s3.ap-southeast-1.wasabisys.com Open in urlscan Pro
154.18.200.11 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.nustarenerqy.com/#redacted@abuse.ionos.com
Effective URL:
https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Submission: On March 02 via automatic, source phishtank (March 2nd 2023, 1:54:19 pm UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 154.18.200.11, located in United States and belongs to BLUEARCHIVE-ZONE-1, US. The main domain is s3.ap-southeast-1.wasabisys.com. The Cisco Umbrella rank of the primary domain is 834795.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on April 26th 2022. Valid for: a year.

This is the only time s3.ap-southeast-1.wasabisys.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 1&1 Ionos (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3036::ac43:bb37	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	154.18.200.11 154.18.200.11	395717 (BLUEARCHI...) (BLUEARCHIVE-ZONE-1)
6	213.165.66.58 213.165.66.58	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	74.208.255.201 74.208.255.201	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
2	217.160.86.61 217.160.86.61	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
11	6

1 2606:4700:3036::ac43:bb37 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.nustarenerqy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.18.200.11 (United States)

ASN395717 (BLUEARCHIVE-ZONE-1, US)

s3.ap-southeast-1.wasabisys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 213.165.66.58 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: ce1.uicdn.net

ce1.uicdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.208.255.201 (Norwalk, United States)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: mail.ionos.com

mail.ionos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.160.86.61 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: frontend-services.ionos.com

frontend-services.ionos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	uicdn.net ce1.uicdn.net — Cisco Umbrella Rank: 104044	291 KB
3	ionos.com mail.ionos.com — Cisco Umbrella Rank: 352406 frontend-services.ionos.com — Cisco Umbrella Rank: 93898	38 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 693	30 KB
1	wasabisys.com s3.ap-southeast-1.wasabisys.com — Cisco Umbrella Rank: 834795	328 KB
1	nustarenerqy.com 1 redirects www.nustarenerqy.com	778 B
11	5

	Domain	Requested by
6	ce1.uicdn.net	s3.ap-southeast-1.wasabisys.com ce1.uicdn.net
2	frontend-services.ionos.com	s3.ap-southeast-1.wasabisys.com
1	code.jquery.com	s3.ap-southeast-1.wasabisys.com
1	mail.ionos.com	s3.ap-southeast-1.wasabisys.com
1	s3.ap-southeast-1.wasabisys.com
1	www.nustarenerqy.com	1 redirects
11	6

This site contains links to these domains. Also see Links.

Domain
www.ionos.com
ias.ionos.com
my.ionos.com
hidrive.ionos.com
archive.ionos.com
www.ionos-status.com

Subject Issuer	Validity	Valid
*.s3.ap-southeast-1.wasabisys.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-26` - `2023-04-26`	a year	crt.sh
ce1.uicdn.net GeoTrust RSA CA 2018	`2022-03-01` - `2023-03-10`	a year	crt.sh
mail.ionos.com GeoTrust EV RSA CA 2018	`2022-09-30` - `2023-10-11`	a year	crt.sh
frontend-services.ionos.com GeoTrust RSA CA 2018	`2022-05-31` - `2023-05-31`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Frame ID: ED42DD48986913A5070B980B14754478
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.nustarenerqy.com/ HTTP 301
https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

687 kB
Transfer

1046 kB
Size

0
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ionos.com/
Title: Webmail

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2327&utm_term=2327&utm_campaign=forgotpw&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=4083&utm_term=4083&utm_campaign=staysignedin&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=flyin
Title: Remember me

Search URL Search Domain Scan URL

URL: https://ias.ionos.com/ias/follow/CLICK?ias_source=WEBMAILER-US&ias_medium=login-webmailer_login&ias_content=WEBMAIL_LOGIN_TEASER_MAIL_ARCHIVING-DEFAULT&ias_campaign=&target=https%3A%2F%2Fwww.ionos.com%2Foffice-solutions%2Femail-archiving-bk%3Fac%3DOM.US.US263K417283T7073a
Title: Learn more

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2442&utm_term=2442&utm_campaign=mobile-ios&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=article
Title: iOS

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2444&utm_term=2444&utm_campaign=mobile-android&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=article
Title: Android

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2436&utm_term=2436&utm_campaign=desktop-thunderbird&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=article
Title: Thunderbird

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2462&utm_term=2462&utm_campaign=desktop-outlook&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=article
Title: Outlook

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2445&utm_term=2445&utm_campaign=desktop-applemail&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=article
Title: Apple Mail

Search URL Search Domain Scan URL

URL: https://www.ionos.com/help/index.php?id=2490&utm_term=2490&utm_campaign=other-assistants&utm_medium=help-and-learn&utm_source=login_frontend_hosting&utm_content=article
Title: email programs (POP/IMAP)

