b2yo0uvm.myraidbox.de Open in urlscan Pro
195.201.43.25 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sendpost-22126.sptrackh.com/api/v1/track/click/7/22126/45/microsoft/7abfcb24-d160-4718-84f1-eea840062485?redirecturl=http%3A...
Effective URL:
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
Submission: On May 01 via api (May 1st 2023, 10:30:02 am UTC) from IE — Scanned from DE

Summary HTTP 23 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 2 countries across 12 domains to perform 23 HTTP transactions. The main IP is 195.201.43.25, located in Gunzenhausen, Germany and belongs to HETZNER-AS, DE. The main domain is b2yo0uvm.myraidbox.de.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 13th 2023. Valid for: a year.

This is the only time b2yo0uvm.myraidbox.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.92.251.90 54.92.251.90	14618 (AMAZON-AES) (AMAZON-AES)
1 1	54.205.87.215 54.205.87.215	14618 (AMAZON-AES) (AMAZON-AES)
1 1	34.201.155.118 34.201.155.118	14618 (AMAZON-AES) (AMAZON-AES)
1	69.61.26.121 69.61.26.121	22653 (GLOBALCOM...) (GLOBALCOMPASS)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
1 12	195.201.43.25 195.201.43.25	24940 (HETZNER-AS) (HETZNER-AS)
23	10

1 54.92.251.90 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-92-251-90.compute-1.amazonaws.com

sendpost-22126.sptrackh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.205.87.215 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-87-215.compute-1.amazonaws.com

api.sx26.email	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.201.155.118 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-201-155-118.compute-1.amazonaws.com

app.sendx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.61.26.121 (Atlanta, United States)

ASN22653 (GLOBALCOMPASS, US)

v.ht	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 195.201.43.25 (Gunzenhausen, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: b2yo0uvm.myraidbox.de

b2yo0uvm.myraidbox.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	myraidbox.de 1 redirects b2yo0uvm.myraidbox.de	43 KB
3	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 269	125 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 91	21 KB
1	googlesyndication.com f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com pagead2.googlesyndication.com Failed	3 KB
1	google.com adservice.google.com — Cisco Umbrella Rank: 130	456 B
1	google.de adservice.google.de — Cisco Umbrella Rank: 5261	531 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	45 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 238	25 KB
1	v.ht v.ht — Cisco Umbrella Rank: 702483	2 KB
1	sendx.io 1 redirects app.sendx.io — Cisco Umbrella Rank: 856603	554 B
1	sx26.email 1 redirects api.sx26.email	266 B
1	sptrackh.com 1 redirects sendpost-22126.sptrackh.com	408 B
23	12

	Domain	Requested by
12	b2yo0uvm.myraidbox.de	1 redirects v.ht b2yo0uvm.myraidbox.de
3	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	www.googletagmanager.com	v.ht
1	www.googletagservices.com	v.ht
1	v.ht
1	app.sendx.io	1 redirects
1	api.sx26.email	1 redirects
1	sendpost-22126.sptrackh.com	1 redirects
0	pagead2.googlesyndication.com Failed	securepubads.g.doubleclick.net
23	13

This site contains no links.

Subject Issuer	Validity	Valid
www.v.ht R3	`2023-05-01` - `2023-07-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.myraidbox.de Sectigo RSA Domain Validation Secure Server CA	`2023-04-13` - `2024-05-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
Frame ID: C23194D5C5634030E411BBFF50F791A0
Requests: 22 HTTP requests in this frame

Frame: https://f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 0C3BB7C8A15B29A7F85312A3E325B20C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Global Logistics | International Shipping | DHL | Poland

Page URL History Show full URLs

https://sendpost-22126.sptrackh.com/api/v1/track/click/7/22126/45/microsoft/7abfcb24-d160-4718-84f1-eea840062485... HTTP 302
http://api.sx26.email/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/ HTTP 301
http://app.sendx.io/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/ HTTP 302
https://v.ht/8HGxi Page URL
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk HTTP 301
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/ Page URL
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

