urlscan.io logo urlscan.io
SecurityTrails logo

healthwithshak.com Open in urlscan Pro
92.204.215.7  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://techpoweredm.com/images/1/
Effective URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Submission: On May 11 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 15 HTTP transactions. The main IP is 92.204.215.7, located in Strasbourg, France and belongs to GODADDY-SXB, DE. The main domain is healthwithshak.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on August 23rd 2022. Valid for: a year.
This is the only time healthwithshak.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Postbank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 46.105.201.240 16276 (OVH)
1 54.39.156.32 16276 (OVH)
2 10 92.204.215.7 21499 (GODADDY-SXB)
3 2600:9000:225... 16509 (AMAZON-02)
15 6
1    2606:4700:3037::6815:4cd7 (United States)

ASN13335 (CLOUDFLARENET, US)
techpoweredm.com
1    2606:4700::6811:490e (United States)

ASN13335 (CLOUDFLARENET, US)
ajax.cloudflare.com
1    46.105.201.240 (France)

ASN16276 (OVH, FR)
s10.histats.com
1    54.39.156.32 (Québec, Canada)

ASN16276 (OVH, FR)
PTR: ns562579.ip-54-39-156.net
s4.histats.com
10    92.204.215.7 (Strasbourg, France)

ASN21499 (GODADDY-SXB, DE)
PTR: 7.215.204.92.host.secureserver.net
healthwithshak.com
3    2600:9000:2251:4800:13:46b5:7d80:93a1 (United States)

ASN16509 (AMAZON-02, US)
www.deutsche-bank.de
Apex Domain
Subdomains		 Transfer
10 healthwithshak.com
healthwithshak.com
372 KB
3 deutsche-bank.de
www.deutsche-bank.de — Cisco Umbrella Rank: 275727
53 KB
2 histats.com
s10.histats.com — Cisco Umbrella Rank: 15911
s4.histats.com — Cisco Umbrella Rank: 13074
5 KB
1 cloudflare.com
ajax.cloudflare.com — Cisco Umbrella Rank: 4970
4 KB
1 techpoweredm.com
techpoweredm.com
966 B
15 5
Domain Requested by
10 healthwithshak.com 2 redirects healthwithshak.com
3 www.deutsche-bank.de healthwithshak.com
www.deutsche-bank.de
1 s4.histats.com s10.histats.com
1 s10.histats.com techpoweredm.com
1 ajax.cloudflare.com techpoweredm.com
1 techpoweredm.com
15 6

This site contains no links.

Subject Issuer Validity Valid
*.techpoweredm.com
GTS CA 1P5		 2023-04-07 -
2023-07-06		 3 months crt.sh
ajax.cloudflare.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-08-09 -
2023-08-16		 a year crt.sh
histats.com
R3		 2023-03-15 -
2023-06-13		 3 months crt.sh
healthwithshak.com
Go Daddy Secure Certificate Authority - G2		 2022-08-23 -
2023-09-24		 a year crt.sh
www.deutsche-bank.de
DigiCert EV RSA CA G2		 2022-11-15 -
2023-11-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Frame ID: 769B4934C926AF4BA3990954A4BFD103
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://techpoweredm.com/images/1/ Page URL
  2. https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/ HTTP 302
    https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/index.php HTTP 302
    https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

15
Requests

100 %
HTTPS

50 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

434 kB
Transfer

657 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://techpoweredm.com/images/1/ Page URL
  2. https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/ HTTP 302
    https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/index.php HTTP 302
    https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
techpoweredm.com/images/1/ 		974 B
966 B 		Document
General
Check archive.org
Download Go to
Full URL
https://techpoweredm.com/images/1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:4cd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b8688bda35a6fc619c9bf4786943dda2d0bbe9a92b37df4f5a770c020d46d39

