www.ostwaltsonsite.com Open in urlscan Pro
164.52.146.18 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
Submission: On March 27 via api (March 27th 2023, 1:04:47 am UTC) from JP — Scanned from JP

Summary HTTP 20 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 8 IPs in 5 countries across 7 domains to perform 20 HTTP transactions. The main IP is 164.52.146.18, located in The Bronx, United States and belongs to DATABANK-LATISYS, US. The main domain is www.ostwaltsonsite.com.

This is the only time www.ostwaltsonsite.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DSK Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	164.52.146.18 164.52.146.18	7226 (DATABANK-...) (DATABANK-LATISYS)
9	195.128.225.81 195.128.225.81	31440 (DSK-AS) (DSK-AS)
1	142.250.196.130 142.250.196.130	15169 (GOOGLE) (GOOGLE)
1 1	40.69.201.11 40.69.201.11	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	23.39.216.31 23.39.216.31	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:140b:2:9... 2600:140b:2:9b4::1015	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2404:6800:400... 2404:6800:4004:821::2002	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:801::2004	15169 (GOOGLE) (GOOGLE)
1	2404:6800:400... 2404:6800:4004:801::2003	15169 (GOOGLE) (GOOGLE)
20	8

3 164.52.146.18 (The Bronx, United States)

ASN7226 (DATABANK-LATISYS, US)
PTR: ez26.ez-web-hosting.com

www.ostwaltsonsite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 195.128.225.81 (Sofia, Bulgaria)

ASN31440 (DSK-AS, BG)

www.dskdirect.bg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.196.130 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.69.201.11 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

seal.websecurity.norton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.39.216.31 (Tokyo, Japan) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-39-216-31.deploy.static.akamaitechnologies.com

www.norton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:2:9b4::1015 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

jp.norton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:821::2002 (Australia)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:801::2004 (Australia)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:801::2003 (Australia)

ASN15169 (GOOGLE, US)

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dskdirect.bg www.dskdirect.bg — Cisco Umbrella Rank: 742178	560 KB
3	norton.com 2 redirects seal.websecurity.norton.com — Cisco Umbrella Rank: 76238 www.norton.com — Cisco Umbrella Rank: 52403 jp.norton.com	663 B
3	ostwaltsonsite.com www.ostwaltsonsite.com	21 KB
1	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 23904	455 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	455 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 29	2 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 168	18 KB
20	7

	Domain	Requested by
9	www.dskdirect.bg	www.ostwaltsonsite.com www.dskdirect.bg
3	www.ostwaltsonsite.com	www.ostwaltsonsite.com
1	www.google.co.jp	www.ostwaltsonsite.com
1	www.google.com	www.ostwaltsonsite.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	jp.norton.com	www.ostwaltsonsite.com
1	www.norton.com	1 redirects
1	seal.websecurity.norton.com	1 redirects
1	www.googleadservices.com	www.ostwaltsonsite.com
20	9

This site contains links to these domains. Also see Links.

Domain
dskbank.bg
online.groupama.bg
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
www.dskdirect.bg DigiCert SHA2 Extended Validation Server CA	`2022-03-23` - `2023-04-18`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.google.co.jp GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
Frame ID: AEC459010D704414716D1894104E7E74
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ДСК Директ

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

20
Requests

60 %
HTTPS

44 %
IPv6

7
Domains

9
Subdomains

8
IPs

5
Countries

603 kB
Transfer

1233 kB
Size

1
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://dskbank.bg/%D0%BF%D1%80%D0%B5%D0%BF%D0%BE%D1%80%D1%8A%D0%BA%D0%B8-%D0%B7%D0%B0-%D1%81%D0%B8%D0%B3%D1%83%D1%80%D0%BD%D0%BE%D1%81%D1%82

Search URL Search Domain Scan URL

URL: https://dskbank.bg/%D0%B8%D0%BD%D0%B4%D0%B8%D0%B2%D0%B8%D0%B4%D1%83%D0%B0%D0%BB%D0%BD%D0%B8-%D0%BA%D0%BB%D0%B8%D0%B5%D0%BD%D1%82%D0%B8/%D0%B1%D0%B0%D0%BD%D0%BA%D0%BE%D0%B2%D0%B8-%D0%BA%D0%B0%D1%80%D1%82%D0%B8/%D0%BA%D1%80%D0%B5%D0%B4%D0%B8%D1%82%D0%BD%D0%B8/%D0%BA%D1%80%D0%B5%D0%B4%D0%B8%D1%82%D0%BD%D0%B0-%D0%BA%D0%B0%D1%80%D1%82%D0%B0-dsk-wizzair?ConsultantReference=Direct_Wizz

