URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Submission Tags: @phish_report
Submission: On April 16 via api from FI — Scanned from FI

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 77.222.40.254, located in Russian Federation and belongs to SWEB-AS, RU. The main domain is webmailun7.temp.swtest.ru.
This is the only time webmailun7.temp.swtest.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 77.222.40.254 44112 (SWEB-AS)
7 2a00:a200:0:2... 5520 (UNI-KOELN)
9 2
Apex Domain
Subdomains
Transfer
7 uni-koeln.de
webmail.uni-koeln.de
90 KB
3 swtest.ru
webmailun7.temp.swtest.ru
3 KB
9 2
Domain Requested by
7 webmail.uni-koeln.de webmailun7.temp.swtest.ru
webmail.uni-koeln.de
3 webmailun7.temp.swtest.ru 1 redirects webmailun7.temp.swtest.ru
9 2

This site contains links to these domains. Also see Links.

Domain
matomo.rrz.uni-koeln.de
portal.uni-koeln.de
Subject Issuer Validity Valid
webmail.uni-koeln.de
GEANT OV ECC CA 4
2023-06-23 -
2024-06-22
a year crt.sh

This page contains 1 frames:

Primary Page: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Frame ID: F494BBE9F72A2CBDA7C6FF53B66B6A8B
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Horde :: Anmelden

Page URL History Show full URLs

  1. http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html HTTP 307
    https://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html HTTP 302
    http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html HTTP 307
    http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html Page URL

Page Statistics

9
Requests

78 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

93 kB
Transfer

276 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html HTTP 307
    https://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html HTTP 302
    http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html HTTP 307
    http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.html
webmailun7.temp.swtest.ru/webmail.uni-koeln.de/
Redirect Chain
  • http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
  • https://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
  • http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
  • http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
7 KB
3 KB
Document
General
Full URL
http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Server
77.222.40.254 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS
vh307.sweb.ru
Software
nginx/1.25.4 /
Resource Hash
32f01024f47f203d4eeb5789b2c1912c488165a4cdeeb1f460e5bc74dbbd782c

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Tue, 16 Apr 2024 12:08:12 GMT
ETag
W/"76847f7-1a8e-616256b52f16f"
Keep-Alive
timeout=10
Last-Modified
Mon, 15 Apr 2024 16:50:30 GMT
Server
nginx/1.25.4
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

Location
http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Non-Authoritative-Reason
HttpsUpgrades
c392ea3470999e0655.css
webmail.uni-koeln.de/static/
77 KB
8 KB
Stylesheet
General
Full URL
https://webmail.uni-koeln.de/static/c392ea3470999e0655.css
Requested by
Host: webmailun7.temp.swtest.ru
URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
319df601d1b9a2a6d807fee8a0ef9418ba974ad7a821c9fd2907f90d9b5534e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
http://webmailun7.temp.swtest.ru/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 02:34:50 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
age
34402
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-length
7584
referrer-policy
strict-origin
last-modified
Mon, 15 Apr 2024 06:29:17 GMT
server
Apache/2.4
etag
"133a8-6161cbda96fc9-br"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=600
accept-ranges
bytes
expires
Tue, 16 Apr 2024 02:44:50 GMT
UzK_mittel_4iSHSdCjyde.png
webmail.uni-koeln.de/themes/unikoeln/graphics/
26 KB
27 KB
Image
General
Full URL
https://webmail.uni-koeln.de/themes/unikoeln/graphics/UzK_mittel_4iSHSdCjyde.png
Requested by
Host: webmailun7.temp.swtest.ru
URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
e555413030f5f13d65169ed40dc9fc515b790fd9437d8f4e581d769052fd1253
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
http://webmailun7.temp.swtest.ru/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 02:31:50 GMT
strict-transport-security
max-age=31536000
referrer-policy
strict-origin
x-content-type-options
nosniff
last-modified
Thu, 28 Jan 2021 18:28:53 GMT
server
Apache/2.4
age
34582
etag
"67ef-5b9fa0f5885b7"
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
26607
expires
Wed, 16 Apr 2025 02:31:50 GMT
tracking.js
webmail.uni-koeln.de/static/matomo/
318 B
866 B
Script
General
Full URL
https://webmail.uni-koeln.de/static/matomo/tracking.js
Requested by
Host: webmailun7.temp.swtest.ru
URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
498e596f0e8a1bff507a031c2b445e29b30568eb744c12728ac7c272aaf68593
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
http://webmailun7.temp.swtest.ru/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 02:12:56 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
age
35716
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-length
154
referrer-policy
strict-origin
last-modified
Thu, 04 Feb 2021 19:44:29 GMT
server
Apache/2.4
etag
"13e-5ba87ee8d4191-br"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
expires
Thu, 16 May 2024 02:12:56 GMT
matomo.js
webmailun7.temp.swtest.ru/matomo.rrz.uni-koeln.de/
0
0
Script
General
Full URL
http://webmailun7.temp.swtest.ru/matomo.rrz.uni-koeln.de/matomo.js
Requested by
Host: webmailun7.temp.swtest.ru
URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Server
77.222.40.254 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS
vh307.sweb.ru
Software
nginx/1.25.4 /
Resource Hash

