urlscan.io logo urlscan.io
SecurityTrails logo

keen-antonelli.49-12-106-1.plesk.page Open in urlscan Pro
49.12.106.1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://zazlooz11.s3.amazonaws.com/zaz2.html
Effective URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Submission: On October 09 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 20 HTTP transactions. The main IP is 49.12.106.1, located in Germany and belongs to HETZNER-AS, DE. The main domain is keen-antonelli.49-12-106-1.plesk.page.
TLS certificate: Issued by R3 on October 8th 2022. Valid for: 3 months.
This is the only time keen-antonelli.49-12-106-1.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 52.216.105.91 16509 (AMAZON-02)
1 20 49.12.106.1 24940 (HETZNER-AS)
20 2
Apex Domain
Subdomains		 Transfer
20 plesk.page
keen-antonelli.49-12-106-1.plesk.page
379 KB
1 amazonaws.com
zazlooz11.s3.amazonaws.com
579 B
20 2
Domain Requested by
20 keen-antonelli.49-12-106-1.plesk.page 1 redirects keen-antonelli.49-12-106-1.plesk.page
1 zazlooz11.s3.amazonaws.com
20 2

This site contains links to these domains. Also see Links.

Domain
developer.dhl
www.dhl.de
Subject Issuer Validity Valid
*.s3.amazonaws.com
Amazon		 2021-12-15 -
2022-12-03		 a year crt.sh
keen-antonelli.49-12-106-1.plesk.page
R3		 2022-10-08 -
2023-01-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Frame ID: 7DCB3A74005DF446DA56BB65E1D76907
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Tracking | DHL | Global

Page URL History Show full URLs

  1. https://zazlooz11.s3.amazonaws.com/zaz2.html Page URL
  2. https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs HTTP 301
    https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/ Page URL

Page Statistics

20
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

379 kB
Transfer

1184 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://zazlooz11.s3.amazonaws.com/zaz2.html Page URL
  2. https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs HTTP 301
    https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
zaz2.html
zazlooz11.s3.amazonaws.com/ 		133 B
579 B 		Document
General
Check archive.org
Download Go to
Full URL
https://zazlooz11.s3.amazonaws.com/zaz2.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.105.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
a921abede37d6233c4af944d2fd5877cdb0461a5ae391b17adaf99561505505c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
133
Content-Type
text/html
Date
Sun, 09 Oct 2022 19:42:31 GMT
ETag
"7df7ce8c3a68eb9a37c9520619372ba9"
Last-Modified
Sat, 08 Oct 2022 06:28:00 GMT
Server
AmazonS3
x-amz-id-2
7V0V4QDBWHNY8Co2lkhTxmDt9HoPrp6MuFCG2oDjLe9/RCHa5Nhrgg16od1hq2l/2F9YqHJNxBs=
x-amz-request-id
7CWCQBM4Y7V0CV24
x-amz-server-side-encryption
AES256
x-amz-version-id
tPQ88JBFR72G7UTZx2LKz9UPZKZ82.Pz
Primary Request /
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Redirect Chain
  • https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs
  • https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
125 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PHP/7.4.32 PleskLin
Resource Hash
6ae88950dbcad96c2493c6fd91c51f961bc6cf606b30f3843d2b662ad2f3fc08

Request headers

Referer
https://zazlooz11.s3.amazonaws.com/zaz2.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 09 Oct 2022 19:42:31 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
x-powered-by
PHP/7.4.32 PleskLin

Redirect headers

content-length
276
content-type
text/html; charset=iso-8859-1
date
Sun, 09 Oct 2022 19:42:30 GMT
location
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
server
nginx
x-powered-by
PleskLin
bundle.35490f91e69e1ed0924450bfedb9e79d.css
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/ 		474 KB
76 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
4cfef2d3e813496a4bfe97240684d5da9eac8e96c6be5532b93d703c8bfd9e5d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
W/"628c20e4-76949"
x-powered-by
PleskLin
content-type
text/css
bundle-utapi.35490f91e69e1ed0924450bfedb9e79d.css
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/ 		18 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle-utapi.35490f91e69e1ed0924450bfedb9e79d.css
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
f261d20f7ad35d2120916bd633690768a9f6539299bb5f9f5f544e98ca778c61

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
W/"628c20e4-4721"
x-powered-by
PleskLin
content-type
text/css
one_trust.css
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/ 		108 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/one_trust.css
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
95a00a64df0eef5899e76badeee2ac4b37362f6eab1b15c1e29e45f7359d2e9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
W/"628c20e4-1af6b"
x-powered-by
PleskLin
content-type
text/css
app.4d897de7.css
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/ 		892 B
481 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/app.4d897de7.css
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
b6ea95aa874acfea607f7d1b6ef627ca2f5b53180c4221df83471ad4c810154b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 00:03:48 GMT
x-accel-version
0.01
server
nginx
etag
W/"37c-5dfb6b0df0100"
x-powered-by
PleskLin
content-type
text/css
app.4564064e.js
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/js/ 		44 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/js/app.4564064e.js
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
53080aa6630a21e855f7cb3a4150e23054f69d670b5f62fcf86e8f8ae42d7484

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
W/"628c20e4-af91"
x-powered-by
PleskLin
content-type
application/javascript
chunk-vendors.524d9220.js
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/js/ 		218 KB
67 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/js/chunk-vendors.524d9220.js
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
2aa3e91fee3b39e252e6bcf6aaf52c9fb0a9272fdf7b4e98c9b03ee1fcb3c392