Search URL Search Domain Scan URL

URL: https://online.groupama.bg/#insurances

Search URL Search Domain Scan URL

URL: https://dskbank.bg/%D0%B8%D0%BD%D0%B4%D0%B8%D0%B2%D0%B8%D0%B4%D1%83%D0%B0%D0%BB%D0%BD%D0%B8-%D0%BA%D0%BB%D0%B8%D0%B5%D0%BD%D1%82%D0%B8/%D0%B4%D1%81%D0%BA-%D0%B4%D0%B8%D1%80%D0%B5%D0%BA%D1%82/%D0%BC%D0%BE%D0%B1%D0%B8%D0%BB%D0%BD%D0%B8-%D0%BF%D1%80%D0%B8%D0%BB%D0%BE%D0%B6%D0%B5%D0%BD%D0%B8%D1%8F/%D0%B4%D1%81%D0%BA-%D1%81%D0%BC%D0%B0%D1%80%D1%82

Search URL Search Domain Scan URL

URL: https://www.facebook.com/dskbank

Search URL Search Domain Scan URL

URL: http://www.youtube.com/dskbank

Search URL Search Domain Scan URL

URL: https://dskbank.bg/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=L1gSLMwJJcQ&list=PLG4yq9b9q8zHLJfvQOfdWg5liNnvLz1mP
Title: Демо филм за граждани

Search URL Search Domain Scan URL

URL: https://dskbank.bg/docs/default-source/bank-tarrif/%D1%82%D0%B0%D1%80%D0%B8%D1%84%D0%B0-%D0%B7%D0%B0-%D1%84%D0%B8%D0%B7%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8-%D0%BB%D0%B8%D1%86%D0%B0.pdf
Title: Тарифа за граждани

Search URL Search Domain Scan URL

URL: https://dskbank.bg/docs/default-source/%D1%82%D0%B0%D1%80%D0%B8%D1%84%D0%B0-%D0%B1%D0%B8%D0%B7%D0%BD%D0%B5%D1%81-%D0%BA%D0%BB%D0%B8%D0%B5%D0%BD%D1%82%D0%B8/%D1%82%D0%B0%D1%80%D0%B8%D1%84%D0%B0-%D0%B7%D0%B0-%D0%B1%D0%B8%D0%B7%D0%BD%D0%B5%D1%81-%D0%BA%D0%BB%D0%B8%D0%B5%D0%BD%D1%82%D0%B8.pdf
Title: Тарифа за фирми

Search URL Search Domain Scan URL

URL: https://dskbank.bg/docs/default-source/%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%BD%D0%B5%D1%82-%D0%B1%D0%B0%D0%BD%D0%BA%D0%B8%D1%80%D0%B0%D0%BD%D0%B5/o%D0%B1%D1%89%D0%B8-%D1%83%D1%81%D0%BB%D0%BE%D0%B2%D0%B8%D1%8F-%D0%B7%D0%B0-%D0%BF%D0%BE%D0%BB%D0%B7%D0%B2%D0%B0%D0%BD%D0%B5-%D0%BD%D0%B0-%D0%B4%D1%81%D0%BA-%D0%B4%D0%B8%D1%80%D0%B5%D0%BA%D1%82-%D0%B7%D0%B0-%D1%84%D0%B8%D0%B7%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8-%D0%BB%D0%B8%D1%86%D0%B0.pdf
Title: Общи условия за граждани