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Referer
http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Date
Tue, 16 Apr 2024 12:08:13 GMT
Content-Encoding
gzip
Server
nginx/1.25.4
Transfer-Encoding
chunked
Vary
Accept-Encoding, accept-language,accept-charset
Content-Language
en
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
Keep-Alive
timeout=10
6a3d48db11507824.js
webmail.uni-koeln.de/static/
149 KB
37 KB
Script
General
Full URL
https://webmail.uni-koeln.de/static/6a3d48db11507824.js
Requested by
Host: webmailun7.temp.swtest.ru
URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
8b4fb80829f0780d4ea0fb0bec39449a7b6e64103502c1d2e7fc10966f5e8c24
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
http://webmailun7.temp.swtest.ru/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 02:56:47 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
age
33085
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-length
36995
referrer-policy
strict-origin
last-modified
Thu, 11 Apr 2024 22:19:01 GMT
server
Apache/2.4
etag
"25233-615d98ad25b85-br"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
expires
Thu, 16 May 2024 02:56:47 GMT
a52a036c4471c32b.js
webmail.uni-koeln.de/static/
3 KB
2 KB
Script
General
Full URL
https://webmail.uni-koeln.de/static/a52a036c4471c32b.js
Requested by
Host: webmailun7.temp.swtest.ru
URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
525e3ca778d8d47da9c2283a51915c7669141557e62f970adc0ca714de3e3b02
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
http://webmailun7.temp.swtest.ru/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 03:06:52 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
age
32480
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-length
1196
referrer-policy
strict-origin
last-modified
Thu, 11 Apr 2024 22:19:01 GMT
server
Apache/2.4
etag
"c49-615d98ad295e1-br"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
accept-ranges
bytes
expires
Thu, 16 May 2024 03:06:52 GMT
button-default.png
webmail.uni-koeln.de/themes/unikoeln/graphics/
87 B
737 B
Image
General
Full URL
https://webmail.uni-koeln.de/themes/unikoeln/graphics/button-default.png
Requested by
Host: webmail.uni-koeln.de
URL: https://webmail.uni-koeln.de/static/c392ea3470999e0655.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
66d26930f75f18c4c1880eef974e444857e7ff1e9e74fb34860fa2e7f7d3ba13
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://webmail.uni-koeln.de/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 02:43:08 GMT
strict-transport-security
max-age=31536000
referrer-policy
strict-origin
x-content-type-options
nosniff
last-modified
Wed, 13 May 2015 16:54:41 GMT
server
Apache/2.4
age
33905
etag
"57-515f977a45d60"
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
87
expires
Wed, 16 Apr 2025 02:43:08 GMT
favicon.ico
webmail.uni-koeln.de/themes/unikoeln/graphics/
15 KB
15 KB
Other
General
Full URL
https://webmail.uni-koeln.de/themes/unikoeln/graphics/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:a200:0:2::d00f Cologne, Germany, ASN5520 (UNI-KOELN, DE),
Reverse DNS
Software
Apache/2.4 /
Resource Hash
7846b5c1879b010fa236e8cd99bb689b646cbec12b6f36503e861dd6ca685dae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
http://webmailun7.temp.swtest.ru/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 02:42:54 GMT
strict-transport-security
max-age=31536000
referrer-policy
strict-origin
x-content-type-options
nosniff
last-modified
Tue, 07 Jul 2015 14:41:49 GMT
server
Apache/2.4
age
33919
etag
"3aee-51a4a05b1e540"
content-security-policy-report-only
default-src 'self'; connect-src 'self' https://matomo.rrz.uni-koeln.de:443; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://matomo.rrz.uni-koeln.de:443; img-src 'self' data:
content-type
image/vnd.microsoft.icon
cache-control
max-age=31536000
accept-ranges
bytes
content-length
15086
expires
Wed, 16 Apr 2025 02:42:54 GMT

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| idSite string| matomoTrackingApiUrl object| _paq object| Prototype object| Class function| PeriodicalExecuter function| Template object| $break object| Enumerable function| $A function| $w function| $H function| Hash function| $R function| ObjectRange object| Abstract object| Try object| Ajax object| Form object| Field function| $F object| Toggle object| Insertion object| $continue object| Position function| $ function| $$ undefined| Sizzle function| Selector object| HordeLogin object| AccessKeys

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: http://webmailun7.temp.swtest.ru/matomo.rrz.uni-koeln.de/matomo.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
recommendation verbose URL: http://webmailun7.temp.swtest.ru/webmail.uni-koeln.de/login.html
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o