www.aw-medien.de Open in urlscan Pro
2a01:4f8:150:126f::2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://infosystem.hbc-radiomatic.com/ssl?wu
Effective URL:
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin
Submission: On July 05 via manual (July 5th 2020, 7:05:35 pm UTC) from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2a01:4f8:150:126f::2, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.aw-medien.de.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 14th 2020. Valid for: 3 months.

This is the only time www.aw-medien.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Western Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	37.202.4.67 37.202.4.67	15817 (MITTWALD-...) (MITTWALD-AS Mittwald CM Service GmbH und Co. KG)
3 17	2a01:4f8:150:... 2a01:4f8:150:126f::2	24940 (HETZNER-AS) (HETZNER-AS)
14	1

1 37.202.4.67 (Germany) 1 redirects

ASN15817 (MITTWALD-AS Mittwald CM Service GmbH und Co. KG, DE)

infosystem.hbc-radiomatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a01:4f8:150:126f::2 (Germany) 3 redirects

ASN24940 (HETZNER-AS, DE)

www.aw-medien.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	aw-medien.de 3 redirects www.aw-medien.de	376 KB
1	hbc-radiomatic.com 1 redirects infosystem.hbc-radiomatic.com	165 B
14	2

	Domain	Requested by
17	www.aw-medien.de	3 redirects www.aw-medien.de
1	infosystem.hbc-radiomatic.com	1 redirects
14	2

This site contains no links.

Subject Issuer	Validity	Valid
aw-medien.de Let's Encrypt Authority X3	`2020-05-14` - `2020-08-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin
Frame ID: 2983DAB00DEAE67B8EAED9EADCE20185
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://infosystem.hbc-radiomatic.com/ssl?wu HTTP 302
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/?=ssl HTTP 302
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu HTTP 301
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/ HTTP 302
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