Search URL Search Domain Scan URL

URL: https://dskbank.bg/docs/default-source/%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%BD%D0%B5%D1%82-%D0%B1%D0%B0%D0%BD%D0%BA%D0%B8%D1%80%D0%B0%D0%BD%D0%B5-%D0%B1%D0%B8%D0%B7%D0%BD%D0%B5%D1%81/%D0%BE%D0%B1%D1%89%D0%B8-%D1%83%D1%81%D0%BB%D0%BE%D0%B2%D0%B8%D1%8F-%D0%B7%D0%B0-%D0%B8%D0%B7%D0%BF%D0%BE%D0%BB%D0%B7%D0%B2%D0%B0%D0%BD%D0%B5-%D0%BD%D0%B0-%D0%B5%D0%BB%D0%B5%D0%BA%D1%82%D1%80%D0%BE%D0%BD%D0%BD%D0%BE-%D0%B1%D0%B0%D0%BD%D0%BA%D0%B8%D1%80%D0%B0%D0%BD%D0%B5-%D0%B7%D0%B0-%D0%B1%D0%B8%D0%B7%D0%BD%D0%B5%D1%81-%D0%BA%D0%BB%D0%B8%D0%B5%D0%BD%D1%82%D0%B8.pdf
Title: Общи условия за фирми

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://seal.websecurity.norton.com/getseal?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en HTTP 301
https://www.norton.com/?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en HTTP 301
https://jp.norton.com/?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/ 17 KB
5 KB 1133ms
344ms Document
text/html 164.52.146.18
DATABANK-LATISYS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
Protocol: HTTP/1.1
Server: 164.52.146.18 The Bronx, United States, ASN7226 (DATABANK-LATISYS, US),
Reverse DNS: ez26.ez-web-hosting.com
Software: Apache /
Resource Hash: 316b6e4242c188b17a802bd1885bd9bdeef9fc7c2f88a3d8303050c27751ee87

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 27 Mar 2023 01:04:39 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK style.direct.2018.css
www.dskdirect.bg/css/compiled/ 695 KB
124 KB 924ms
309ms Stylesheet
text/css 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dskdirect.bg/css/compiled/style.direct.2018.css?v=20180824

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

11b3512beedd660283b5a5e4e760bc59807e8b361179477eed53e09b203bc740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 27 Mar 2023 01:04:40 GMT
Last-Modified: Tue, 07 Feb 2023 07:48:52 GMT
Server: Microsoft-IIS/10.0
ETag: "c4ab709fc83ad91:0"
Vary: Accept-Encoding
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css
Transfer-Encoding: chunked
Cache-Control: max-age=86400
Server-Timing: dtSInfo;desc="0", dtRpid;desc="1705366904"
Accept-Ranges: bytes
X-XSS-PROTECTION: 1; mode=block

GET
H/1.1 404
Not Found calendar.js
www.ostwaltsonsite.com/calendar/ 0
0 1152ms
1152ms Script
text/html 164.52.146.18
DATABANK-LATISYS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ostwaltsonsite.com/calendar/calendar.js?v=20180824
Requested by: Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
Protocol: HTTP/1.1
Server: 164.52.146.18 The Bronx, United States, ASN7226 (DATABANK-LATISYS, US),
Reverse DNS: ez26.ez-web-hosting.com
Software: Apache /
Resource Hash

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Mon, 27 Mar 2023 01:04:39 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://www.ostwaltsonsite.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=100
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK conversion.js Show response
www.googleadservices.com/pagead/ 47 KB
18 KB 49ms
46ms Script
text/javascript 142.250.196.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Server

142.250.196.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f2.1e100.net

Software

cafe /

Resource Hash

0c8cd1cbb9199b7380ec94342406b653fb821d74c091c452fed049ce969d7b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Mon, 27 Mar 2023 01:04:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 13066819419773989411
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Timing-Allow-Origin: *
Content-Length: 18356
X-XSS-Protection: 0
Expires: Mon, 27 Mar 2023 01:04:39 GMT

GET
H/1.1 200
OK Direct.bg.svg
www.dskdirect.bg/images/svg/ 10 KB
11 KB 267ms
266ms Image
image/svg+xml 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/images/svg/Direct.bg.svg

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

4dc2784d1bf184b593dd4d447f1037407dbbf62d5ad04d730636513b57a067bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Mon, 27 Mar 2023 01:04:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 17 Apr 2018 07:21:14 GMT
Server: Microsoft-IIS/10.0
ETag: "0d1fcaa1cd6d31:0"
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-183195599"
Accept-Ranges: bytes
Content-Length: 10473
X-XSS-PROTECTION: 1; mode=block