Search URL Search Domain Scan URL

URL: https://my.ionos.com/
Title: My IONOS

Search URL Search Domain Scan URL

URL: https://hidrive.ionos.com/
Title: HiDrive

Search URL Search Domain Scan URL

URL: https://archive.ionos.com/
Title: Email archiving

Search URL Search Domain Scan URL

URL: https://www.ionos-status.com/?utm_medium=footer&utm_content=none&utm_source=WEBMAIL_LOGIN&utm_campaign=login&utm_term=no_search
Title: All Systems Operational

Search URL Search Domain Scan URL

URL: https://www.ionos.com/about
Title: 1&1 IONOS Inc. %2 2020

Search URL Search Domain Scan URL

URL: https://www.ionos.com/terms-gtc/terms-privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.nustarenerqy.com/ HTTP 301
https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request INBOX.html Show response
s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/
Redirect Chain

http://www.nustarenerqy.com/
https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html

328 KB
328 KB

527ms
171ms

Document
text/html

154.18.200.11
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 154.18.200.11 , United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.12.1004-2023-02-17-7ff2f5bdd9 (head2) /
Resource Hash: 2b114465a2dad95292096bc6d727759d4caaed0079d63261bdf84cfef97c208f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Content-Length: 335651
Content-Type: text/html
Date: Thu, 02 Mar 2023 13:54:14 GMT
ETag: "1d6bc50c04bf00db8538863701613572"
Last-Modified: Tue, 31 Jan 2023 10:56:07 GMT
Server: WasabiS3/7.12.1004-2023-02-17-7ff2f5bdd9 (head2)
x-amz-id-2: 2Rxu81/5sPGhkIodXQrYGb3+wkK0pBqOPwPa9ALBg2IDq6DTh817Q5cTqa/emufD4Tk0rp21wopk
x-amz-request-id: 60673B9D4A90C17D

Redirect headers

CF-RAY: 7a1a21635c3c37da-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Thu, 02 Mar 2023 13:54:13 GMT
Expires: Thu, 02 Mar 2023 14:54:13 GMT
Location: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aE2ZtxNRzZG20RbAz5FiChG8BnGXBXPNXiOLSJjZoswRX4cCkTc0fZDnHEbicc9h476is5aUmwO29Oog7wF%2Fnlt0JJtgGt9H3CeDzsuacJyd0fsr2BVsr4J4ZJXzjwfBhUj5bqrKXc4kpNoZ2fHPL8T%2BPg%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 ionos.min.css
ce1.uicdn.net/exos/framework/1.1/ 227 KB
32 KB 41ms
18ms Stylesheet
text/css 213.165.66.58
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Requested by: Host: s3.ap-southeast-1.wasabisys.com
URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.165.66.58 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: ce1.uicdn.net
Software: Apache /
Resource Hash: 78023966447841c215d32c32def810e2aa63578e36c9783b785a1667fb2c2ab7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s3.ap-southeast-1.wasabisys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:54:14 GMT
content-encoding: br
last-modified: Mon, 21 Mar 2022 11:53:00 GMT
server: Apache
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=43200, public
accept-ranges: bytes
content-length: 32819
expires: Fri, 01 Mar 2024 05:19:28 GMT

GET
H/1.1 200
OK login.min.css
mail.ionos.com/css/ 15 KB
8 KB 418ms
133ms Stylesheet
text/css 74.208.255.201
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.ionos.com/css/login.min.css?v=1579862045214

Requested by

Host: s3.ap-southeast-1.wasabisys.com
URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

74.208.255.201 Norwalk, United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),

Reverse DNS

mail.ionos.com

Software

Apache/2.4.38 (Debian) /

Resource Hash

9d27c279b8aef5083f4720d71b79ba18519d3f924955d7338932a5252555b669

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .schlund.de .uicdn.net .statuspage.io .ionos.de .ionos.co.uk .ionos.com .ionos.es .ionos.mx .ionos.fr .ionos.it .ionos.ca; img-src data: 'self' .schlund.de .uicdn.net .ionos.de .ionos.co.uk .ionos.com .ionos.es .ionos.mx .ionos.fr .ionos.it .ionos.ca; frame-src 'self' .ionos.de .ionos.co.uk .ionos.com .ionos.es .ionos.mx .ionos.fr .ionos.it .ionos.ca; style-src 'self' 'unsafe-inline' .schlund.de .uicdn.net .ionos.de .ionos.co.uk .ionos.com .ionos.es .ionos.mx .ionos.fr .ionos.it *.ionos.ca; object-src 'none';
Strict-Transport-Security	max-age=31556926
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s3.ap-southeast-1.wasabisys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 13:54:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' *.schlund.de *.uicdn.net *.statuspage.io *.ionos.de *.ionos.co.uk *.ionos.com *.ionos.es *.ionos.mx *.ionos.fr *.ionos.it *.ionos.ca; img-src data: 'self' *.schlund.de *.uicdn.net *.ionos.de *.ionos.co.uk *.ionos.com *.ionos.es *.ionos.mx *.ionos.fr *.ionos.it *.ionos.ca; frame-src 'self' *.ionos.de *.ionos.co.uk *.ionos.com *.ionos.es *.ionos.mx *.ionos.fr *.ionos.it *.ionos.ca; style-src 'self' 'unsafe-inline' *.schlund.de *.uicdn.net *.ionos.de *.ionos.co.uk *.ionos.com *.ionos.es *.ionos.mx *.ionos.fr *.ionos.it *.ionos.ca; object-src 'none';
Strict-Transport-Security: max-age=31556926
Connection: keep-alive
Content-Length: 6702
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 15 Feb 2023 10:09:51 GMT
Server: Apache/2.4.38 (Debian)
ETag: "3cd3-5f4ba47e779c0-gzip"
Vary: Accept-Encoding,User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=86400
Accept-Ranges: bytes
Keep-Alive: timeout=15
Expires: Fri, 03 Mar 2023 13:54:15 GMT

