secure.encryptedconnection.net Open in urlscan Pro
18.203.104.233 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dH...
Effective URL:
https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb24...
Submission: On October 29 via manual (October 29th 2018, 2:32:04 pm UTC) from GB

Summary HTTP 6 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 18.203.104.233, located in Cambridge, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is secure.encryptedconnection.net.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 31st 2016. Valid for: 3 years.

This is the only time secure.encryptedconnection.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	52.30.141.241 52.30.141.241		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4	18.203.104.233 18.203.104.233		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2606:4700:30:... 2606:4700:30::681b:957e		13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
6	3

1 52.30.141.241 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-30-141-241.eu-west-1.compute.amazonaws.com

invoices.phishing.guru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.203.104.233 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-203-104-233.eu-west-1.compute.amazonaws.com

secure.encryptedconnection.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:957e (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.tui-holding.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	encryptedconnection.net secure.encryptedconnection.net	863 KB
1	tui-holding.at www.tui-holding.at	1 MB
1	phishing.guru invoices.phishing.guru	696 B
6	3

	Domain	Requested by
4	secure.encryptedconnection.net	invoices.phishing.guru secure.encryptedconnection.net
1	www.tui-holding.at	secure.encryptedconnection.net
1	invoices.phishing.guru
6	3

This site contains no links.

Subject Issuer	Validity	Valid
knowbe4.com Go Daddy Secure Certificate Authority - G2	`2016-03-31` - `2019-02-25`	3 years	crt.sh
sni173786.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-10-21` - `2019-04-29`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg==
Frame ID: 022FB796AD10529DC8C4D459744326E6
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb2... Page URL
https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9p... Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
env /^Modernizr$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

