world-behind.de Open in urlscan Pro
2606:4700:3034::ac43:d09b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://world-behind.de/
Effective URL:
https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4
Submission Tags: https://phish.report @phish_report Search All
Submission: On July 27 via api (July 27th 2023, 3:59:36 pm UTC) from FI — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3034::ac43:d09b, located in United States and belongs to CLOUDFLARENET, US. The main domain is world-behind.de.
TLS certificate: Issued by E1 on July 26th 2023. Valid for: 3 months.

This is the only time world-behind.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 11	2606:4700:303... 2606:4700:3034::ac43:d09b		13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	1

11 2606:4700:3034::ac43:d09b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

world-behind.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	world-behind.de 1 redirects world-behind.de	86 KB
10	1

	Domain	Requested by
11	world-behind.de	1 redirects world-behind.de
10	1

This site contains no links.

Subject Issuer	Validity	Valid
world-behind.de E1	`2023-07-26` - `2023-10-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4
Frame ID: 265144FF0F2A0CFF73B18CCA7012A90F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

6d66ef6c46d8fb8806e6c8a035186b4064c29461a83c7 6d66ef6c46d8fb8806e6c8a035186b4064c29461a83c7

Page URL History Show full URLs

https://world-behind.de/ HTTP 302
https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd01... Page URL

