web11220.web09.bero-webspace.de
Open in
urlscan Pro
45.82.121.115
Malicious Activity!
Public Scan
Effective URL: https://web11220.web09.bero-webspace.de/index.php
Submission: On July 14 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on July 11th 2023. Valid for: 3 months.
This is the only time web11220.web09.bero-webspace.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: International Card Services (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3036::6815:2c97 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
30 | 45.82.121.115 45.82.121.115 | 44486 (SYNLINQ s...) (SYNLINQ synlinq.de) | |
1 | 52.18.152.60 52.18.152.60 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 199.101.153.209 199.101.153.209 | 13713 (ARCOT) (ARCOT) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::2008 | 15169 (GOOGLE) (GOOGLE) | |
33 | 4 |
ASN44486 (SYNLINQ synlinq.de, DE)
PTR: web09.bero-host.de
web11220.web09.bero-webspace.de |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-152-60.eu-west-1.compute.amazonaws.com
w.usabilla.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
30 |
bero-webspace.de
web11220.web09.bero-webspace.de |
1 MB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 79 |
82 KB |
1 |
arcot.com
argus.arcot.com — Cisco Umbrella Rank: 854877 |
735 B |
1 |
usabilla.com
w.usabilla.com — Cisco Umbrella Rank: 4319 |
91 B |
1 |
bitly.lc
1 redirects
bitly.lc |
633 B |
33 | 5 |
Domain | Requested by | |
---|---|---|
30 | web11220.web09.bero-webspace.de |
web11220.web09.bero-webspace.de
|
1 | www.googletagmanager.com |
web11220.web09.bero-webspace.de
|
1 | argus.arcot.com | |
1 | w.usabilla.com |
web11220.web09.bero-webspace.de
|
1 | bitly.lc | 1 redirects |
33 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
icscards.nl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
web11220.web09.bero-webspace.de R3 |
2023-07-11 - 2023-10-09 |
3 months | crt.sh |
w.usabilla.com Amazon RSA 2048 M01 |
2023-02-09 - 2024-02-09 |
a year | crt.sh |
argus.arcot.com DigiCert EV RSA CA G2 |
2023-01-21 - 2024-01-23 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://web11220.web09.bero-webspace.de/index.php
Frame ID: ADE7C6E67F022F2053EC9A819225DF07
Requests: 32 HTTP requests in this frame
Frame:
https://w.usabilla.com/a1d53d1e874a.js?lv=1
Frame ID: DBD99929DD17A08ECA8219EB55719EA0
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Inloggen - Mijn ICS | International Card ServicesPage URL History Show full URLs
-
https://bitly.lc/aDGPb
HTTP 301
https://web11220.web09.bero-webspace.de/index.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Home
Search URL Search Domain Scan URL
Title: Nog geen gebruiker? Activeer nu Mijn ICS.
Search URL Search Domain Scan URL
Title: Inlognaam en/of wachtwoord vergeten?
Search URL Search Domain Scan URL
Title: Heeft u nog geen Card? Vraag er een aan!
Search URL Search Domain Scan URL
Title: Hoe werkt het?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bitly.lc/aDGPb
HTTP 301
https://web11220.web09.bero-webspace.de/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
web11220.web09.bero-webspace.de/ Redirect Chain
|
34 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-ics.css
web11220.web09.bero-webspace.de/SCI/ |
236 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plx.check.js
web11220.web09.bero-webspace.de/SCI/ |
425 B 433 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
web11220.web09.bero-webspace.de/SCI/ |
457 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conversion_async.js
web11220.web09.bero-webspace.de/SCI/ |
24 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
web11220.web09.bero-webspace.de/SCI/ |
44 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
web11220.web09.bero-webspace.de/SCI/ |
122 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8574.js
web11220.web09.bero-webspace.de/SCI/ |
16 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
web11220.web09.bero-webspace.de/SCI/ |
109 KB 109 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm_002.js
web11220.web09.bero-webspace.de/SCI/ |
136 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
web11220.web09.bero-webspace.de/SCI/ |
118 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arcotfpcollect.js
web11220.web09.bero-webspace.de/SCI/ |
33 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collectddna.js
web11220.web09.bero-webspace.de/SCI/ |
3 KB 1012 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
proxyid.js
web11220.web09.bero-webspace.de/SCI/ |
164 B 386 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.js
web11220.web09.bero-webspace.de/SCI/ |
1 KB 848 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a
web11220.web09.bero-webspace.de/SCI/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header1080.png
web11220.web09.bero-webspace.de/SCI/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
extra-veilig-inloggen.png
web11220.web09.bero-webspace.de/SCI/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer1080.png
web11220.web09.bero-webspace.de/SCI/ |
87 KB 88 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.js
web11220.web09.bero-webspace.de/SCI/ |
95 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main_002.js
web11220.web09.bero-webspace.de/SCI/ |
2 MB 436 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime.js
