urlscan.io logo urlscan.io
SecurityTrails logo

hotelleschanze.com Open in urlscan Pro
95.216.246.100  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://hotelleschanze.com/secure/sharddoc22/
Effective URL: https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=con...
Submission Tags: falconsandbox
Submission: On June 27 via api from US — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 95.216.246.100, located in Helsinki, Finland and belongs to HETZNER-AS, DE. The main domain is hotelleschanze.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 19th 2022. Valid for: 3 months.
This is the only time hotelleschanze.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

IP Address AS Autonomous System
2 4 95.216.246.100 24940 (HETZNER-AS)
4 38.34.185.163 18978 (ENZUINC-)
7 3
Apex Domain
Subdomains		 Transfer
4 com.de
code.jquery.com.de
460 KB
4 hotelleschanze.com
hotelleschanze.com
285 KB
7 2
Domain Requested by
4 code.jquery.com.de hotelleschanze.com
code.jquery.com.de
4 hotelleschanze.com 2 redirects hotelleschanze.com
7 2

This site contains no links.

Subject Issuer Validity Valid
hotelleschanze.com
cPanel, Inc. Certification Authority		 2022-05-19 -
2022-08-17		 3 months crt.sh
code.jquery.com.de
cPanel, Inc. Certification Authority		 2022-05-09 -
2022-08-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj
Frame ID: 84E73A569F88416EF94620D9D37A5DBC
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sharing Link Validation

Page URL History Show full URLs

  1. https://hotelleschanze.com/secure/sharddoc22/ Page URL
  2. https://hotelleschanze.com/secure/sharddoc22/meta.php HTTP 302
    https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf?squabbled=Vhp1eKeAUP&reoffers=re... HTTP 301
    https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=r... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

745 kB
Transfer

920 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hotelleschanze.com/secure/sharddoc22/ Page URL
  2. https://hotelleschanze.com/secure/sharddoc22/meta.php HTTP 302
    https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj HTTP 301
    https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
hotelleschanze.com/secure/sharddoc22/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hotelleschanze.com/secure/sharddoc22/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
95.216.246.100 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
lin70.itlinks.com
Software
Apache /
Resource Hash
e59b61e122bb45c34111dc00a1c2e3368e4a42b5ddc3fbe90f20bbbe31e9f184

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 27 Jun 2022 19:20:23 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
jquery-3.5.1.min.js
code.jquery.com.de/ 		230 KB
230 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com.de/jquery-3.5.1.min.js
Requested by
Host: hotelleschanze.com
URL: https://hotelleschanze.com/secure/sharddoc22/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
38.34.185.163 Tokyo, Japan, ASN18978 (ENZUINC-, US),
Reverse DNS
163.185-34-38.rdns.scalabledns.com
Software
Apache /
Resource Hash
72acf4e3492449dabe8ca28cdfc6cead48e3e61717f77439dcb0b5bb68bdb037

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://hotelleschanze.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Mon, 27 Jun 2022 19:20:24 GMT
Last-Modified
Fri, 20 May 2022 16:50:17 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
235071
ip.php
code.jquery.com.de/ 		0
0
Primary Request /
hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/
Redirect Chain
  • https://hotelleschanze.com/secure/sharddoc22/meta.php
  • https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj
  • https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj
282 KB
283 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj
Requested by
Host: hotelleschanze.com
URL: https://hotelleschanze.com/secure/sharddoc22/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
95.216.246.100 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
lin70.itlinks.com
Software
Apache /
Resource Hash
971949a82afd272214e03530da9b9cdb5b8d5dbdd4962f52eb32a19445ea52b5

Request headers

Referer
https://hotelleschanze.com/secure/sharddoc22/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 27 Jun 2022 19:20:25 GMT
Keep-Alive
timeout=5, max=97
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Length
368
Content-Type
text/html; charset=iso-8859-1
Date
Mon, 27 Jun 2022 19:20:25 GMT
Keep-Alive
timeout=5, max=98
Location
https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj
Server
Apache
jquery-3.5.1.min.js
code.jquery.com.de/ 		230 KB
230 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com.de/jquery-3.5.1.min.js
Requested by
Host: hotelleschanze.com
URL: https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
38.34.185.163 Tokyo, Japan, ASN18978 (ENZUINC-, US),
Reverse DNS
163.185-34-38.rdns.scalabledns.com
Software
Apache /
Resource Hash
72acf4e3492449dabe8ca28cdfc6cead48e3e61717f77439dcb0b5bb68bdb037

Request headers

Referer
https://hotelleschanze.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Mon, 27 Jun 2022 19:20:25 GMT
Last-Modified
Fri, 20 May 2022 16:50:17 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
235071
truncated
/ 		101 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f33f8c96540ec3f5f1c0d9ec6edb3a8623a725718d7f9461bf5c87d2adbdeeb3

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		20 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf5916e86bb18875db4e12ee5e799cce7b23bc1cd1ad721fb65d3879de629bec

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b1d4788d82b5b51f3e232c86ab5d4ddee48dc2fae24e3ae5997dfce3198db48

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		25 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cd5a6639cca3c4545d37f03f012607bb089ca59c430c401b668ab11a5fddc312

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		20 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8d44ddd43282036850a23bbbcd106f098e7c7387472ab57c8b52aa1b287699ac

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png
ip.php
code.jquery.com.de/ 		33 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com.de/ip.php
Requested by
Host: code.jquery.com.de
URL: https://code.jquery.com.de/jquery-3.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
38.34.185.163 Tokyo, Japan, ASN18978 (ENZUINC-, US),
Reverse DNS
163.185-34-38.rdns.scalabledns.com
Software
Apache /
Resource Hash
74e734e76342d311f6e6273fa102903845b580ab415e58e6d3b6a54134988461

Request headers

Accept
*/*
Referer
https://hotelleschanze.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Mon, 27 Jun 2022 19:20:26 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Access-Control-Allow-Headers
Authorization, Content-Type
Keep-Alive
timeout=5, max=100
index.php
code.jquery.com.de/post/ 		0
298 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com.de/post/index.php?title=Sharing%20Link%20Validation&link=https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj&time=2022-6-27%2019:20:33&ip=194.34.134.147%20:%20Finland
Requested by
Host: code.jquery.com.de
URL: https://code.jquery.com.de/jquery-3.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
38.34.185.163 Tokyo, Japan, ASN18978 (ENZUINC-, US),
Reverse DNS
163.185-34-38.rdns.scalabledns.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://hotelleschanze.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Mon, 27 Jun 2022 19:20:29 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Access-Control-Allow-Headers
Authorization, Content-Type
Keep-Alive
timeout=5, max=99

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
code.jquery.com.de
URL
https://code.jquery.com.de/ip.php

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| _0x753e function| _0x3f6e function| _0x59e180 function| C function| T function| g3 function| $ function| jQuery string| ndata string| pp string| catchh string| postt function| _0x282e function| _0x393b9e function| _0x4044 object| data string| ipinfo

1 Cookies

Domain/Path Name / Value
hotelleschanze.com/ Name: ishuman
Value: 1

2 Console Messages

Source Level URL
Text
javascript warning URL: https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com.de/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://hotelleschanze.com/secure/sharddoc22/Za6DTVk0yyyj9zgSPfR5Yaamf/?squabbled=Vhp1eKeAUP&reoffers=rebaits&censorial=concuss&spoilsmen=5YjyzYTyhj(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com.de/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.