GET
H/1.1 404
Not Found DSK_Security_1104x74.jpg
www.ostwaltsonsite.com/repository/photos/ 16 KB
16 KB 499ms
499ms Image
text/html 164.52.146.18
DATABANK-LATISYS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.ostwaltsonsite.com/repository/photos/DSK_Security_1104x74.jpg
Requested by: Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
Protocol: HTTP/1.1
Server: 164.52.146.18 The Bronx, United States, ASN7226 (DATABANK-LATISYS, US),
Reverse DNS: ez26.ez-web-hosting.com
Software: Apache /
Resource Hash: d824b7a6abcc517b0919c8f6dd9265faf8c4fa9968f19e29bd61d9ac02fe2377

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Mon, 27 Mar 2023 01:04:41 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://www.ostwaltsonsite.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK DSK_WizzAir_DSK_Direct_1600x700px.jpg
www.dskdirect.bg/repository/photos/ 240 KB
241 KB 290ms
288ms Image
image/jpeg 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/repository/photos/DSK_WizzAir_DSK_Direct_1600x700px.jpg

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

074efc7b992be35729c3f9a5937ff8a7bab899e5e39a83bd87732e7cb24e3364

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Mon, 27 Mar 2023 01:04:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 05 Jul 2018 08:57:16 GMT
Server: Microsoft-IIS/10.0
ETag: "07ea2c3e14d41:0"
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1729548638"
Accept-Ranges: bytes
Content-Length: 245833
X-XSS-PROTECTION: 1; mode=block

GET
H2

200

/ Show response
jp.norton.com/
Redirect Chain

https://seal.websecurity.norton.com/getseal?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en
https://www.norton.com/?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en
https://jp.norton.com/?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en

0
0

101ms
16ms

Script
text/html

2600:140b:2:9b4::1015
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://jp.norton.com/?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en
Requested by: Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/
Protocol: H2
Server: 2600:140b:2:9b4::1015 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Mon, 27 Mar 2023 01:04:42 GMT
Server: AkamaiGHost
Location: https://jp.norton.com/?host_name=www.dskdirect.bg&size=S&use_flash=NO&use_transparent=YES&lang=en
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Expires: Mon, 27 Mar 2023 01:04:42 GMT

GET
H/1.1 200
OK DSK_CarInsurance_360x160_BG.png
www.dskdirect.bg/repository/photos/banners/ 75 KB
75 KB 498ms
272ms Image
image/png 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/repository/photos/banners/DSK_CarInsurance_360x160_BG.png

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

f6613c4bd974b120dc3c8319e187cdd40361c0e3307a19b4b8ffc2f51ce26059

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Mon, 27 Mar 2023 01:04:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 04 Feb 2020 07:49:02 GMT
Server: Microsoft-IIS/10.0
ETag: "0eb0912fdbd51:0"
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="1222850296"
Accept-Ranges: bytes
Content-Length: 76330
X-XSS-PROTECTION: 1; mode=block

GET
H/1.1 200
OK smart.svg
www.dskdirect.bg/images/svg/ 37 KB
22 KB 806ms
279ms Image
image/svg+xml 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/images/svg/smart.svg

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

59112ed4801f8c7528bb2cb4aecd536dd4b480e89a39eadecf61fc6fa4c4a148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 27 Mar 2023 01:04:42 GMT
Last-Modified: Tue, 04 Jun 2019 14:25:38 GMT
Server: Microsoft-IIS/10.0
ETag: "09d5161e11ad51:0"
Vary: Accept-Encoding
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1949232239"
Accept-Ranges: bytes
Content-Length: 22269
X-XSS-PROTECTION: 1; mode=block

GET
H/1.1 200
OK facebook.svg
www.dskdirect.bg/images/svg/ 1 KB
2 KB 819ms
282ms Image
image/svg+xml 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/images/svg/facebook.svg

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

7a9d2e26c43294bfc2f43d7c8de599e8ebdb1e930dec633e62c58293986a50b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Mon, 27 Mar 2023 01:04:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 17 Apr 2018 07:21:14 GMT
Server: Microsoft-IIS/10.0
ETag: "0d1fcaa1cd6d31:0"
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-1034350020"
Accept-Ranges: bytes
Content-Length: 1045
X-XSS-PROTECTION: 1; mode=block

GET
H/1.1 200
OK youtube.svg
www.dskdirect.bg/images/svg/ 6 KB
3 KB 840ms
292ms Image
image/svg+xml 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/images/svg/youtube.svg