6
Requests

83 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2017 kB
Transfer

4781 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Page URL
https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== invoices.phishing.guru/	363 B 696 B	146ms 64ms	Document text/html	52.30.141.241 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Protocol HTTP/1.1 Server 52.30.141.241 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-30-141-241.eu-west-1.compute.amazonaws.com Software nginx/1.4.6 (Ubuntu) / Resource Hash Request headers Host invoices.phishing.guru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 29 Oct 2018 14:31:52 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Server nginx/1.4.6 (Ubuntu) Vary Accept-Encoding Referrer-Policy no-referrer-when-downgrade Cache-Control max-age=0, private, must-revalidate X-Request-Id 63fb7cf4-a7e3-42ea-a529-86f773bdb7c2 X-Runtime 0.035885 Content-Encoding gzip
GET H2	200	Primary Request XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Show response secure.encryptedconnection.net/pages/7ac82846922f/	1 KB 925 B	189ms 71ms	Document text/html	18.203.104.233 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Requested by Host: invoices.phishing.guru URL: http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.203.104.233 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-203-104-233.eu-west-1.compute.amazonaws.com Software nginx/1.4.6 (Ubuntu) / Resource Hash `9b2fd0731aa9fbe4346e3745e9b8fb8c9a5f06244e59da2c09195faebaa6c81b` Request headers :method GET :authority secure.encryptedconnection.net :scheme https :path /pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 referer http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== accept-encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://invoices.phishing.guru/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Response headers status 200 date Mon, 29 Oct 2018 14:31:53 GMT content-type text/html; charset=utf-8 server nginx/1.4.6 (Ubuntu) vary Accept-Encoding referrer-policy no-referrer-when-downgrade cache-control max-age=0, private, must-revalidate x-request-id f22638c2-c4bc-4571-a8cd-046ada682952 x-runtime 0.042164 content-encoding gzip
GET H2	200	application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js Show response secure.encryptedconnection.net/assets/	3 MB 846 KB	30ms 28ms	Script application/x-javascript	18.203.104.233 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://secure.encryptedconnection.net/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js Requested by Host: secure.encryptedconnection.net URL: https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.203.104.233 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-203-104-233.eu-west-1.compute.amazonaws.com Software nginx/1.4.6 (Ubuntu) / Resource Hash `18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b` Request headers :path /assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority secure.encryptedconnection.net referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== :scheme https :method GET Referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 29 Oct 2018 14:31:53 GMT content-encoding gzip last-modified Fri, 26 Oct 2018 20:30:48 GMT server nginx/1.4.6 (Ubuntu) etag "5bd37978-d3254" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=315360000 public content-length 864852 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Show response secure.encryptedconnection.net/assets/	50 KB 16 KB	82ms 81ms	Script application/x-javascript	18.203.104.233 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://secure.encryptedconnection.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Requested by Host: secure.encryptedconnection.net URL: https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.203.104.233 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-203-104-233.eu-west-1.compute.amazonaws.com Software nginx/1.4.6 (Ubuntu) / Resource Hash `654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97` Request headers :path /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority secure.encryptedconnection.net referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== :scheme https :method GET Referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 29 Oct 2018 14:31:53 GMT content-encoding gzip last-modified Fri, 26 Oct 2018 20:30:48 GMT server nginx/1.4.6 (Ubuntu) etag "5bd37978-3d69" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=315360000 public content-length 15721 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css secure.encryptedconnection.net/assets/	606 B 532 B	82ms 80ms	Stylesheet text/css	18.203.104.233 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://secure.encryptedconnection.net/assets/landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css Requested by Host: secure.encryptedconnection.net URL: https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.203.104.233 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-203-104-233.eu-west-1.compute.amazonaws.com Software nginx/1.4.6 (Ubuntu) / Resource Hash `b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c` Request headers :path /assets/landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority secure.encryptedconnection.net referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== :scheme https :method GET Referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 29 Oct 2018 14:31:53 GMT content-encoding gzip last-modified Fri, 26 Oct 2018 20:30:49 GMT server nginx/1.4.6 (Ubuntu) etag "5bd37979-11c" vary Accept-Encoding content-type text/css status 200 cache-control max-age=315360000 public content-length 284 expires Thu, 31 Dec 2037 23:55:55 GMT
GET S	200	landing_page_en.png www.tui-holding.at/reisebuero-finder/oesterreich/signatur/	1 MB 1 MB	82ms 11ms	Image image/png	2606:4700:30::681b:957e Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://www.tui-holding.at/reisebuero-finder/oesterreich/signatur/landing_page_en.png Requested by Host: secure.encryptedconnection.net URL: https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:30::681b:957e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `4c09b00fc15e5c561cdbd2ea06f2c14ed82ab7147a3b1478199d31aef2f1eebd` Request headers Referer https://secure.encryptedconnection.net/pages/7ac82846922f/XcmVnjaXBpZWi50X2lkPTVEyODLMyGNTUxwJmNhbXBhIaWiduX3J1bl9pZD0zOTc3lOCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlLmVuY3J5cHRlZGNvbm5lY3Rpb24ubmV0L3BhZ2VzLzdhYzgyODQ2OTIyZg== User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 29 Oct 2018 14:31:53 GMT cf-cache-status HIT last-modified Thu, 18 Oct 2018 10:15:43 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=2592000 accept-ranges bytes cf-ray 4716592e2b47c2a6-FRA content-length 1179586 expires Wed, 28 Nov 2018 14:31:53 GMT

Verdicts & Comments Add Verdict or Comment

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _typeof boolean| windowIsDefined function| _extends function| FlatpickrInstance function| _flatpickr function| flatpickr function| updateQueryStringParameter function| getParam function| colSort function| ES6Promise function| $ function| jQuery object| jQuery1124008500845085237096 function| Retina function| RetinaImagePath function| RetinaImage function| Color function| Chart object| Chartkick function| proj4 function| AjaxBootstrapSelect function| AjaxBootstrapSelectList function| AjaxBootstrapSelectRequest function| Slider object| Utils object| asap_questionaire function| AsapStoreViewer object| Routes function| moment object| FullCalendar function| _ object| ProgressBar object| html5 object| Modernizr object| asap object| kb4

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://secure.encryptedconnection.net/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js(Line 85364) Message: bootstrap-slider.js - WARNING: $.fn.slider namespace is already bound. Use the $.fn.bootstrapSlider namespace instead.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

invoices.phishing.guru
secure.encryptedconnection.net
www.tui-holding.at
18.203.104.233
2606:4700:30::681b:957e
52.30.141.241
18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b
4c09b00fc15e5c561cdbd2ea06f2c14ed82ab7147a3b1478199d31aef2f1eebd
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
9b2fd0731aa9fbe4346e3745e9b8fb8c9a5f06244e59da2c09195faebaa6c81b
b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c