23
Requests

96 %
HTTPS

58 %
IPv6

12
Domains

13
Subdomains

10
IPs

2
Countries

263 kB
Transfer

697 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sendpost-22126.sptrackh.com/api/v1/track/click/7/22126/45/microsoft/7abfcb24-d160-4718-84f1-eea840062485?redirecturl=http%3A%2F%2Fapi.sx26.email%2Fapi%2Fv1%2Ftrack%2Fcampaign%2Fclick%2FVu4PeKOy52o8hJM0T87ZM5%2FW2g9QfqPKRpOnrOtiONXgK/ HTTP 302
http://api.sx26.email/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/ HTTP 301
http://app.sendx.io/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/ HTTP 302
https://v.ht/8HGxi Page URL
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk HTTP 301
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/ Page URL
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://sendpost-22126.sptrackh.com/api/v1/track/click/7/22126/45/microsoft/7abfcb24-d160-4718-84f1-eea840062485?redirecturl=http%3A%2F%2Fapi.sx26.email%2Fapi%2Fv1%2Ftrack%2Fcampaign%2Fclick%2FVu4PeKOy52o8hJM0T87ZM5%2FW2g9QfqPKRpOnrOtiONXgK/ HTTP 302
http://api.sx26.email/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/ HTTP 301
http://app.sendx.io/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/ HTTP 302
https://v.ht/8HGxi

Request Chain 11

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk HTTP 301
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

8HGxi Show response
v.ht/
Redirect Chain

https://sendpost-22126.sptrackh.com/api/v1/track/click/7/22126/45/microsoft/7abfcb24-d160-4718-84f1-eea840062485?redirecturl=http%3A%2F%2Fapi.sx26.email%2Fapi%2Fv1%2Ftrack%2Fcampaign%2Fclick%2FVu4P...
http://api.sx26.email/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/
http://app.sendx.io/api/v1/track/campaign/click/Vu4PeKOy52o8hJM0T87ZM5/W2g9QfqPKRpOnrOtiONXgK/
https://v.ht/8HGxi

3 KB
2 KB

796ms
117ms

Document
text/html

69.61.26.121
GLOBALCOMPASS

General

Check archive.org

Show headers Download Go to

Full URL

https://v.ht/8HGxi

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.61.26.121 Atlanta, United States, ASN22653 (GLOBALCOMPASS, US),

Reverse DNS

Software

Hotcores.com /

Resource Hash

94f78cfaef19980f55f361cdae577fbb52c48e9b87e027cdd6654ad425c4f9d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; Charset=UTF-8;charset=UTF-8
Date: Mon, 01 May 2023 10:24:15 GMT
I-AM: Alpha
Pragma: no-cache
Server: Hotcores.com
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Robots-Tag: noindex, nofollow

Redirect headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Origin,Authorization,Access-Control-Allow-Origin
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Access-Control-Allow-Origin
Connection: keep-alive
Content-Length: 36
Content-Type: text/plain; charset=utf-8
Date: Mon, 01 May 2023 10:29:57 GMT
Location: https://v.ht/8HGxi
Server: openresty

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 74 KB
25 KB 149ms
91ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: v.ht
URL: https://v.ht/8HGxi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee49f8607bd9a47f930280a04ffcef166dd50dcd07a105a71b0c05dee5d93620

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24761
x-xss-protection: 0
server: cafe
etag: 933 / 19478 / m202304250101 / config-hash: 6244525888432953740
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 01 May 2023 10:29:58 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 114 KB
45 KB 83ms
24ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-31510493-3