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

1daa4277916dd050fb98fe61a6d1f584871d477094885219c4ea900ee7fc07a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 27 Mar 2023 01:04:42 GMT
Last-Modified: Tue, 17 Apr 2018 07:21:14 GMT
Server: Microsoft-IIS/10.0
ETag: "0d1fcaa1cd6d31:0"
Vary: Accept-Encoding
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="-210670524"
Accept-Ranges: bytes
Content-Length: 2353
X-XSS-PROTECTION: 1; mode=block

GET
H/1.1 200
OK BankaDSK_ciril_CM_White.svg
www.dskdirect.bg/images/svg/ 8 KB
3 KB 404ms
275ms Image
image/svg+xml 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/images/svg/BankaDSK_ciril_CM_White.svg

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

b6fb3abc677a66e3a6575b2dbaec9950f8d8630e26922f33094afdeaba7f004e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 27 Mar 2023 01:04:42 GMT
Last-Modified: Wed, 23 May 2018 11:25:38 GMT
Server: Microsoft-IIS/10.0
ETag: "0a548c688f2d31:0"
Vary: Accept-Encoding
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="1286447629"
Accept-Ranges: bytes
Content-Length: 2913
X-XSS-PROTECTION: 1; mode=block

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/850154699/ 3 KB
2 KB 86ms
47ms Script
text/javascript 2404:6800:4004:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/850154699/?random=1679879081780&cv=9&fst=1679879081780&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261%2C466465926%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=http%3A%2F%2Fwww.ostwaltsonsite.com%2Fwp-content%2Fuploads%2Fdsk%2Fuser%2Faccount%2F&tiba=%D0%94%D0%A1%D0%9A%20%D0%94%D0%B8%D1%80%D0%B5%D0%BA%D1%82&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:821::2002 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f053d1a4e80ea9c7cb0db02bf31ed3b08b49f337103453a2a2965861b34571d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Mar 2023 01:04:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1308
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET icons.svg
www.dskdirect.bg/images/svg/ 0
0

GET SourceSansPro-Regular.ttf.woff
www.dskdirect.bg/css/fonts/ 0
0

GET SourceSansPro-Semibold.ttf.woff
www.dskdirect.bg/css/fonts/ 0
0

GET
H2 200 /
www.google.com/pagead/1p-user-list/850154699/ 42 B
455 B 99ms
47ms Image
image/gif 2404:6800:4004:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/850154699/?random=1679879081780&cv=9&fst=1679878800000&num=1&guid=ON&eid=375603261%2C466465926%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=http%3A%2F%2Fwww.ostwaltsonsite.com%2Fwp-content%2Fuploads%2Fdsk%2Fuser%2Faccount%2F&tiba=%D0%94%D0%A1%D0%9A%20%D0%94%D0%B8%D1%80%D0%B5%D0%BA%D1%82&fmt=3&is_vtc=1&random=1708820582&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:801::2004 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Mar 2023 01:04:41 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.co.jp/pagead/1p-user-list/850154699/ 42 B
455 B 95ms
44ms Image
image/gif 2404:6800:4004:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/850154699/?random=1679879081780&cv=9&fst=1679878800000&num=1&guid=ON&eid=375603261%2C466465926%2C512247838&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=http%3A%2F%2Fwww.ostwaltsonsite.com%2Fwp-content%2Fuploads%2Fdsk%2Fuser%2Faccount%2F&tiba=%D0%94%D0%A1%D0%9A%20%D0%94%D0%B8%D1%80%D0%B5%D0%BA%D1%82&fmt=3&is_vtc=1&random=1708820582&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.ostwaltsonsite.com
URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:801::2003 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://www.ostwaltsonsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Mar 2023 01:04:41 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK smart.png
www.dskdirect.bg/images/ 79 KB
79 KB 386ms
271ms Image
image/png 195.128.225.81
DSK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dskdirect.bg/images/smart.png

Requested by

Host: www.dskdirect.bg
URL: https://www.dskdirect.bg/css/compiled/style.direct.2018.css?v=20180824