GET
H/1.1 200
200 navigation.css
frontend-services.ionos.com/t/navi/css/ 115 KB
29 KB 75ms
16ms Stylesheet
text/css 217.160.86.61
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://frontend-services.ionos.com/t/navi/css/navigation.css?v=3.17.10-20200622-163115
Requested by: Host: s3.ap-southeast-1.wasabisys.com
URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 217.160.86.61 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: frontend-services.ionos.com
Software: Apache /
Resource Hash: e613bd3ebc70c07887ee04409aa739d54f58b53933caf3147a20865ed2324f4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s3.ap-southeast-1.wasabisys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 13:54:14 GMT
Content-Encoding: gzip
Last-Modified: Sat, 26 Oct 1985 07:15:00 GMT
Server: Apache
ETag: W/"117539-499158900000-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: public, max-age=86400, s-maxage=900
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
200 statuspage.css
frontend-services.ionos.com/t/statuspage/css/ 5 KB
1 KB 76ms
17ms Stylesheet
text/css 217.160.86.61
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://frontend-services.ionos.com/t/statuspage/css/statuspage.css?v=1.5.0
Requested by: Host: s3.ap-southeast-1.wasabisys.com
URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 217.160.86.61 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: frontend-services.ionos.com
Software: Apache /
Resource Hash: 394cb290159c07321f7cc6dfe7788ea8837c7d41e95bbaff755813b93c91de49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s3.ap-southeast-1.wasabisys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 13:54:14 GMT
Content-Encoding: gzip
Last-Modified: Sat, 26 Oct 1985 07:15:00 GMT
Server: Apache
ETag: W/"4695-499158900000-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: public, max-age=86400, s-maxage=900
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 70ms
23ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: s3.ap-southeast-1.wasabisys.com
URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://s3.ap-southeast-1.wasabisys.com/
Origin: https://s3.ap-southeast-1.wasabisys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 02 Mar 2023 13:54:14 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d84"
vary: Accept-Encoding
x-hw: 1677765254.dop259.am5.t,1677765254.cds123.am5.hn,1677765254.cds312.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H2 200 opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/ 62 KB
63 KB 29ms
12ms Font
application/font-woff 213.165.66.58
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ce1.uicdn.net/exos/fonts/open-sans/opensans-regular.woff
Requested by: Host: ce1.uicdn.net
URL: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.165.66.58 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: ce1.uicdn.net
Software: Apache /
Resource Hash: 2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b

Request headers

Referer: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Origin: https://s3.ap-southeast-1.wasabisys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:54:15 GMT
last-modified: Tue, 12 Jun 2018 09:26:07 GMT
server: Apache
x-cache-status: HIT
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 63712
expires: Fri, 09 Feb 2024 10:09:35 GMT

GET
DATA 200
OK truncated
/ 251 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e429904c596758c38b6110935a28e2769b7b5aa73033d8e7c18319cb84c7c461

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 exos-icon-font.woff
ce1.uicdn.net/exos/icons/ 50 KB
50 KB 53ms
43ms Font
application/font-woff 213.165.66.58
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ce1.uicdn.net/exos/icons/exos-icon-font.woff?v=13
Requested by: Host: ce1.uicdn.net
URL: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.165.66.58 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: ce1.uicdn.net
Software: Apache /
Resource Hash: 35538b399f40d6db114f64b970fb8a612d88d833906f95f4cb8675c0277ecfb3

Request headers

Referer: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Origin: https://s3.ap-southeast-1.wasabisys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:54:15 GMT
last-modified: Fri, 05 Aug 2022 04:39:12 GMT
server: Apache
x-cache-status: HIT
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 50688
expires: Fri, 09 Feb 2024 10:09:35 GMT

