l7000335.ferozo.com Open in urlscan Pro
200.58.111.177  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request user.php Show response l7000335.ferozo.com/px/app/	3 KB 3 KB	1429ms 953ms	Document text/html	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Full URL http://l7000335.ferozo.com/px/app/user.php Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / PHP/7.3.32 Resource Hash dbe9e953d917efbf5e35a8b9f4f0831f4d1f3c54e7d25c4adf5af8e9eda2703f Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 01 Jun 2023 12:58:36 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=10, max=200 Pragma no-cache Server Apache Transfer-Encoding chunked X-Powered-By PHP/7.3.32
GET H2	200	fonts.css www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/	1 KB 882 B	402ms 18ms	Stylesheet text/css	13.32.99.15 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/user.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.15 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-15.fra60.r.cloudfront.net Software Apache / Resource Hash adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b Security Headers Name Value Content-Security-Policy frame-ancestors https://*.deutsche-bank.de Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de Request headers accept-language de-DE,de;q=0.9 Referer http://l7000335.ferozo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 12:58:37 GMT strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff via 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront) content-security-policy frame-ancestors https://*.deutsche-bank.de x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-length 226 last-modified Wed, 24 Feb 2021 08:20:14 GMT server Apache db-nickname VTJGc2RHVmtYMTlWc056amkzWWxzQURxOUxFcGc1L1lsR3c1VkIxRmxPQT0= etag "42d-5bc10b44d0b80-gzip" vary Accept-Encoding,Origin x-frame-options SAMEORIGIN, allow-from https://meine.deutsche-bank.de content-type text/css access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id gLIx__VbkUlKuSdB5sonTI1h193lOCE8rmtoANA0KHSx98XhFiM1FQ== expires Fri, 31 May 2024 12:58:37 GMT
GET H/1.1	200 OK	user-style.css l7000335.ferozo.com/px/app/res/	3 KB 3 KB	253ms 245ms	Stylesheet text/css	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Full URL http://l7000335.ferozo.com/px/app/res/user-style.css Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/user.php Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / Resource Hash 3dc541aa9bb40fe5df53166a1ae584f2df06bc3abf2237e5a46cf77c1d15c3d6 Request headers accept-language de-DE,de;q=0.9 Referer http://l7000335.ferozo.com/px/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Date Thu, 01 Jun 2023 12:58:37 GMT Last-Modified Tue, 03 Jan 2023 05:28:52 GMT Server Apache ETag "c3d-5f15557da6d00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=199 Content-Length 3133
GET H/1.1	200 OK	logo-cut.png l7000335.ferozo.com/px/app/res/	2 KB 2 KB	495ms 247ms	Image image/png	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Show image Full URL http://l7000335.ferozo.com/px/app/res/logo-cut.png Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/user.php Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / Resource Hash ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901 Request headers accept-language de-DE,de;q=0.9 Referer http://l7000335.ferozo.com/px/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Date Thu, 01 Jun 2023 12:58:37 GMT Last-Modified Mon, 02 Jan 2023 20:01:10 GMT Server Apache ETag "70e-5f14d69998d80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=200 Content-Length 1806
GET H/1.1	200 OK	img1.jpg l7000335.ferozo.com/px/app/res/	44 KB 45 KB	494ms 241ms	Image image/jpeg	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Show image Full URL http://l7000335.ferozo.com/px/app/res/img1.jpg Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/user.php Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / Resource Hash 97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a Request headers accept-language de-DE,de;q=0.9 Referer http://l7000335.ferozo.com/px/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Date Thu, 01 Jun 2023 12:58:37 GMT Last-Modified Mon, 02 Jan 2023 19:41:24 GMT Server Apache ETag "b0ef-5f14d22e8a100" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=198 Content-Length 45295
GET H/1.1	200 OK	jq.js Show response l7000335.ferozo.com/px/app/res/	287 KB 287 KB	254ms 246ms	Script application/javascript	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Full URL http://l7000335.ferozo.com/px/app/res/jq.js Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/user.php Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / Resource Hash 9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953 Request headers accept-language de-DE,de;q=0.9 Referer http://l7000335.ferozo.com/px/app/user.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Date Thu, 01 Jun 2023 12:58:37 GMT Last-Modified Mon, 02 Jan 2023 19:14:00 GMT Server Apache ETag "47b27-5f14cc0eb2e00" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=200 Content-Length 293671
GET H/1.1	200 OK	back.jpg l7000335.ferozo.com/px/app/res/	243 KB 243 KB	338ms 246ms	Image image/jpeg	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Show image Full URL http://l7000335.ferozo.com/px/app/res/back.jpg Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/res/user-style.css Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / Resource Hash 8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf Request headers accept-language de-DE,de;q=0.9 Referer http://l7000335.ferozo.com/px/app/res/user-style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers Date Thu, 01 Jun 2023 12:58:37 GMT Last-Modified Mon, 02 Jan 2023 18:32:24 GMT Server Apache ETag "3cbb5-5f14c2c253e00" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=199 Content-Length 248757