Requested by

Host: v.ht
URL: https://v.ht/8HGxi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02f775242058ed281532f4bd28c79939c1600992742d89253814cfa994ed4d61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45425
x-xss-protection: 0
last-modified: Mon, 01 May 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 01 May 2023 10:29:58 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 46ms
15ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-31510493-3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 May 2023 08:32:18 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 7060
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 01 May 2023 10:32:18 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/ 398 KB
124 KB 79ms
24ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37e314bfd8e8cb9262b5ea01059377cea510e23b2215fc93de8b34a5726284a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 09:06:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5019
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126109
x-xss-protection: 0
server: cafe
etag: 6695821980177688499
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 30 Apr 2024 09:06:19 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 26 B
572 B 83ms
48ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=v.ht

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19dc99a8224767e303208b156949a2c7b99e67dbe02ef9aa078fecaa28d3616e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30
x-xss-protection: 0
expires: Mon, 01 May 2023 10:29:58 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
198 B 18ms
17ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1027535775&t=pageview&_s=1&dl=https%3A%2F%2Fv.ht%2F8HGxi&ul=en-us&de=UTF-8&dt=8HGxi&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1925748142&gjid=1804744520&cid=1782751001.1682936998&tid=UA-31510493-3&_gid=414102474.1682936998&_r=1&gtm=457e34q0&jsscut=1&z=293857168

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://v.ht/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 May 2023 10:29:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://v.ht
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 74ms
23ms Script
application/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=v.ht

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 61ms
22ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=v.ht

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 640 B
688 B 51ms
50ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3868011469209755&correlator=3016420333657716&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fif&iu_parts=5837603%2CVht_360&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x360&ifi=1&adks=495576698&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1682936998473&lmt=1682936998&dlt=1682936998147&idt=301&adxs=-12245933&adys=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fv.ht%2F8HGxi&frm=20&vis=1&psz=300x63&msz=0x0&fws=128&ohw=0&ga_vid=1782751001.1682936998&ga_sid=1682936998&ga_hid=1027535775&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32629b5151e5b0c0a80821ec260c4b2e8a8134666ab20245f4bd4258194182d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://v.ht/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 324
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://v.ht
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0C3B 6 KB
3 KB 69ms
20ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://v.ht/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 01 May 2023 10:29:58 GMT
expires: Tue, 30 Apr 2024 10:29:58 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
b2yo0uvm.myraidbox.de/wp-content/vok/sk/
Redirect Chain

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk
https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/

416 B
431 B

11ms
11ms

Document
text/html

195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/

Requested by

Host: v.ht
URL: https://v.ht/8HGxi

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://v.ht/8HGxi
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 01 May 2023 10:29:58 GMT
server: nginx
strict-transport-security: max-age=63072000
vary: Accept-Encoding
x-cache: HIT
x-cache-device-type: responsive
x-cache-type: NGINX
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

content-length: 162
content-type: text/html
date: Mon, 01 May 2023 10:29:58 GMT
location: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/
server: nginx
strict-transport-security: max-age=63072000
vary: Accept-Encoding
x-cache-device-type: responsive
x-cache-type: NGINX
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET sodar
pagead2.googlesyndication.com/getconfig/ 0
0

GET
H2 200 Primary Request billing.php Show response
b2yo0uvm.myraidbox.de/wp-content/vok/sk/ 5 KB
1 KB 10ms
10ms Document
text/html 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

7406d0a51b14e4a34afa7e1d25b3d8be3ab88f9e40578af1a704c4743d3b9b88

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 01 May 2023 10:29:58 GMT
server: nginx
strict-transport-security: max-age=63072000
vary: Accept-Encoding
x-cache: HIT
x-cache-device-type: responsive
x-cache-type: NGINX
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 header.css
b2yo0uvm.myraidbox.de/wp-content/vok/sk/css/ 6 KB
2 KB 11ms
11ms Stylesheet
text/css 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/css/header.css

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

e0cd60b4b91620fc5ea59d9a28c2509efca95e3981ea8f52733e5ec0c6123375

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: public
date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
content-encoding: br
etag: W/"64497d56-18b0"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 dhl-logo.svg
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 2 KB
991 B 12ms
11ms Image
image/svg+xml 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/dhl-logo.svg

