spamblog.standardleitweg.de Open in urlscan Pro
2a03:4000:30:2449::10:9368 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://spamblog.standardleitweg.de/
Submission: On March 18 via automatic, source certstream-suspicious (March 18th 2020, 4:14:46 pm UTC)

Summary HTTP 14 Redirects Links 4 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2a03:4000:30:2449::10:9368, located in Germany and belongs to NETCUP-AS netcup GmbH, DE. The main domain is spamblog.standardleitweg.de.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 18th 2020. Valid for: 3 months.

This is the only time spamblog.standardleitweg.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
12	2a03:4000:30:... 2a03:4000:30:2449::10:9368		197540 (NETCUP-AS...) (NETCUP-AS netcup GmbH)
14	2

12 2a03:4000:30:2449::10:9368 (Germany)

ASN197540 (NETCUP-AS netcup GmbH, DE)

spamblog.standardleitweg.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stats.stdlw.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	standardleitweg.de spamblog.standardleitweg.de	68 KB
2	stdlw.de stats.stdlw.de	23 KB
14	2

	Domain	Requested by
10	spamblog.standardleitweg.de	spamblog.standardleitweg.de
2	stats.stdlw.de	spamblog.standardleitweg.de
14	2

This site contains links to these domains. Also see Links.

Domain
de.wikipedia.org
www.419eater.com
www.s9y.org
s9y.org

Subject Issuer	Validity	Valid
spamblog.standardleitweg.de Let's Encrypt Authority X3	`2020-01-18` - `2020-04-17`	3 months	crt.sh
stats.stdlw.de Let's Encrypt Authority X3	`2020-03-17` - `2020-06-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spamblog.standardleitweg.de/
Frame ID: 2C083532BF8068EC892774C2418EF459
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Serendipity (CMS) Expand

Overall confidence: 100%
Detected patterns

meta generator /Serendipity(?: v\.([\d.]+))?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

meta generator /Serendipity(?: v\.([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Matomo (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /piwik\.js|piwik\.php/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

79 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

91 kB
Transfer

237 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://de.wikipedia.org/wiki/Vorschussbetrug
Title: 419 Scam

