rainer.burgard.contextoenergetico.com
www.jgbhf-bank.comnt.y5restaurant.com
162.213.253.13
198.54.114.143
68.65.122.50
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
105c03d3360cdb953585482374b2cc953d090741037502b0609629f5bb0135b7
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
706de242e7c3cfc4b16ba8174723f26fb80566c3171e9e795f057476011a5de1
7b6cf23ac2454b039ddf4f51b7074636ed5b08b6a1d254a47430c4ace2a3569d
8d4af5ec8c33b5dc0cbc32ca17e405c2f596eb7864257e92280122a1278a1e57
9efc0c0edb42643cf0273bf0d18d3d5108d60651befb5ebddd11a855fa65a258
e29db32031dc537aee9cb557b408395f3324f1e0f744349c0cdf943a3af39296
f32a760f15530284447282af5c7d0825babf8bc4739e073928f6128830819f7a
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

251202250.website Open in urlscan Pro 68.65.122.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

1 IPs

1 Countries

314 kBTransfer

404 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

251202250.website Open in urlscan Pro
68.65.122.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

1
IPs

1
Countries

314 kB
Transfer

404 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!