zanbeel.com
Open in
urlscan Pro
162.241.219.146
Malicious Activity!
Public Scan
Effective URL: https://zanbeel.com/k781271r/status/repporte/index.php?cmd=_signin&dispatch=2a2177a0b1f88668438cdfa26&locale=en_
Submission: On September 17 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 17th 2021. Valid for: 3 months.
This is the only time zanbeel.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 1&1 Ionos (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.241.24.107 162.241.24.107 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
4 8 | 162.241.219.146 162.241.219.146 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
5 | 213.165.66.58 213.165.66.58 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
10 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5865.bluehost.com
www.oldps1.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5649.bluehost.com
zanbeel.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
zanbeel.com
4 redirects
zanbeel.com |
92 KB |
5 |
uicdn.net
ce1.uicdn.net |
256 KB |
1 |
oldps1.com
www.oldps1.com |
2 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
8 | zanbeel.com |
4 redirects
www.oldps1.com
zanbeel.com |
5 | ce1.uicdn.net |
zanbeel.com
|
1 | www.oldps1.com | |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
thezeplar.com R3 |
2021-08-17 - 2021-11-15 |
3 months | crt.sh |
ce1.uicdn.net GeoTrust RSA CA 2018 |
2020-03-03 - 2022-03-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://zanbeel.com/k781271r/status/repporte/index.php?cmd=_signin&dispatch=2a2177a0b1f88668438cdfa26&locale=en_
Frame ID: 8753C18D031528A0ADC3AE176A2C4E2B
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Sign inPage URL History Show full URLs
- http://www.oldps1.com/status/ Page URL
-
https://zanbeel.com/k781271r
HTTP 301
https://zanbeel.com/k781271r/ HTTP 302
https://zanbeel.com/k781271r/status HTTP 301
https://zanbeel.com/k781271r/status/ HTTP 302
https://zanbeel.com/k781271r/status/repporte/index.php?cmd=_signin&dispatch=2a2177a0b1f88668438c... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.oldps1.com/status/ Page URL
-
https://zanbeel.com/k781271r
HTTP 301
https://zanbeel.com/k781271r/ HTTP 302
https://zanbeel.com/k781271r/status HTTP 301
https://zanbeel.com/k781271r/status/ HTTP 302
https://zanbeel.com/k781271r/status/repporte/index.php?cmd=_signin&dispatch=2a2177a0b1f88668438cdfa26&locale=en_ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
www.oldps1.com/status/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.php
zanbeel.com/k781271r/status/repporte/ Redirect Chain
|
16 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
min.css
zanbeel.com/k781271r/status/repporte/images/ |
168 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigat.css
zanbeel.com/k781271r/status/repporte/images/ |
128 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
statuspage.css
zanbeel.com/k781271r/status/repporte/images/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 63 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
320 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
exos-icon-font.woff
ce1.uicdn.net/exos/icons/ |
48 KB 48 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-regular.woff
ce1.uicdn.net/exos/fonts/overpass/ |
42 KB 42 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-bold.woff
ce1.uicdn.net/exos/fonts/open-sans/ |
62 KB 62 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overpass-bold.woff
ce1.uicdn.net/exos/fonts/overpass/ |
41 KB 41 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 1&1 Ionos (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect boolean| originAgentCluster0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ce1.uicdn.net
www.oldps1.com
zanbeel.com
162.241.219.146
162.241.24.107
213.165.66.58
1f42844414cd770d774ca242545edd18a9c6cb25b9c0ac396954cce92e338ed2
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
7afccd9150b0fcbf1a1056e6cc6051c9b6d85a55da7bf1a7fb0f475c0b22facc
7d7a1a8ec55f31a6674fd2e2c41bcc6421a9aeb5cf161c6e93363f31347160f9
87ded158312b1e7d6cceb4ec41c823990295ce51e5c39b42f47538a91086ac1c
89c964e03155b72a17f17d877ce96b4644b6cfd4715bb0cf5032fc195aec0c0d
a2324d78fa23878b6ad03de16af33e37576a1b76e1d722c3822f8099ea17f9c0
b3277e70abe1446f00087e4c9b22dd32ff2c2273c0ca5df76dbdd913fdb06744
c8e1724edab4d29c68d698c71f04db98774a5ba4fb432e4d37bfb0beecdac987
d78e7ad4838a9fb4db11451b1db78ccd0b0c7b28f5787684ce2870918ce27bb5
d9f194d2930aaecac18b829d41805b327f50900197c56e42cc8989a032b1f2ff