GET H2	200	FrutigerLTW05-55Roman.woff2 www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/	25 KB 26 KB	31ms 16ms	Font font/woff2	2600:9000:2251:9000:13:46b5:7d80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-55Roman.woff2 Requested by Host: www.deutsche-bank.de URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2251:9000:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash 55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31 Security Headers Name Value Content-Security-Policy frame-ancestors https://*.deutsche-bank.de Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de Request headers Referer https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Origin http://l7000335.ferozo.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 12:58:37 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-security-policy frame-ancestors https://*.deutsche-bank.de via 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-length 25764 last-modified Wed, 24 Feb 2021 08:20:14 GMT server Apache db-nickname VTJGc2RHVmtYMS9iMDh4bGxsNzJsWXFxZjZHMVBMNGM3NUd1TFVFQXBTYz0= etag "64a4-5bc10b44d0b80" vary Origin x-frame-options SAMEORIGIN, allow-from https://meine.deutsche-bank.de content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id _lNyvbtk2bnhMzyI2UCB2j-hvb5HR-pJhS6sRVqMLAtAVI2clzdM1g== expires Fri, 31 May 2024 12:58:37 GMT
GET H2	200	FrutigerLTW05-65Bold.woff2 www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/	25 KB 26 KB	38ms 22ms	Font font/woff2	2600:9000:2251:9000:13:46b5:7d80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-65Bold.woff2 Requested by Host: www.deutsche-bank.de URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2251:9000:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de Security Headers Name Value Content-Security-Policy frame-ancestors https://*.deutsche-bank.de Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de Request headers Referer https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css Origin http://l7000335.ferozo.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Thu, 01 Jun 2023 12:58:37 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-security-policy frame-ancestors https://*.deutsche-bank.de via 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-length 26008 last-modified Wed, 24 Feb 2021 08:20:14 GMT server Apache db-nickname VTJGc2RHVmtYMTlWc056amkzWWxzQURxOUxFcGc1L1lsR3c1VkIxRmxPQT0= etag "6598-5bc10b44d0b80" vary Origin x-frame-options SAMEORIGIN, allow-from https://meine.deutsche-bank.de content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id UQ67-IeP5Wd1ARAPGopmLTkkNqfg6SbzvDQ6kaJ_yFuUDx-gX_L24Q== expires Fri, 31 May 2024 12:58:37 GMT
POST H/1.1	200 OK	fetch.php Show response l7000335.ferozo.com/px/panel/	1 B 234 B	260ms 260ms	XHR text/html	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Full URL http://l7000335.ferozo.com/px/panel/fetch.php Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/res/jq.js Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / PHP/7.3.32 Resource Hash 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 Request headers Accept */* Referer http://l7000335.ferozo.com/px/app/user.php X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Thu, 01 Jun 2023 12:58:41 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/7.3.32 Keep-Alive timeout=10, max=198 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
POST H/1.1	200 OK	fetch.php Show response l7000335.ferozo.com/px/panel/	1 B 234 B	260ms 259ms	XHR text/html	200.58.111.177 Dattatec.com
General Check archive.org Show headers Download Go to Full URL http://l7000335.ferozo.com/px/panel/fetch.php Requested by Host: l7000335.ferozo.com URL: http://l7000335.ferozo.com/px/app/res/jq.js Protocol HTTP/1.1 Server 200.58.111.177 Rosario, Argentina, ASN27823 (Dattatec.com, AR), Reverse DNS lujan.dattaweb.com Software Apache / PHP/7.3.32 Resource Hash 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 Request headers Accept */* Referer http://l7000335.ferozo.com/px/app/user.php X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Thu, 01 Jun 2023 12:58:43 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/7.3.32 Keep-Alive timeout=10, max=197 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
POST		fetch.php l7000335.ferozo.com/px/panel/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

l7000335.ferozo.com

URL

http://l7000335.ferozo.com/px/panel/fetch.php

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery string| cd

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			l7000335.ferozo.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 39f62b4c88fc1e2557e10d4fe36685d6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

l7000335.ferozo.com
www.deutsche-bank.de
l7000335.ferozo.com
13.32.99.15
200.58.111.177
2600:9000:2251:9000:13:46b5:7d80:93a1
3dc541aa9bb40fe5df53166a1ae584f2df06bc3abf2237e5a46cf77c1d15c3d6
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953
adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
dbe9e953d917efbf5e35a8b9f4f0831f4d1f3c54e7d25c4adf5af8e9eda2703f
ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901