web11220.web09.bero-webspace.de/SCI/ |
1 KB 818 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfills.js
web11220.web09.bero-webspace.de/SCI/ |
107 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
web11220.web09.bero-webspace.de/SCI/ |
185 KB 51 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zero.png
web11220.web09.bero-webspace.de/SCI/ |
68 B 235 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.woff
web11220.web09.bero-webspace.de/SCI/ |
11 KB 11 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SunOT-Light.ttf
web11220.web09.bero-webspace.de/SCI/ |
84 KB 85 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SunOT-SemiBold.ttf
web11220.web09.bero-webspace.de/SCI/ |
84 KB 84 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SunOT-Regular.ttf
web11220.web09.bero-webspace.de/SCI/ |
84 KB 85 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ics-icons.woff2
web11220.web09.bero-webspace.de/SCI/ |
6 KB 7 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a1d53d1e874a.js
w.usabilla.com/ Frame DBD9 |
0 91 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zero.png
argus.arcot.com/img/ |
68 B 735 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
243 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: International Card Services (Financial)184 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 boolean| credentialless object| onbeforetoggle object| onscrollend function| PLX object| _rmclient_instance_ object| arcotrf number| FLASH_REQ_VERSION_MAJ number| FLASH_REQ_VERSION_MIN number| FLASH_REQ_VERSION_REV object| ca number| gmescDefaultNumberOfIterations number| gmescDefaultCalibrationDuration number| gmescDefaultIntervalDelay object| RMLogger boolean| flashLoaded function| flashReadyCallback function| checkFlashLoaded object| collectddna object| Modernizr function| $ function| jQuery function| GooglemKTybQhCsO function| google_trackConversion object| webpackJsonp object| google_tag_manager object| global_layer function| postscribe object| dataLayer object| AWIN object| Sha256 object| Utf8 object| ng object| __core-js_shared__ object| core function| Zone function| __zone_symbol__Promise function| __zone_symbol__ZoneAwarePromise function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononmessageerrorpatched object| __zone_symbol__loadfalse object| picturefillCFG function| picturefill object| google_tag_data function| ga object| gaplugins function| lightningjs function| usabilla_live object| cookieBarModule number| iForm function| onYouTubeIframeAPIReady object| __zone_symbol__resizefalse object| client number| endTime object| __zone_symbol__hashchangefalse object| __zone_symbol__popstatefalse function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bitly.lc/ | Name: PHPSESSID Value: m7m49euksu42pne6vf8o5el20m |
|
bitly.lc/ | Name: short_723 Value: 1 |
|
web11220.web09.bero-webspace.de/ | Name: PHPSESSID Value: utsta6dt2m8lvh86kbu8n0ol0n |
|
web11220.web09.bero-webspace.de/ | Name: did_proxy Value: 1:tjaKx95DWq5zldDPkqgrcAnX6H_aV7zrhaTmk-WoSAclmnzIIvOCPWRp-_G_ZQF_OBiNCHr_ShQWGCIVpLd05A |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
argus.arcot.com
bitly.lc
w.usabilla.com
web11220.web09.bero-webspace.de
www.googletagmanager.com
199.101.153.209
2606:4700:3036::6815:2c97
2a00:1450:4001:82f::2008
45.82.121.115
52.18.152.60
0c16a9ebdeb58f066530bd50b181bca55a605c4fff3ff24a9b52f4c31d42523b
0f2176aa1cc68c72cd2143aacf9bf008f8221e5018497b8670123c6094873851
117b360c8779ffa4fff52d37d282f4ea045dfa8207512b656f81212e98c07195
19297c9db1820584dcd8830b1dc06d16755349d437e541699077b70218235270
1c11d691d580caed671cf100123c4f001526db2b13ba43ae5e5dfdb8aeb1bc11
21caab764c78b5bef10d7d4d83c1a52c42aed38151c7ba791aad08c2bb416600
23b6fb0108b94d2d81693c51c160e6be5d60855078f0a042a13334e81b79dec9
26e6a7b3caf0b044980820a1a26cd56a16efad9108fd14e7416bae2a2b76320b
2f039fef043645c3c36431334f663a26a7b36733ffe6e8d2a1897a6b7d8d006a
3c17bc0dc32d0c5cf2fdacf76c4475a61cbe5b157cfc15d99ae285aee9b31320
49c58084e3de9827c78f7f032067a36de31c4262cf9944549d470888c61299a3
599c81fcee2bc4d5ad375e508e6c92ce3fe1095f4bac101835c9874c3383beee
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
69e81e13ae217c9a436756a0f91d43af57f3adb823ea36f94d33f03cb4694981
73279ccf74f3d699f8bdfb84362a371c02bdd334e62e32221f39e0e9f5542315
75af6860450b2595cd18ebad00dbf3927d9e494dfdbd12ceefcec15b2c03d84e
84429568eaf929acdbe3f6c648a77256fcff076b2c95d33f936cdfc15426b962
9933fba197b8b12d44ddc31fc7f327ef7fcac0e05630175446597e984c74776a
aa284b7e670155e3694ead1f34811106892c0469ef455c0e859a636f7930d47a
ad487b35eb35aa1b295cabd22782b8035fd3cde781b1a6c3ec532062fc800190
b515f45ebebfb0ee02c91385cb83e32dc0a92d2d13bc1f5d4b9924e33491d931
c167af5b56da7ade4885dd06171d75d05f265928bf8ec9b217d274a40c981d8e
c1f3874cc3f5467a309962d1f127dc7c0f5bfdba58e6084a779d4dacefcefb8d
c3b09cb485572507979b8d739c13086404da2199dd750f65f2014ba2877ab2b9
c68bbfd2d18e2ae77eb3f2ae219c566fb7d99523f120c5cab325c2281f3f7a0d
de33fe1ba0d81147fc56ff19149e85914d13c4c4d7a5969aeda463d9f4787848
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec9f3a937497958b3a9d4296eafc9b94b70a06d685ca02d65ac7daca456998c8
f178878e526f9c318bfc328469ee0774d0c7a308916f456fdc505776b2d8ed0f
f6d14a5c40a406c335c7aea3f6983070bb59111b470bdf39bd7e1c3f4618b9f4
ff0c5bae5b62334b18d5bc1a792b6a649d93a0c1bca980430c03ea72c859b563