Search URL Search Domain Scan URL

URL: http://www.419eater.com/
Title: 419Eater

Search URL Search Domain Scan URL

URL: http://www.s9y.org/
Title: Serendipity PHP Weblog

Search URL Search Domain Scan URL

URL: http://s9y.org/
Title: Serendipity

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response spamblog.standardleitweg.de/	44 KB 9 KB	417ms 397ms	Document text/html	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Full URL https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `97d79960edcb5e6f0535bf754e4609730cf49679700fd00959ae8e68a5d0bfed` Request headers :method GET :authority spamblog.standardleitweg.de :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 server nginx date Wed, 18 Mar 2020 16:14:26 GMT content-type text/html; charset=UTF-8 content-length 9267 x-session-reinit true cache-control private, pre-check=0, post-check=0, max-age=0 expires 0 pragma no-cache x-freetag-count Array set-cookie s9y_b698fb4f10bf5b77bb4962670efbe5f0=rbc27uu7mhsuq8envoid5o1v47; path=/; secure vary Accept-Encoding content-encoding gzip
GET H2	200	modernizr-2.7.1.min.js Show response spamblog.standardleitweg.de/templates/2k11/js/	7 KB 4 KB	72ms 71ms	Script application/javascript	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Full URL https://spamblog.standardleitweg.de/templates/2k11/js/modernizr-2.7.1.min.js Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `f834b461840f0ae383d8b18c06c7963f2185925ed1045a0f50dad6b7f79eb173` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 16:14:26 GMT content-encoding gzip last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag W/"5b16bd44-1ce8" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	jquery.js Show response spamblog.standardleitweg.de/templates/	95 KB 39 KB	161ms 160ms	Script application/javascript	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Full URL https://spamblog.standardleitweg.de/templates/jquery.js Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 16:14:26 GMT content-encoding gzip last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag W/"5b16bd44-17b8b" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	SPAM-KannManSelbstGestalten.png spamblog.standardleitweg.de/uploads/Spam/	5 KB 5 KB	105ms 105ms	Image image/png	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL https://spamblog.standardleitweg.de/uploads/Spam/SPAM-KannManSelbstGestalten.png Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `a7cebf8ee5b525bdab76604cb427ee5f408587359e6d6a780cfc1bcf9417cf71` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 16:14:26 GMT last-modified Fri, 12 Feb 2016 12:34:10 GMT server nginx etag "56bdd142-142e" content-type image/png status 200 accept-ranges bytes content-length 5166
GET H2	200	tongue.png spamblog.standardleitweg.de/plugins/serendipity_event_emoticate/img/emoticons/	571 B 722 B	106ms 105ms	Image image/png	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL https://spamblog.standardleitweg.de/plugins/serendipity_event_emoticate/img/emoticons/tongue.png Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `5518501a80e90597ba2a436c510b039ce73d81ea3aff93e470997938483b5416` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 16:14:26 GMT last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag "23b-56de7b97e7572" content-type image/png status 200 x-accel-version 0.01 accept-ranges bytes content-length 571
GET H2	200	smile.png spamblog.standardleitweg.de/plugins/serendipity_event_emoticate/img/emoticons/	556 B 707 B	60ms 60ms	Image image/png	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL https://spamblog.standardleitweg.de/plugins/serendipity_event_emoticate/img/emoticons/smile.png Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `7e170a3a7b23a1593a5018f30229812df2616d4c70277f58e9fe92ef54957850` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 16:14:26 GMT last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag "22c-56de7b97e7572" content-type image/png status 200 x-accel-version 0.01 accept-ranges bytes content-length 556
GET H/1.1	200 OK	blocked.gif spamblog.standardleitweg.de/uploads/	118 B 376 B	79ms 75ms	Image image/gif	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL http://spamblog.standardleitweg.de/uploads/blocked.gif Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol HTTP/1.1 Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `2af4c22b4490d9a598a3fee3b49d3f898feefb4cb6918f58b68a3d815439e9a8` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 18 Mar 2020 16:14:26 GMT Last-Modified Fri, 12 Feb 2016 12:34:09 GMT Server nginx ETag "76-52b91e2361240" Content-Type image/gif X-Accel-Version 0.01 Connection keep-alive Accept-Ranges bytes Content-Length 118
GET H2	200	xml.gif spamblog.standardleitweg.de/templates/2k11/img/	652 B 803 B	37ms 36ms	Image image/gif	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL https://spamblog.standardleitweg.de/templates/2k11/img/xml.gif Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `42d62d64c1fb9729713dd36039bc5efeacb8f3e599b7f44202bf66c3c0f92252` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 16:14:26 GMT last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag "28c-56de7b98059d2" content-type image/gif status 200 x-accel-version 0.01 accept-ranges bytes content-length 652
GET H2	200	subtome.png spamblog.standardleitweg.de/templates/2k11/img/	2 KB 2 KB	28ms 27ms	Image image/png	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL https://spamblog.standardleitweg.de/templates/2k11/img/subtome.png Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `ab449915b6079d95ab07a53d34bad4d6dd3a74fa8a179fd7a4dc30cc35e8a8e6` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 16:14:26 GMT last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag "5b16bd44-90f" content-type image/png status 200 accept-ranges bytes content-length 2319
GET H2	200	2k11.min.js Show response spamblog.standardleitweg.de/templates/2k11/js/	14 KB 7 KB	60ms 60ms	Script application/javascript	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Full URL https://spamblog.standardleitweg.de/templates/2k11/js/2k11.min.js Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `fe8871de554fdbff99dbacd642bb6c7f5b6cd3ae577c1828e0be0aa6a3988336` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 16:14:26 GMT content-encoding gzip last-modified Tue, 05 Jun 2018 16:41:40 GMT server nginx etag W/"5b16bd44-39df" vary Accept-Encoding content-type application/javascript status 200
GET		index.php spamblog.standardleitweg.de/	0 0