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

85 kB
Transfer

305 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://world-behind.de/ HTTP 302
https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Show response world-behind.de/ Redirect Chain https://world-behind.de/ https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4	23 KB 9 KB	24ms 23ms	Document text/html	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c51a1d26e26d82d9074631514003b07eb90dc0f9fcb4234d6808d5b95f53aa72` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7ed6170c1e443626-FRA content-encoding br content-type text/html; charset=UTF-8 date Thu, 27 Jul 2023 15:59:31 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C3Km6gRVXWbG4%2BckzDGVJyQSannxuQmaSl8aodl5e7WvFNXcdcX819FICuf3aQbvhRKYpptTDgOMxHxvUTU8u0M6fNlCMHnnkcnyaDkbatY5M4S%2F6q3hdsClK4yYzTgXkaXF2yKNSqWzTNikcWo%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-turbo-charged-by LiteSpeed Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-cache, no-store, must-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 7ed617074f183626-FRA content-type text/html; charset=UTF-8 date Thu, 27 Jul 2023 15:59:31 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location ./00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EHMQFDvhekmJhELfvyGIILfillG32CZG218AVyJoP1jISFdagB2k1d%2Fiya9Ue5oMfgJrEbBs6Q4j6rMFf%2FiCeqyURPHZz4PrU2TzqVifZ1GqdRPcExpAz89i%2Bilzk0H0A%2FxXqisTx%2BTvXUrRFzs%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-turbo-charged-by LiteSpeed
GET H3	200	7a1b206739629f4798edf2c8aa0b70e564c29461af271 Show response world-behind.de/jq/	84 KB 31 KB	36ms 35ms	Script application/javascript	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://world-behind.de/jq/7a1b206739629f4798edf2c8aa0b70e564c29461af271 Requested by Host: world-behind.de URL: https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wvJBoQV9IwiXyD2IHPfVD19xBxXG0QNPw0g269uzRSmmti3zN%2BHo6dFWWCTr3UyymxQYEBF8V%2Bp7quo2aCZyZWZxmuTofobZ09ZYIRnL4G8i6hYc4SJ9LyjMGPvGFxSUYvCx%2B5Vpd0fRD1ogQo%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170c489a9a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	7a1b206739629f4798edf2c8aa0b70e564c29461af278 Show response world-behind.de/boot/	50 KB 15 KB	31ms 29ms	Script application/javascript	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://world-behind.de/boot/7a1b206739629f4798edf2c8aa0b70e564c29461af278 Requested by Host: world-behind.de URL: https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1JuYwmYQ2Q8QPJvXZCuz1rDV%2FO5xQU4HJww0uecwdVUvQ2o%2BH1y6fDVD7xvmofaVdbK5OCCb4o3M%2BEaKRR92EUDq0v2epFq0UL8Q2%2FdPGzIj%2Fj5HJLXdBpy%2FgI07UwoOPzruUlc1kp6Z48BWK7s%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170c489c9a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	7a1b206739629f4798edf2c8aa0b70e564c29461af27a Show response world-behind.de/js/	6 KB 3 KB	29ms 28ms	Script application/javascript	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://world-behind.de/js/7a1b206739629f4798edf2c8aa0b70e564c29461af27a Requested by Host: world-behind.de URL: https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `61593f44eacab85e975fc59b794d0dc704ad1375b32cd6eda47a7355731d8218` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wj8eOnnw2rwPbMbt9vYpOFQdTY5GqozIHVwAcblXxh9Ntjvnsd7BMpDE9BJEFvhva2Lc7bouBxmNCnxc4tcBZwxtbiUUCylwt4%2FPIlv52Dj5uv7QapKNF3VPUlbHll5S2vU%2Bp8lMSVTqGE6xcck%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170c489e9a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	1 Show response world-behind.de/	29 KB 4 KB	22ms 22ms	XHR text/html	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://world-behind.de/1 Requested by Host: world-behind.de URL: https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ccf6eb3b38e39cc647a6aa13af037f8fc93db7f132a178faa68b7613a1b0275b` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers pragma no-cache date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WmBhsw7iKMBarE8LYUGXpZYUN5LMBYwGfvajl%2BvhK9tZKyAfpNxwnUGLo7Jb8K1oh5Hzt1q3L%2F3KnLUQeskvLcGjxdFAURI95dsHp9wKdERpJ9rC4g1caoVBI7dXN4%2BcWBxhdWDxz%2BQ9c4%2Bq7aE%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate x-turbo-charged-by LiteSpeed cf-ray 7ed6170d098f9a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	7a1b206739629f4798edf2c8aa0b70e564c29461d4349 world-behind.de/APP-7a1b206739629f4798edf2c8aa0b70e564c29461d4348/	103 KB 18 KB	34ms 34ms	Stylesheet text/css	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://world-behind.de/APP-7a1b206739629f4798edf2c8aa0b70e564c29461d4348/7a1b206739629f4798edf2c8aa0b70e564c29461d4349 Requested by Host: world-behind.de URL: https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rw3xcYvFaJRyf6hctSEuLi4NUBT1AEmKv3R4qi%2FMCTn4NLU1y9OhAbf0UO5TQ77CVbu1I9kdvYA6C2EQTHeRUD1Uab%2B4Lx8W3plzBzefgkedNnFVAGG0JKoDcouhwhqUoHk5fgG7O1m3mQw8Z5A%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170d29d19a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	7a1b206739629f4798edf2c8aa0b70e564c29461d436e world-behind.de/o/	4 KB 2 KB	21ms 20ms	Image image/svg+xml	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://world-behind.de/o/7a1b206739629f4798edf2c8aa0b70e564c29461d436e Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v35tw%2BXLZ69%2FfVVoi%2BYQ%2BNkGFbMMuoTGtONlfznx5M4lA4p3t7%2FE4vUYTLejm8M%2FkDMJrBiJMf8cx9e5%2BCgMiQA2JpI3FGVR08ydaib4rRqFRECcxSUMSfMJn3N7CVCvIphwN9uQV8T1Dhfsd8g%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170d29d39a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	m_.svg world-behind.de/ASSETS/img/	4 KB 2 KB	30ms 30ms	Image image/svg+xml	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://world-behind.de/ASSETS/img/m_.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status MISS last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RbaUrFmefT15E0L6fJ8X2gM6bD9YvzzGi9e4vnncjYJpRL17AU%2FJ2zsgGa9U9yz6dhw0hBPltZBvlAlEWrHCmLwS7qS9ExFiGNivhmML6gKcP0A1EYOKNqMbHnwNX%2F1hJMc1PNK04C71czzvytQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170d29d49a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	sig-op.svg world-behind.de/ASSETS/img/	2 KB 1 KB	37ms 37ms	Image image/svg+xml	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://world-behind.de/ASSETS/img/sig-op.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status MISS last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mpJSTaCGrM3wpIPZBseCkmihYSqK9Ng9IpVAV3u47XWwlAn9I9nw4KT8lysjTbw6ItHNJp4hgHBn2aIX91zljTmABe%2F%2FdaHS0sZPoywPihJjiZ0ihAA25WCkq8OevcsCNhcdVqYwSp17sRlWahs%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170d29d59a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT
GET H3	200	7a1b206739629f4798edf2c8aa0b70e564c29461d434e world-behind.de/x/	2 KB 1 KB	29ms 29ms	Image image/svg+xml	2606:4700:3034::ac43:d09b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://world-behind.de/x/7a1b206739629f4798edf2c8aa0b70e564c29461d434e Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3034::ac43:d09b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language de-DE,de;q=0.9 Referer https://world-behind.de/00c3a7b57527e021f3aa87a8bd014c4964c29461a83e3LOG00c3a7b57527e021f3aa87a8bd014c4964c29461a83e4 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1 Response headers date Thu, 27 Jul 2023 15:59:31 GMT content-encoding br cf-cache-status DYNAMIC last-modified Wed, 26 Jul 2023 16:52:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=svpXIBfCQ3h2obsf6J3B0ejiKKhvuHXO%2BbSzeXDm%2FGzaEbxgQoiYGYOvPqoFgmC3FNT2SAbl3PYax8v63PGxNs0v4LzKecUR2HCaN%2FyRF5OngnL8JRa0dELZDinJbbeakoPQjHeVdgTXV6wE8IE%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed cf-ray 7ed6170d39d69a03-FRA alt-svc h3=":443"; ma=86400 expires Thu, 03 Aug 2023 15:59:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			world-behind.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: 76e3606be986ecdd836544a20234cbf0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

world-behind.de
2606:4700:3034::ac43:d09b
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
61593f44eacab85e975fc59b794d0dc704ad1375b32cd6eda47a7355731d8218
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
c51a1d26e26d82d9074631514003b07eb90dc0f9fcb4234d6808d5b95f53aa72
ccf6eb3b38e39cc647a6aa13af037f8fc93db7f132a178faa68b7613a1b0275b

world-behind.de Open in urlscan Pro 2606:4700:3034::ac43:d09b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

85 kBTransfer

305 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

1 Cookies

Indicators

world-behind.de Open in urlscan Pro
2606:4700:3034::ac43:d09b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

85 kB
Transfer

305 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!