GET
H2 200 overpass-regular.woff
ce1.uicdn.net/exos/fonts/overpass/ 42 KB
42 KB 42ms
32ms Font
application/font-woff 213.165.66.58
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ce1.uicdn.net/exos/fonts/overpass/overpass-regular.woff
Requested by: Host: ce1.uicdn.net
URL: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.165.66.58 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: ce1.uicdn.net
Software: Apache /
Resource Hash: d78e7ad4838a9fb4db11451b1db78ccd0b0c7b28f5787684ce2870918ce27bb5

Request headers

Referer: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Origin: https://s3.ap-southeast-1.wasabisys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:54:15 GMT
last-modified: Tue, 12 Jun 2018 09:26:06 GMT
server: Apache
x-cache-status: HIT
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 42580
expires: Fri, 09 Feb 2024 10:09:35 GMT

GET
H2 200 opensans-bold.woff
ce1.uicdn.net/exos/fonts/open-sans/ 62 KB
62 KB 31ms
22ms Font
application/font-woff 213.165.66.58
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ce1.uicdn.net/exos/fonts/open-sans/opensans-bold.woff
Requested by: Host: ce1.uicdn.net
URL: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.165.66.58 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: ce1.uicdn.net
Software: Apache /
Resource Hash: 7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9

Request headers

Referer: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Origin: https://s3.ap-southeast-1.wasabisys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:54:15 GMT
last-modified: Tue, 12 Jun 2018 09:26:07 GMT
server: Apache
x-cache-status: HIT
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 63564
expires: Fri, 09 Feb 2024 10:09:35 GMT

GET
H2 200 overpass-bold.woff
ce1.uicdn.net/exos/fonts/overpass/ 41 KB
41 KB 62ms
53ms Font
application/font-woff 213.165.66.58
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://ce1.uicdn.net/exos/fonts/overpass/overpass-bold.woff
Requested by: Host: ce1.uicdn.net
URL: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 213.165.66.58 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: ce1.uicdn.net
Software: Apache /
Resource Hash: 7afccd9150b0fcbf1a1056e6cc6051c9b6d85a55da7bf1a7fb0f475c0b22facc

Request headers

Referer: https://ce1.uicdn.net/exos/framework/1.1/ionos.min.css?v=1579862045214
Origin: https://s3.ap-southeast-1.wasabisys.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:54:15 GMT
last-modified: Tue, 12 Jun 2018 09:26:06 GMT
server: Apache
x-cache-status: HIT
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 42092
expires: Fri, 09 Feb 2024 10:09:35 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 23e0cb055625e782416f459f380c216bf14ae15c191c9e1de7dc4dd7bc648359

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ea897ce746ac3177faaf6be44aa8ea6129a39220bdf122d9973113ae77c8a7a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1&1 Ionos (Telecommunication)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://s3.ap-southeast-1.wasabisys.com/policies/appsuite/tlyappioox/mailfolderdefault0/INBOX.html(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ce1.uicdn.net
code.jquery.com
frontend-services.ionos.com
mail.ionos.com
s3.ap-southeast-1.wasabisys.com
www.nustarenerqy.com
154.18.200.11
2001:4de0:ac18::1:a:1a
213.165.66.58
217.160.86.61
2606:4700:3036::ac43:bb37
74.208.255.201
1ea897ce746ac3177faaf6be44aa8ea6129a39220bdf122d9973113ae77c8a7a
23e0cb055625e782416f459f380c216bf14ae15c191c9e1de7dc4dd7bc648359
2b114465a2dad95292096bc6d727759d4caaed0079d63261bdf84cfef97c208f
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
35538b399f40d6db114f64b970fb8a612d88d833906f95f4cb8675c0277ecfb3
394cb290159c07321f7cc6dfe7788ea8837c7d41e95bbaff755813b93c91de49
78023966447841c215d32c32def810e2aa63578e36c9783b785a1667fb2c2ab7
7afccd9150b0fcbf1a1056e6cc6051c9b6d85a55da7bf1a7fb0f475c0b22facc
7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9
9d27c279b8aef5083f4720d71b79ba18519d3f924955d7338932a5252555b669
d78e7ad4838a9fb4db11451b1db78ccd0b0c7b28f5787684ce2870918ce27bb5
e429904c596758c38b6110935a28e2769b7b5aa73033d8e7c18319cb84c7c461
e613bd3ebc70c07887ee04409aa739d54f58b53933caf3147a20865ed2324f4e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

s3.ap-southeast-1.wasabisys.com Open in urlscan Pro 154.18.200.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

5 Domains

6 Subdomains

6 IPs

3 Countries

687 kBTransfer

1046 kBSize

0 Cookies

16 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

s3.ap-southeast-1.wasabisys.com Open in urlscan Pro
154.18.200.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

687 kB
Transfer

1046 kB
Size

0
Cookies

11 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!