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

195.128.225.81 Sofia, Bulgaria, ASN31440 (DSK-AS, BG),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

885ba059f6960be2f0c3f240641c2935c88401fe000b1c11db9074650fd4c216

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.dskdirect.bg/css/compiled/style.direct.2018.css?v=20180824
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Mon, 27 Mar 2023 01:04:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 15 Apr 2020 08:28:14 GMT
Server: Microsoft-IIS/10.0
ETag: "0e33bceff12d61:0"
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=1200
Server-Timing: dtSInfo;desc="0", dtRpid;desc="2085588954"
Accept-Ranges: bytes
Content-Length: 80612
X-XSS-PROTECTION: 1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.dskdirect.bg
URL: https://www.dskdirect.bg/images/svg/icons.svg

Domain: www.dskdirect.bg
URL: https://www.dskdirect.bg/css/fonts/SourceSansPro-Regular.ttf.woff

Domain: www.dskdirect.bg
URL: https://www.dskdirect.bg/css/fonts/SourceSansPro-Semibold.ttf.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DSK Bank (Banking)

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.doubleclick.net/	1970-01-20 10:37:59	Name: test_cookie Value: CheckForPermission

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://www.ostwaltsonsite.com/calendar/calendar.js?v=20180824 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
security	error	URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/(Line 80) Message: Unsafe attempt to load URL https://www.dskdirect.bg/images/svg/icons.svg from frame with URL http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/. Domains, protocols and ports must match.
network	error	URL: http://www.ostwaltsonsite.com/repository/photos/DSK_Security_1104x74.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/ Message: Access to font at 'https://www.dskdirect.bg/css/fonts/SourceSansPro-Regular.ttf.woff' from origin 'http://www.ostwaltsonsite.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.dskdirect.bg/css/fonts/SourceSansPro-Regular.ttf.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: http://www.ostwaltsonsite.com/wp-content/uploads/dsk/user/account/ Message: Access to font at 'https://www.dskdirect.bg/css/fonts/SourceSansPro-Semibold.ttf.woff' from origin 'http://www.ostwaltsonsite.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.dskdirect.bg/css/fonts/SourceSansPro-Semibold.ttf.woff Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

googleads.g.doubleclick.net
jp.norton.com
seal.websecurity.norton.com
www.dskdirect.bg
www.google.co.jp
www.google.com
www.googleadservices.com
www.norton.com
www.ostwaltsonsite.com
www.dskdirect.bg
142.250.196.130
164.52.146.18
195.128.225.81
23.39.216.31
2404:6800:4004:801::2003
2404:6800:4004:801::2004
2404:6800:4004:821::2002
2600:140b:2:9b4::1015
40.69.201.11
074efc7b992be35729c3f9a5937ff8a7bab899e5e39a83bd87732e7cb24e3364
0c8cd1cbb9199b7380ec94342406b653fb821d74c091c452fed049ce969d7b38
11b3512beedd660283b5a5e4e760bc59807e8b361179477eed53e09b203bc740
1daa4277916dd050fb98fe61a6d1f584871d477094885219c4ea900ee7fc07a8
316b6e4242c188b17a802bd1885bd9bdeef9fc7c2f88a3d8303050c27751ee87
4dc2784d1bf184b593dd4d447f1037407dbbf62d5ad04d730636513b57a067bd
59112ed4801f8c7528bb2cb4aecd536dd4b480e89a39eadecf61fc6fa4c4a148
7a9d2e26c43294bfc2f43d7c8de599e8ebdb1e930dec633e62c58293986a50b6
885ba059f6960be2f0c3f240641c2935c88401fe000b1c11db9074650fd4c216
b6fb3abc677a66e3a6575b2dbaec9950f8d8630e26922f33094afdeaba7f004e
d824b7a6abcc517b0919c8f6dd9265faf8c4fa9968f19e29bd61d9ac02fe2377
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f053d1a4e80ea9c7cb0db02bf31ed3b08b49f337103453a2a2965861b34571d4
f6613c4bd974b120dc3c8319e187cdd40361c0e3307a19b4b8ffc2f51ce26059

www.ostwaltsonsite.com Open in urlscan Pro 164.52.146.18 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

20 Requests

60 %HTTPS

44 %IPv6

7 Domains

9 Subdomains

8 IPs

5 Countries

603 kBTransfer

1233 kBSize

1 Cookies

13 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

52 JavaScript Global Variables

1 Cookies

7 Console Messages

Indicators

www.ostwaltsonsite.com Open in urlscan Pro
164.52.146.18 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

60 %
HTTPS

44 %
IPv6

7
Domains

9
Subdomains

8
IPs

5
Countries

603 kB
Transfer

1233 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!