376 kB
Transfer

1239 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://infosystem.hbc-radiomatic.com/ssl?wu HTTP 302
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/?=ssl HTTP 302
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu HTTP 301
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/ HTTP 302
https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request signin Show response www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/ Redirect Chain https://infosystem.hbc-radiomatic.com/ssl?wu https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/?=ssl https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/ https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin	41 KB 8 KB	2643ms 2642ms	Document text/html	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `3bfc65541e9385d1999398b5df57f20cb03fcaedad712cb196c87e9dc2d18c6c` Request headers :method GET :authority www.aw-medien.de :scheme https :path /wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server nginx date Sun, 05 Jul 2020 19:05:11 GMT content-type text/html; charset=UTF-8 content-length 8405 vary Accept-Encoding content-encoding gzip x-powered-by PleskLin Redirect headers status 302 server nginx date Sun, 05 Jul 2020 19:05:08 GMT content-type text/html; charset=UTF-8 content-length 0 location signin x-powered-by PleskLin
GET H2	200	angular.min.js Show response www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/	163 KB 66 KB	3934ms 3933ms	Script application/javascript	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/angular.min.js Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:15 GMT content-encoding gzip last-modified Sun, 19 Nov 2017 21:55:28 GMT server nginx x-powered-by PleskLin etag W/"5a11fdd0-28cdb" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	jquery.min.js Show response www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/	286 KB 102 KB	4020ms 4019ms	Script application/javascript	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/jquery.min.js Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:15 GMT content-encoding gzip last-modified Sun, 03 Dec 2017 22:11:38 GMT server nginx x-powered-by PleskLin etag W/"5a24769a-478d0" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	jquery.validate.min.js Show response www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/	49 KB 16 KB	3736ms 3735ms	Script application/javascript	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/jquery.validate.min.js Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `ce0fe7f95d80802ce6db03b2d255ca1878f0f4be17048aaed326946d30804b61` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:15 GMT content-encoding gzip last-modified Sat, 29 Dec 2018 18:19:14 GMT server nginx x-powered-by PleskLin etag W/"5c27baa2-c3f1" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	jquery.mask.js Show response www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/	18 KB 6 KB	3765ms 3764ms	Script application/javascript	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/jquery.mask.js Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:15 GMT content-encoding gzip last-modified Sun, 31 Jan 2016 06:57:28 GMT server nginx x-powered-by PleskLin etag W/"56adb058-47fe" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	style.js Show response www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/	2 KB 1 KB	3816ms 3816ms	Script application/javascript	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/style.js Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:15 GMT content-encoding gzip last-modified Wed, 16 Jan 2019 22:34:12 GMT server nginx x-powered-by PleskLin etag W/"5c3fb164-8bf" vary Accept-Encoding content-type application/javascript status 200
GET H2	200	responsive_css.min.css www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	645 KB 144 KB	3952ms 3951ms	Stylesheet text/css	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/responsive_css.min.css Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `1b569082f494e574b17873d77d5e1db4e7f7bef6e1063099463eebac2407255d` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:15 GMT content-encoding gzip last-modified Thu, 29 Aug 2019 23:51:46 GMT server nginx x-powered-by PleskLin etag W/"5d686512-a1351" vary Accept-Encoding content-type text/css status 200
GET H2	200	logo.wu.big.svg www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	4 KB 2 KB	4155ms 4155ms	Image image/svg+xml	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/logo.wu.big.svg Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `a429e88fb3c60ba945bd70230f4b38c857342b15a7f1934f868c5f830eca7255` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:19 GMT content-encoding gzip last-modified Mon, 18 Feb 2019 02:34:24 GMT server nginx x-powered-by PleskLin etag W/"5c6a19b0-1168" vary Accept-Encoding content-type image/svg+xml status 200
GET H2	200	icon-sm-facebook.png www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	342 B 511 B	4385ms 4384ms	Image image/png	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/icon-sm-facebook.png Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `bab161ca346ecfc2d92f8035cafa2a0448fa6efb6816c32d6a2aee55b0628c35` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:19 GMT etag "156-57f39f727d700" last-modified Sat, 12 Jan 2019 02:57:00 GMT server nginx x-powered-by PleskLin content-type image/png status 200 x-accel-version 0.01 accept-ranges bytes content-length 342
GET H2	200	icon-sm-youtube.png www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	600 B 769 B	4161ms 4160ms	Image image/png	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/icon-sm-youtube.png Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `e9bc91eb9c42d58853f009f0076d4d3f462c066860b6dcd12ba64bc321b11b1c` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:19 GMT etag "258-57f39f7465b80" last-modified Sat, 12 Jan 2019 02:57:02 GMT server nginx x-powered-by PleskLin content-type image/png status 200 x-accel-version 0.01 accept-ranges bytes content-length 600
GET H2	200	icon-sm-instagram.png www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	1 KB 1 KB	4224ms 4223ms	Image image/png	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/icon-sm-instagram.png Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `5e0120b92d7795162c66cdba045e02b6a20b5b8fd576c0a29aff905844177f8f` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:19 GMT last-modified Sat, 12 Jan 2019 02:57:04 GMT server nginx x-powered-by PleskLin etag "5c395780-479" content-type image/png status 200 accept-ranges bytes content-length 1145
GET H2	200	icon-sm-twitter.png www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	793 B 962 B	4354ms 4354ms	Image image/png	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/icon-sm-twitter.png Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `7fb88f60e778fc1c415ee2d5662a12480c63f635f06d4f7b68b500a8e9c8c6f9` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/signin User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:19 GMT etag "319-57f39f7836480" last-modified Sat, 12 Jan 2019 02:57:06 GMT server nginx x-powered-by PleskLin content-type image/png status 200 x-accel-version 0.01 accept-ranges bytes content-length 793
GET H2	200	wuspinner.gif www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	10 KB 10 KB	4275ms 4275ms	Image image/gif	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/wuspinner.gif Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/jquery.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `730d7bc1118f9e1393794b0bd07926625801b63d739dfdc59cb08f3ebe3b6e5b` Request headers Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/responsive_css.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 05 Jul 2020 19:05:19 GMT last-modified Sat, 12 Jan 2019 04:49:50 GMT server nginx x-powered-by PleskLin etag "5c3971ee-261a" content-type image/gif status 200 accept-ranges bytes content-length 9754
GET H2	200	glyphicons-halflings-regular.woff2 www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/	18 KB 18 KB	4220ms 4220ms	Font font/woff2	2a01:4f8:150:126f::2 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/glyphicons-halflings-regular.woff2 Requested by Host: www.aw-medien.de URL: https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/js/jquery.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f8:150:126f::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / PleskLin Resource Hash `fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.aw-medien.de/wp-content/cjt-content/ssl/Uberprufen/Home/Wu/style/css/responsive_css.min.css Origin https://www.aw-medien.de Response headers date Sun, 05 Jul 2020 19:05:19 GMT last-modified Sat, 12 Jan 2019 03:00:18 GMT server nginx x-powered-by PleskLin etag "5c395842-466c" content-type font/woff2 status 200 accept-ranges bytes content-length 18028

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Western Union (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| angular function| $ function| jQuery function| preventBack

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

infosystem.hbc-radiomatic.com
www.aw-medien.de
2a01:4f8:150:126f::2
37.202.4.67
1b569082f494e574b17873d77d5e1db4e7f7bef6e1063099463eebac2407255d
3bfc65541e9385d1999398b5df57f20cb03fcaedad712cb196c87e9dc2d18c6c
5e0120b92d7795162c66cdba045e02b6a20b5b8fd576c0a29aff905844177f8f
692d421d5c163409a5918e802f507abbaa6bec90baa454c5252977a5b3b7ff0d
730d7bc1118f9e1393794b0bd07926625801b63d739dfdc59cb08f3ebe3b6e5b
7fb88f60e778fc1c415ee2d5662a12480c63f635f06d4f7b68b500a8e9c8c6f9
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9
a429e88fb3c60ba945bd70230f4b38c857342b15a7f1934f868c5f830eca7255
bab161ca346ecfc2d92f8035cafa2a0448fa6efb6816c32d6a2aee55b0628c35
ce0fe7f95d80802ce6db03b2d255ca1878f0f4be17048aaed326946d30804b61
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a
e9bc91eb9c42d58853f009f0076d4d3f462c066860b6dcd12ba64bc321b11b1c
f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

www.aw-medien.de Open in urlscan Pro 2a01:4f8:150:126f::2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

376 kBTransfer

1239 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

www.aw-medien.de Open in urlscan Pro
2a01:4f8:150:126f::2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

376 kB
Transfer

1239 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!