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: public
date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
content-encoding: br
etag: W/"64497d56-643"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 searchloupe.svg
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 329 B
551 B 11ms
10ms Image
image/svg+xml 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/searchloupe.svg

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

fd85293d457b5dc514838dd7d5c7c1509a7eed60e23cb32ab9303666833eb98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: public
date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
content-encoding: br
etag: W/"64497d56-149"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 headermobile.JPG
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 9 KB
9 KB 14ms
13ms Image
image/jpeg 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/headermobile.JPG

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

c600aea2fa4dad3a13560e01bedf9e6c45db0571c3257d9e53e51c4f8fbbc41f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-cache-type: STATIC
content-length: 9061
x-xss-protection: 1; mode=block
pragma: public
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
etag: "64497d56-2365"
vary: Accept-Encoding, Accept
content-type: image/jpeg
cache-control: max-age=31536000, public
accept-ranges: bytes
x-cache-device-type: responsive
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 saba9m.JPG
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 8 KB
8 KB 20ms
20ms Image
image/jpeg 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/saba9m.JPG

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

d1b64fb7749d0d3c905c5244660a21f3d8e29699457f2889274c8a717742b6c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-cache-type: STATIC
content-length: 7956
x-xss-protection: 1; mode=block
pragma: public
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
etag: "64497d56-1f14"
vary: Accept-Encoding, Accept
content-type: image/jpeg
cache-control: max-age=31536000, public
accept-ranges: bytes
x-cache-device-type: responsive
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 customer.svg
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 2 KB
1 KB 22ms
21ms Image
image/svg+xml 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/customer.svg

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

0c3950f8653400246636960456db609af841feb691e53911e763ee282616a390

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: public
date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
content-encoding: br
etag: W/"64497d56-657"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 ssdsd.JPG
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 8 KB
8 KB 22ms
22ms Image
image/jpeg 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ssdsd.JPG

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

7dcdd04db64c3edd7e9868c6238b622d33caee1e7bdadbf2623d801109eefef1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-cache-type: STATIC
content-length: 7949
x-xss-protection: 1; mode=block
pragma: public
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
etag: "64497d56-1f0d"
vary: Accept-Encoding, Accept
content-type: image/jpeg
cache-control: max-age=31536000, public
accept-ranges: bytes
x-cache-device-type: responsive
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 feedback.png
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 2 KB
2 KB 23ms
22ms Image
image/png 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/feedback.png

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

3221db8f898b88e467ebbb8ae155a37bd02087b3df197ad5c4ecead06db08cdf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-cache-type: STATIC
content-length: 1577
x-xss-protection: 1; mode=block
pragma: public
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
etag: "64497d56-629"
vary: Accept-Encoding, Accept
content-type: image/png
cache-control: max-age=31536000, public
accept-ranges: bytes
x-cache-device-type: responsive
expires: Tue, 30 Apr 2024 10:29:58 GMT

GET
H2 200 socials.JPG
b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/ 9 KB
9 KB 23ms
23ms Image
image/jpeg 195.201.43.25
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/images/socials.JPG

Requested by

Host: b2yo0uvm.myraidbox.de
URL: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.201.43.25 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b2yo0uvm.myraidbox.de

Software

nginx /

Resource Hash

1ace605596027318737abeca712c7a0d6d76f753cf82affba37c3d2f44862ae4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b2yo0uvm.myraidbox.de/wp-content/vok/sk/billing.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 01 May 2023 10:29:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-cache-type: STATIC
content-length: 9110
x-xss-protection: 1; mode=block
pragma: public
last-modified: Wed, 26 Apr 2023 19:36:54 GMT
server: nginx
etag: "64497d56-2396"
vary: Accept-Encoding, Accept
content-type: image/jpeg
cache-control: max-age=31536000, public
accept-ranges: bytes
x-cache-device-type: responsive
expires: Tue, 30 Apr 2024 10:29:58 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202304250101&st=env