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7c586eb27af42c6b-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 11 May 2023 06:40:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cRv3ab7mJZLeXYAd%2Baf1eg5L8ks1b3SiZRhLpm%2BTOcJpmMwx2bByc6YTeB9rxKr89nuxGhlX3RAmR06xRyLwYUWCh%2BwbN1VmRMozOSw166hNTW0Od0u2vGJ64zG%2BwY5BtXfiyGPniVgIsdisf%2Bkw"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.cloudflare.com/cdn-cgi/scripts/95c75768/cloudflare-static/rocket-loader.min.js
Requested by
Host: techpoweredm.com
URL: https://techpoweredm.com/images/1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:490e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://techpoweredm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:46 GMT
strict-transport-security
max-age=15780000; includeSubDomains
x-content-type-options
nosniff
last-modified
Fri, 28 Apr 2023 14:11:40 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
gzip
etag
W/"644bd41c-302c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wkysQ8nBCYpXaD0wY4u15kbUqoRthHMjkP7vdY6%2BZEGyABtPH0Zqc0AicHxLRa0fLd%2BJm9W%2By4MhDws2mnBeEpUZjpC%2BWqYzBA5QdJYRpM87qgToTowEAYY1kWC5KJaqTd25egmfL9Eyzqf9kFcCUZ8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7c586eb34882996f-FRA
expires
Sat, 13 May 2023 06:40:46 GMT
js15_as.js
s10.histats.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s10.histats.com/js15_as.js
Requested by
Host: techpoweredm.com
URL: https://techpoweredm.com/images/1/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://techpoweredm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:37:18 GMT
content-encoding
br
last-modified
Thu, 16 Apr 2020 10:44:16 GMT
x-cacheable
Matched cache
x-cdn-pop-ip
137.74.120.0/27
etag
"-375139978"
content-type
text/javascript
x-cdn-pop
sbg
accept-ranges
bytes
content-length
4364
x-request-id
738527325
0.php
s4.histats.com/stats/ 		49 B
183 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s4.histats.com/stats/0.php?4299303&@f16&@g1&@h1&@i1&@j1683787246713&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-45287129&@b3:1683787247&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Ftechpoweredm.com%2Fimages%2F1%2F&@w
Requested by
Host: s10.histats.com
URL: https://s10.histats.com/js15_as.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.39.156.32 Québec, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns562579.ip-54-39-156.net
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://techpoweredm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date
Thu, 11 May 2023 06:40:46 GMT
Connection
close
Content-Length
49
Content-Type
text/html;charset=UTF-8
Primary Request user.php
healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/
Redirect Chain
  • https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/
  • https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/index.php
  • https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache / PHP/7.4.33
Resource Hash
b8a8edc065b41e0883a978e04e051a4d98aca9a71b28c39b74da16b11587420c

Request headers

Referer
https://techpoweredm.com/images/1/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-length
987
content-type
text/html; charset=UTF-8
date
Thu, 11 May 2023 06:40:47 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

content-encoding
br
content-length
1
content-type
text/html; charset=UTF-8
date
Thu, 11 May 2023 06:40:46 GMT
location
user.php
server
Apache
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
fonts.css
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 		1 KB
859 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:4800:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
adc96b6efe5919552898681732312c97108a36e5d17d1bd20044c09f31b7e43b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://healthwithshak.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b4904c5988fd0eaae341a12cc47f3766.cloudfront.net (CloudFront)
content-security-policy
frame-ancestors https://*.deutsche-bank.de
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-length
226
last-modified
Wed, 24 Feb 2021 08:20:14 GMT
server
Apache
db-nickname
VTJGc2RHVmtYMTlWVlcydHRLYTczcVZLN3Q2VkdTMGJsa2RpTzFLRGVKRT0=
vary
Accept-Encoding,Origin
x-frame-options
SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
x-amz-cf-id
mkGybR7_BF9GSgOaRiDZL-RzhniaIsr59-peSjtJD87hwR-Es3SCMg==
expires
Fri, 10 May 2024 06:40:47 GMT
user-style.css
healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/ 		3 KB
927 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/user-style.css
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache /
Resource Hash
3dc541aa9bb40fe5df53166a1ae584f2df06bc3abf2237e5a46cf77c1d15c3d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
content-encoding
br
last-modified
Tue, 03 Jan 2023 09:28:52 GMT
server
Apache
etag
"4ae1bc8-c3d-5f158b228fd00-br"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
834
logo-cut.png
healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/logo-cut.png
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache /
Resource Hash
ed3071781924562c02f648cab6d9decda453e6b57d137a4dded6f85ae7be3901

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
last-modified
Tue, 03 Jan 2023 00:01:10 GMT
server
Apache
accept-ranges
bytes
etag
"4ae1bc3-70e-5f150c3e81d80"
content-length
1806
content-type
image/png
img1.jpg
healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/img1.jpg
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache /
Resource Hash
97fe447ddc107dc8b5f84af5b559f36c71eb2da143a98ef3080014d1f17c994a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
last-modified
Mon, 02 Jan 2023 23:41:24 GMT
server
Apache
accept-ranges
bytes
etag
"4ae1bbe-b0ef-5f1507d373100"
content-length
45295
content-type
image/jpeg
jq.js
healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/ 		287 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/jq.js
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache /
Resource Hash
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
content-encoding
br
last-modified
Mon, 02 Jan 2023 23:14:00 GMT
server
Apache
etag
"4ae1bc1-47b27-5f1501b39be00-br"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
82150
back.jpg
healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/ 		243 KB
243 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/back.jpg
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/user-style.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache /
Resource Hash
8c477933a91763dd80d66840a72f9b25bee4250bc4adb2ec15932d5f6a473ecf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/user-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
last-modified
Mon, 02 Jan 2023 22:32:24 GMT
server
Apache
accept-ranges
bytes
etag
"4ae1bba-3cbb5-5f14f8673ce00"
content-length
248757
content-type
image/jpeg
FrutigerLTW05-55Roman.woff2
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 		25 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-55Roman.woff2
Requested by
Host: www.deutsche-bank.de
URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:4800:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
55cb206a77ff71092c309352fcb5927a389382ae678bab55f85ab13ed6239d31
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