GET H2	200	piwik.js Show response stats.stdlw.de/piwik/	67 KB 23 KB	60ms 28ms	Script application/javascript	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Full URL https://stats.stdlw.de/piwik/piwik.js Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `b52608eb90130f261d38507f7445e73f9c54fde9b481d23f1987bafd1ed5090a` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 16:14:26 GMT content-encoding gzip last-modified Wed, 18 Mar 2020 07:13:31 GMT server nginx etag "10d63-5a11bca273c36-gzip" vary Accept-Encoding content-type application/javascript status 200 accept-ranges bytes content-length 23358
GET		index.php spamblog.standardleitweg.de/	0 0

GET H2	200	piwik.php stats.stdlw.de/piwik/	43 B 119 B	698ms 697ms	Image image/gif	2a03:4000:30:2449::10:9368 NETCUP-AS netcup ...
General Check archive.org Show headers Download Go to Show image Full URL https://stats.stdlw.de/piwik/piwik.php?action_name=Das%20Spam%20Blog&idsite=9&rec=1&r=520387&h=17&m=14&s=26&url=https%3A%2F%2Fspamblog.standardleitweg.de%2F&_id=981a89adbe48f50e&_idts=1584548067&_idvc=1&_idn=0&_refts=0&_viewts=1584548067&send_image=1&cookie=1&res=1600x1200&gt_ms=398&pv_id=s4YF75 Requested by Host: spamblog.standardleitweg.de URL: https://spamblog.standardleitweg.de/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a03:4000:30:2449::10:9368 , Germany, ASN197540 (NETCUP-AS netcup GmbH, DE), Reverse DNS Software nginx / Resource Hash `548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87` Request headers Referer https://spamblog.standardleitweg.de/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers status 200 date Wed, 18 Mar 2020 16:14:27 GMT cache-control no-store server nginx content-type image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: spamblog.standardleitweg.de
URL: http://spamblog.standardleitweg.de/index.php?/serendipity.css&v=

Domain: spamblog.standardleitweg.de
URL: http://spamblog.standardleitweg.de/index.php?/serendipity.js&v=

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| Modernizr object| html5 undefined| $ function| jQuery object| _paq function| AccessifyHTML5 object| respond object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			spamblog.standardleitweg.de/	1970-01-19 08:09:09	Name: _pk_ses.9.655b Value: 1
			spamblog.standardleitweg.de/	1970-01-19 17:35:03	Name: _pk_id.9.655b Value: 981a89adbe48f50e.1584548067.1.1584548067.1584548067.
			spamblog.standardleitweg.de/	1969-12-31 23:59:59	Name: s9y_b698fb4f10bf5b77bb4962670efbe5f0 Value: rbc27uu7mhsuq8envoid5o1v47

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spamblog.standardleitweg.de
stats.stdlw.de
spamblog.standardleitweg.de
2a03:4000:30:2449::10:9368
2af4c22b4490d9a598a3fee3b49d3f898feefb4cb6918f58b68a3d815439e9a8
42d62d64c1fb9729713dd36039bc5efeacb8f3e599b7f44202bf66c3c0f92252
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5518501a80e90597ba2a436c510b039ce73d81ea3aff93e470997938483b5416
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7e170a3a7b23a1593a5018f30229812df2616d4c70277f58e9fe92ef54957850
97d79960edcb5e6f0535bf754e4609730cf49679700fd00959ae8e68a5d0bfed
a7cebf8ee5b525bdab76604cb427ee5f408587359e6d6a780cfc1bcf9417cf71
ab449915b6079d95ab07a53d34bad4d6dd3a74fa8a179fd7a4dc30cc35e8a8e6
b52608eb90130f261d38507f7445e73f9c54fde9b481d23f1987bafd1ed5090a
f834b461840f0ae383d8b18c06c7963f2185925ed1045a0f50dad6b7f79eb173
fe8871de554fdbff99dbacd642bb6c7f5b6cd3ae577c1828e0be0aa6a3988336