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| redirect

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.sendx.io/	1969-12-31 23:59:59	Name: sendx_sess Value: 6ee8fea80a449fb0945f7ffc601ae634
.v.ht/	1970-01-20 21:04:56	Name: _ga Value: GA1.2.1782751001.1682936998
.v.ht/	1970-01-20 11:30:23	Name: _gid Value: GA1.2.414102474.1682936998
.v.ht/	1970-01-20 11:28:57	Name: _gat_gtag_UA_31510493_3 Value: 1
.doubleclick.net/	1970-01-20 11:28:57	Name: test_cookie Value: CheckForPermission
.v.ht/	1970-01-20 20:50:32	Name: __gads Value: ID=b26ad5e419b332cc:T=1682936998:S=ALNI_MZLyePYxIdYWhezFVOjuhqFq68kNQ
.v.ht/	1970-01-20 20:50:32	Name: __gpi Value: UID=00000c0e135234cf:T=1682936998:RT=1682936998:S=ALNI_MaeZf7qFmoUFx62N3Gvt3GVe-j6mg

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
api.sx26.email
app.sendx.io
b2yo0uvm.myraidbox.de
f1c7aea33c0c591dc9ea4373caef5f6e.safeframe.googlesyndication.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
sendpost-22126.sptrackh.com
v.ht
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
pagead2.googlesyndication.com
195.201.43.25
2001:4860:4802:34::178
2a00:1450:4001:806::2002
2a00:1450:4001:809::2002
2a00:1450:4001:810::2008
2a00:1450:4001:827::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:831::2002
34.201.155.118
54.205.87.215
54.92.251.90
69.61.26.121
02f775242058ed281532f4bd28c79939c1600992742d89253814cfa994ed4d61
0c3950f8653400246636960456db609af841feb691e53911e763ee282616a390
19dc99a8224767e303208b156949a2c7b99e67dbe02ef9aa078fecaa28d3616e
1ace605596027318737abeca712c7a0d6d76f753cf82affba37c3d2f44862ae4
3221db8f898b88e467ebbb8ae155a37bd02087b3df197ad5c4ecead06db08cdf
32629b5151e5b0c0a80821ec260c4b2e8a8134666ab20245f4bd4258194182d7
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
37e314bfd8e8cb9262b5ea01059377cea510e23b2215fc93de8b34a5726284a8
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7406d0a51b14e4a34afa7e1d25b3d8be3ab88f9e40578af1a704c4743d3b9b88
7dcdd04db64c3edd7e9868c6238b622d33caee1e7bdadbf2623d801109eefef1
94f78cfaef19980f55f361cdae577fbb52c48e9b87e027cdd6654ad425c4f9d4
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
c600aea2fa4dad3a13560e01bedf9e6c45db0571c3257d9e53e51c4f8fbbc41f
d1b64fb7749d0d3c905c5244660a21f3d8e29699457f2889274c8a717742b6c5
e0cd60b4b91620fc5ea59d9a28c2509efca95e3981ea8f52733e5ec0c6123375
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ee49f8607bd9a47f930280a04ffcef166dd50dcd07a105a71b0c05dee5d93620
fd85293d457b5dc514838dd7d5c7c1509a7eed60e23cb32ab9303666833eb98a

b2yo0uvm.myraidbox.de Open in urlscan Pro 195.201.43.25 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

23 Requests

96 %HTTPS

58 %IPv6

12 Domains

13 Subdomains

10 IPs

2 Countries

263 kBTransfer

697 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

23 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

7 Cookies

Security Headers

Indicators

b2yo0uvm.myraidbox.de Open in urlscan Pro
195.201.43.25 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

23
Requests

96 %
HTTPS

58 %
IPv6

12
Domains

13
Subdomains

10
IPs

2
Countries

263 kB
Transfer

697 kB
Size

7
Cookies

23 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!