Referer
https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Origin
https://healthwithshak.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-security-policy
frame-ancestors https://*.deutsche-bank.de
via
1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-length
25764
last-modified
Wed, 24 Feb 2021 08:20:14 GMT
server
Apache
db-nickname
VTJGc2RHVmtYMTlWVlcydHRLYTczcVZLN3Q2VkdTMGJsa2RpTzFLRGVKRT0=
vary
Origin
x-frame-options
SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
x-amz-cf-id
9p7VDDUuu9BUCzfoESgspgTnsWfJ8E-DQ7wtTtmadC6w6lSHDonDLQ==
expires
Fri, 10 May 2024 06:40:47 GMT
FrutigerLTW05-65Bold.woff2
www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/ 		25 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/FrutigerLTW05-65Bold.woff2
Requested by
Host: www.deutsche-bank.de
URL: https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:4800:13:46b5:7d80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache /
Resource Hash
be4beee7d867a4c4702b8ab281d1d11884a6b7ae9a5e74aac6b141000cb248de
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.deutsche-bank.de
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, allow-from https://meine.deutsche-bank.de

Request headers

Referer
https://www.deutsche-bank.de/cip-content/assets/pb-unity/fonts/fonts.css
Origin
https://healthwithshak.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Thu, 11 May 2023 06:40:47 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-security-policy
frame-ancestors https://*.deutsche-bank.de
via
1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-length
26008
last-modified
Wed, 24 Feb 2021 08:20:14 GMT
server
Apache
db-nickname
VTJGc2RHVmtYMS8xN1JpY0llMk9BWU00S3Z0dXlCVXc4VGlXVU5FalRGbz0=
vary
Origin
x-frame-options
SAMEORIGIN, allow-from https://meine.deutsche-bank.de
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
x-amz-cf-id
ZuevV7OBsoRmKKk5DQv1Kss5gh0sBfZD50pRmf8HG-YgDxmcQzeQrQ==
expires
Fri, 10 May 2024 06:40:47 GMT
fetch.php
healthwithshak.com/wp-content/languages/OkHGjhgHJG/panel/ 		1 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/panel/fetch.php
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/jq.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache / PHP/7.4.33
Resource Hash
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Accept
*/*
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 11 May 2023 06:40:49 GMT
content-encoding
br
server
Apache
x-powered-by
PHP/7.4.33
content-length
5
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
fetch.php
healthwithshak.com/wp-content/languages/OkHGjhgHJG/panel/ 		1 B
57 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/panel/fetch.php
Requested by
Host: healthwithshak.com
URL: https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/res/jq.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.204.215.7 Strasbourg, France, ASN21499 (GODADDY-SXB, DE),
Reverse DNS
7.215.204.92.host.secureserver.net
Software
Apache / PHP/7.4.33
Resource Hash
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Accept
*/*
Referer
https://healthwithshak.com/wp-content/languages/OkHGjhgHJG/app/user.php
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 11 May 2023 06:40:51 GMT
content-encoding
br
server
Apache
x-powered-by
PHP/7.4.33
content-length
5
vary
Accept-Encoding
content-type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Postbank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery string| cd

8 Cookies

Domain/Path Name / Value
techpoweredm.com/ Name: HstCfa4299303
Value: 1683787246713
techpoweredm.com/ Name: HstCla4299303
Value: 1683787246713
techpoweredm.com/ Name: HstCmu4299303
Value: 1683787246713
techpoweredm.com/ Name: HstPn4299303
Value: 1
techpoweredm.com/ Name: HstPt4299303
Value: 1
techpoweredm.com/ Name: HstCnv4299303
Value: 1
techpoweredm.com/ Name: HstCns4299303
Value: 1
healthwithshak.com/ Name: PHPSESSID
Value: 8698ccc60f61ca1e78697b1322dadd12