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
W/"628c20e4-369fc"
x-powered-by
PleskLin
content-type
application/javascript
dhl-logo.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/dhl-logo.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-643"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
1603
glo-footer-logo.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/glo-footer-logo.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-2ec0"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
11968
youtube-new.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/youtube-new.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-584"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
1412
facebook-new.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/facebook-new.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-57e"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
1406
linkedIn-new.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/linkedIn-new.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-66f"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
1647
instagram-new.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/images/instagram-new.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
2b7033274e2d189caaebe5e75931b4a5a2e9e1d1ca297e56a99e5e5ef987adba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-1109"
x-powered-by
PleskLin
content-type
image/svg+xml
accept-ranges
bytes
content-length
4361
default-274a65bae9742377aaf010bb1a7de971.woff
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/ 		40 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/default-274a65bae9742377aaf010bb1a7de971.woff
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940

Request headers

Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Origin
https://keen-antonelli.49-12-106-1.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-a07c"
x-powered-by
PleskLin
content-type
application/font-woff
accept-ranges
bytes
content-length
41084
c21352eccd8a788365ab6333944e7899.svg
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/img/ 		808 B
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/img/c21352eccd8a788365ab6333944e7899.svg
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
content-encoding
br
last-modified
Sat, 08 Oct 2022 06:19:47 GMT
server
nginx
etag
W/"328-5ea7fe9c5269e"
content-type
text/html
iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
6d051536af97fbd33fae0683a1b6ce3749757ab43c8ee8c89295755fd4595807

Request headers

Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Origin
https://keen-antonelli.49-12-106-1.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-2464"
x-powered-by
PleskLin
content-type
application/font-woff
accept-ranges
bytes
content-length
9316
default-815fcbb4d2c57901701125d768f09d67.woff
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/ 		40 KB
41 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/default-815fcbb4d2c57901701125d768f09d67.woff
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
19d0bda83ecbc986620468801adf000c77c3c38398650903c63fac8dcbac4383

Request headers

Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Origin
https://keen-antonelli.49-12-106-1.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-a170"
x-powered-by
PleskLin
content-type
application/font-woff
accept-ranges
bytes
content-length
41328
default-3e828e80f6e985c352eba4474518978d.woff
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/ 		43 KB
43 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/default-3e828e80f6e985c352eba4474518978d.woff
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
87c40e3961e21f759770615ae67568a3de3ec6e0735f1238a6aae062f4ea15d5

Request headers

Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Origin
https://keen-antonelli.49-12-106-1.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:31 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-ace4"
x-powered-by
PleskLin
content-type
application/font-woff
accept-ranges
bytes
content-length
44260
default-5a6dd86f272b304a8b83f7df61f11c2f.woff
keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/ 		40 KB
41 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff
Requested by
Host: keen-antonelli.49-12-106-1.plesk.page
URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
49.12.106.1 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.1.106.12.49.clients.your-server.de
Software
nginx / PleskLin
Resource Hash
b033eff45e6e8ecd5c5bccd8ef9a96c4dc37325adc64c5aed8b1d909b24c4eb4

Request headers

Referer
https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/bundle.35490f91e69e1ed0924450bfedb9e79d.css
Origin
https://keen-antonelli.49-12-106-1.plesk.page
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Sun, 09 Oct 2022 19:42:33 GMT
last-modified
Tue, 24 May 2022 00:03:48 GMT
server
nginx
etag
"628c20e4-a188"
x-powered-by
PleskLin
content-type
application/font-woff
accept-ranges
bytes
content-length
41352

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| inuser_session object| _inuser_session object| webpackJsonp object| regeneratorRuntime

1 Cookies

Domain/Path Name / Value
keen-antonelli.49-12-106-1.plesk.page/ Name: PHPSESSID
Value: i4kogrpknofsr4tf4n56lgdpio

1 Console Messages

Source Level URL
Text
network error URL: https://keen-antonelli.49-12-106-1.plesk.page/dhl-cryptre-news/webs/css/img/c21352eccd8a788365ab6333944e7899.svg
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

keen-antonelli.49-12-106-1.plesk.page
zazlooz11.s3.amazonaws.com
49.12.106.1
52.216.105.91
19d0bda83ecbc986620468801adf000c77c3c38398650903c63fac8dcbac4383
2aa3e91fee3b39e252e6bcf6aaf52c9fb0a9272fdf7b4e98c9b03ee1fcb3c392
2b7033274e2d189caaebe5e75931b4a5a2e9e1d1ca297e56a99e5e5ef987adba
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2
4cfef2d3e813496a4bfe97240684d5da9eac8e96c6be5532b93d703c8bfd9e5d
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
53080aa6630a21e855f7cb3a4150e23054f69d670b5f62fcf86e8f8ae42d7484
5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940
6ae88950dbcad96c2493c6fd91c51f961bc6cf606b30f3843d2b662ad2f3fc08
6d051536af97fbd33fae0683a1b6ce3749757ab43c8ee8c89295755fd4595807
87c40e3961e21f759770615ae67568a3de3ec6e0735f1238a6aae062f4ea15d5
95a00a64df0eef5899e76badeee2ac4b37362f6eab1b15c1e29e45f7359d2e9f
a921abede37d6233c4af944d2fd5877cdb0461a5ae391b17adaf99561505505c
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347
b033eff45e6e8ecd5c5bccd8ef9a96c4dc37325adc64c5aed8b1d909b24c4eb4
b6ea95aa874acfea607f7d1b6ef627ca2f5b53180c4221df83471ad4c810154b
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528
f261d20f7ad35d2120916bd633690768a9f6539299bb5f9f5f544e98ca778c61